Principle Methods of Risk Management

Project Name: Principle Methods of Risk Management

Description: – Cyber Risk Management is revolved around categorization of controls, selecting security controls, Implementation controls &  monitoring of security controls. This blog will explain methods of risk management. Principle Methods of Risk Management is a exercise in which risks are identified and ruled proactively. It allows enterprises to enhance their chances of success by minimizing threats and maximizing opportunities.

Author: Rohit D Sadgune / Amruta Sadgune

FAQ:-

1. What are the principle risk assessment activities?
2. What are system characterization?
3. What is threat identification?
4. What is vulnerability Identification?
5. What is control analysis and likelihood determination?
6. Understanding Impact analysis
7. What is risk determination?
8. What is control recommendations?
9. Why documentation of results is required?

Risk Assessment Activities

Risk Comprises of a situation which involves exposure to danger, harm or a loss. Risk assessment in simple terms is nothing but the evaluation of a specific situation. Below are the simple steps described to understand the steps considered for the proper risk assessment.

• System Characterization

Defines the resources and the environment considered to make the system. This should involve the possible systems which may be exposed to threat.

Input

1. Hardware
2. Software
3. System Interfaces
4. Data and Information
5. People
6. System Missions

Output

1. System Boundary
2. System Functions
3. System and Data Criticality
4. System and Data Sensitivity

• Threat Identification

Once the possible systems are identified which are vulnerable to loss then a decision can be made on how to protect them from possible risks. Various methods can be considered in order to understand the sources of the attacks. Threat can be categorized as physical or logical threats depending upon the affected system.

 Input

1. History of System Attacks
2. Data  from Intelligence agencies

Output

Threat Statement

• Vulnerability Identification

Understanding the vulnerable areas in the organization.

Input

1. Reports from prior risk assessment
2. Any audit Comments
3. Security requirement
4. Security test results

Output

List of potential vulnerabilities

• Control Analysis

This phase includes assessment of controls which are already in place and planned. The output is used to identify the likelihood of vulnerability.

Input

1. Current Controls
2. Planned Controls

Output

List of Current and Planned Controls

• Likelihood Determination

Probability that the vulnerability could be exploited by a threat.

 Input

1. Threat source motivation
2. Threat Capacity
3. Nature of Vulnerability
4. Current Controls

Output

Likelihood Ratings

• Impact Analysis

Understanding the scope of the vulnerability which would affect the organization. This should assume the worst case scenarios

Input

1. Mission impact Analysis
2. Asset Criticality Assessment
3. Data Criticality
4. Data sensitivity

Output

Impact Rating

• Risk Determination

Determination of the estimation of the risk including the probability of the loss or magnitude

Input

1. Likelihood of threat exploitation
2. Magnitude of impact
3. Adequacy of Planned or current controls      

Output

Risk Associated Risk Levels

• Control Recommendations

Measures in order to control the vulnerability to Risk

Output

          Recommended Controls

• Results Documentations

Documentation is an important aspect for tracking the analysis and findings to community or an organization.

Output

Risk Assessment Report