What Risk Management Involves
Risk management is the identification, assessment, and prioritization of risks. Managing risk is one of the key responsibilities of every manager within the organization.
In any well-developed risk management program, two formal processes are at work:
Find the assets, threats, and vulnerabilities, then measure and prioritize the risks.
Choose and apply cost-effective controls to reduce the risks.
The risk management cycle
| Phase | Activities |
|---|---|
| Risk identification | Identify · Measure · Prioritize |
| Control measures | Cost/benefit analysis |
Risk identification works on three elements: threat, vulnerability, and asset.
Accountability: The Communities of Interest
Communities of interest must work together to manage risk. Each has a distinct role:
Who does what?
Security leads, IT builds, management funds and prioritizes, users detect. A question about budget points to management; a question about noticing a phishing email points to users.
Steps in Risk Management
Identify risks
Using the threat–vulnerability matrix and asset impact.
Assess risks
Quantitative or qualitative.
Evaluate the risk controls (CBA model)
Determine which control options are cost-effective.
Acquire or install the appropriate controls
Oversee processes
Ensure the controls remain effective.
Summarize the findings
Asset Identification and Inventory
Risk identification begins with an asset inventory:
- Identify information assets, including people, procedures, data and information, software, hardware, and networking elements.
- Do this without pre-judging the value of each asset: values are assigned later in the process.
- Determine which attributes of each asset should be tracked.
Potential attributes by asset type
| Physical devices | People | Procedures | Data |
|---|---|---|---|
| Name | Position name/number/ID | Description | Classification (sensitive, confidential, private, public) |
| Asset tag | Supervisor name/number/ID | Intended purpose | Owner / creator / manager |
| IP address | Security clearance level | Software/hardware/networking elements it is tied to | Size of data structure |
| MAC address | Special skills | Where it is stored for reference | Data structure used |
| Asset type; serial number | Where it is stored for update purposes | Online or offline | |
| Manufacturer name; model or part number | Location | ||
| Software version, update revision, or FCO number | Backup procedures | ||
| Physical / logical location; controlling entity |
Tools
Asset inventories can be supported by tools such as a network asset tracker and asset management software.
Don't value too early
Identification must be done without pre-judging each asset's value. Valuation comes after the inventory is complete.
Classifying and Categorizing Assets
- Determine or refine an asset classification scheme.
- A classification scheme categorizes information assets based on their sensitivity and security needs.
- Each category designates the level of protection needed for a particular asset.
- Some asset types, such as personnel, may require an alternative classification scheme.
- Classification categories must be comprehensive and mutually exclusive.
Memory trick · Good categories
Comprehensive + Mutually exclusive
every asset fits somewhere, and no asset fits in two places.
| Data classification | Typical meaning |
|---|---|
| Sensitive | Highest protection; serious harm if disclosed |
| Confidential | Internal use by authorized staff only |
| Private | Personal information about individuals |
| Public | Can be freely released |
Asset Valuation and Ranking
Determine the values of assets by assigning a relative value: comparative judgments made so that the most valuable information assets are given the highest priority.
Factors to consider
Questions for assessing asset value
Which asset is the most critical to the success of the organization?
Which asset generates the most revenue?
Which asset generates the highest profitability?
Which asset is the most expensive to replace?
Which asset is the most expensive to protect?
Whose loss or compromise would be most embarrassing or cause the greatest liability?
Weighted factor analysis
A weighted factor analysis worksheet turns these questions into numbers: each criterion gets a weight (weights total 100), each asset gets a score per criterion (e.g. 0.1–1.0), and the asset's weighted score is the sum of score × weight.
FormulaWeighted score = Σ (criterion score × criterion weight)
| Asset (illustration) | Revenue (30) | Profitability (40) | Public image (30) | Weighted score |
|---|---|---|---|---|
| Customer order database | 1.0 | 0.9 | 0.5 | 30 + 36 + 15 = 81 |
| Public website | 0.8 | 0.6 | 1.0 | 24 + 24 + 30 = 78 |
| Internal wiki | 0.2 | 0.3 | 0.2 | 6 + 12 + 6 = 24 |
Asset ranking then prioritizes the assets according to value: the highest weighted score is protected first.
Threat and Vulnerability Identification
After ranking the assets, the threats and vulnerabilities are assessed as in Chapter 3. The outcome is a threat–vulnerability matrix, and threats are prioritized based on their score for each asset.
Vulnerability assessment examples
| Asset | Vulnerability | Threat |
|---|---|---|
| Email servers | Anti-virus software not updated | Virus attack |
| Router | Incorrect router configuration | Network susceptible to reduction or loss of connectivity |
Read the pattern
Each row is one threat/vulnerability pair on one asset. That is exactly the unit the TVA worksheet records.
The TVA Worksheet
At the end of the risk identification process you have two lists:
A list of assets and their vulnerabilities, prioritized by asset value.
A list that prioritizes the threats facing the organization, based on the weighted table.
These lists are combined into a single worksheet: the Threat–Vulnerability–Asset (TVA) worksheet. Assets are listed along one axis in order of priority, threats along the other in order of priority, and each intersection records the vulnerabilities (T#V#A#) where that threat meets that asset.
| Asset 1 (most valuable) | Asset 2 | Asset 3 | |
|---|---|---|---|
| Threat 1 (most dangerous) | T1V1A1, T1V2A1 | T1V1A2 | — |
| Threat 2 | T2V1A1 | T2V1A2, T2V2A2 | T2V1A3 |
| Threat 3 | — | T3V1A2 | T3V1A3 |
Where to start
The top-left of the TVA worksheet (most valuable asset × most dangerous threat) holds the highest-priority vulnerabilities.
What is next? Risk assessment, either quantitative or qualitative, which Chapter 5 covers.
Exam Tips & Tricks
Two formal processes
Risk identification and assessment, and risk control.
Communities of interest
Cyber security leads; IT builds and maintains secure systems; management allocates resources and prioritizes; users detect and respond early.
Six steps
Identify, assess, evaluate controls (CBA), acquire/install controls, oversee effectiveness, summarize findings.
Inventory rule
Identify people, procedures, data, software, hardware, networking without pre-judging value.
Classification rule
Categories based on sensitivity and security needs; comprehensive and mutually exclusive.
Valuation factors
Cost, impact on profitability, revenue, and public image. Assign relative values.
Weighted analysis
Weighted score = Σ score × weight; rank assets by the result.
TVA worksheet
Combines prioritized assets/vulnerabilities with prioritized threats; next step is risk assessment.
Flashcards — Test Yourself
Say the answer out loud, then flip the card to check. Shuffle the deck to test yourself in a new order.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Risk management | Identification, assessment, and prioritization of risks. |
| Formal processes | Risk identification and assessment; risk control. |
| Risk management cycle | Risk identification (identify, measure, prioritize) and control measures (CBA). |
| Cyber security role | Leadership in addressing risk. |
| IT role | Build and maintain secure systems. |
| Management role | Resource allocation and prioritization. |
| Users role | Early detection and proper response to threats. |
| Asset categories | People, procedures, data/information, software, hardware, networking. |
| Device attributes | Name, asset tag, IP, MAC, type, serial number, manufacturer, model, version, location, controlling entity. |
| People attributes | Position, supervisor, security clearance, special skills. |
| Data attributes | Classification, owner, size, structure, online/offline, location, backup procedures. |
| Classification scheme | Based on sensitivity/security needs; comprehensive and mutually exclusive. |
| Valuation factors | Cost, profitability, revenue, public image. |
| Weighted factor analysis | Criteria weights × asset scores, summed and ranked. |
| Threat–vulnerability matrix | Output of threat identification; prioritizes threats per asset. |
| TVA worksheet | Threat–Vulnerability–Asset worksheet combining both prioritized lists. |