Introduction to Risk Management

It explain the fact that the risk management process should live together with the other parts of the company. So it should be pervasive in order to protect properly the assets increasing the value of them.

It should be not made like an improvisation, but it has to be at least conceptually structured, so to know the purpose of each activity and the role of each actor. Comprehensive means that the risk management process must take into account the whole reality of the organization.

Each company is different, and has different internal structure and processes. So the risk management process has to be customized to be efficient and effective. The customization should be done also looking to the external context, like dependencies, partners and providers.

The process must involve all the people that are interested, and may benefit from the result of the analysis. That’s important because most incident comes from lack of awareness.

In the context of cyber the world changes very rapidly, so the process can’t be static but it has to evolve during time.

The information used have to be of high quality, that can confirm the analysis, provide multiple perspective and tell more about the incident. So they must be timely, clear and available. Sometimes having a lot of low quality information is worse than having less high quality one. The information gathering has to be continuous to ensure the improvement of the process. Ideally the information gained should be validated.

Behind the risk management process there are people, so it is possible that the assessment produced can be influenced be their opinion and interpretation of the data. It is not a problem that can be solve in a deterministic way, because there is always a subjectivity point.

The risk management process is not static, it has to improve during time reacting to changes and correcting possibly misbehavior.

Design of the process itself, which activities and how they should flow during time.

Move from theory to practice

Evaluate the process to improve it.

After the evacuation of the process improvements are designed.

Integrate the improvements.

The hard part of the implementation is the customization on the process to be adapted to the company.

Is the set of process composed of all the action performed to communicate the outcome of the analysis to increase the level of awareness. The communication should be done in a structured way, so identify the procedures on how to collect data and how to communicate them from and for the process. The communication process should support all the actions of the risk management process.

It is the set of activities aimed to improve the quality of the process. So observe, get and interpret data acquired from the process and use them to improve the process itself. Also this part has to monitor and review every part of the process.

It is a good practice that helps the company to take snapshots of the risk management process. It can be considered like a log mechanism used to create historical data and support during the analysis.

These four aspects have to work together to guarantee and adequate, effective and efficient process.

It is the first activity, it consists of the identification of the context relevant for the assessment considering internal and external factors. Internal factors take into account internal standards, policies and procedures, where external factors are represented by law and regulations. The outcome is composed by different parts: the target of assessment, then the boundaries are refined considering the perimeter of the analysis to be performed. The focus is the main issue or central area of attention in a risk assessment. it is important to keep track of the assumption taken during each step. Assumptions are taken for granted or accepted as true about the system in question. At the end of the task the outcome is the formalization of the context, that is a document that contains who is the client (people that asked to perform the assessment), the assumptions taken, the relevant assets that will be analyzed and the scale used to measure the risk, so how the risk value is evaluated and how to measure consequences and likelihood.

The risk identification is the set of activities aiming to identify, describe, and document risks and possible causes of risk.

In this phase We have to identify all the possible causes of a incident, and the way in which the incident may became concrete. Some observation are taken into account:

1. A risk is always associated with an incident.
2. There are three elements without which there can be no risk: assets, vulnerability and threat. To an incident to became true there are to be present all of three components.

The scope is to identify, starting from the assets, all the possible incidents that have associated some real threats and vulnerabilities; establishing the likelihood. A risk is present if there is a vulnerability in the system, a threat source and a threat.

Considering the cyber world, the presence of a vulnerability inside a system can lead to a domino effect.

The risk analysis is the activity aiming to estimate and determine the level of the identified risks.

The number associated with the risk is a function of the likelihood and the consequences of it. So to estimate a risk we have to estimate its likelihood and consequences.

The risk evaluation is the set of activities involving the comparison of the risk analysis results with the risk evaluation criteria to determine which risks should be considered for treatment.

in this phase, all the risks identified are considered as a whole, to check if there are some correction to perform. It is composed by four activities.

• Consolidation. Evaluate how much the estimation of the risk is impacted by uncertainty; theoretically We want a 0 level of doubt, but in reality it is impossible because statistical tools are used in the identification phase. Of course if the error is low the overall impact will be low; if it high it might be needed to perform additional analysis to reduce it at an acceptable level.
• Evaluate the risk level. Look where the risk is placed in the risk matrix, to make a prioritization.
• Risk aggregation. We’ll see the single risks can be aggregated to consider a general one, where few individual risks that stay in the green part but taken together or in sequence can be considered as red. Another criteria of aggregation can be to look on different incidents that can impact a single asset.
• Risk grouping. Risk can be grouped if they have common elements, like if they are caused by the same set of vulnerabilities.

The risk treatment is the set of activities aiming to identify and select means for risk mitigation and reduction.

This is the last step of the assessment process. Ideally we would manage each risk in the matrix, but practically it is not possible, because there are monetary, time and other constraints. In summary resolving a risk can be less affordable than accepting it.

There are four main options for risk treatment.

• Risk Reduction. It is the most common option to apply, it consist on trying to find which are the elements to be put in place to reduce the likelihood or the impact.
• Risk Retention. It is applied when solving the risk is more costly than accepting it; or when the risk has little likelihood and low impact or the impact is not critical.
• Risk Avoidance. In this case there is so active acting on the assets, but policies are put in place to be sure that the risk can’t arise in the first place, like a defensive barrier around the asset; acting on the root cause of the threat.
• Risk Sharing. This option consist on transferring part of the consequences to another party, like an insurance company or a sub-contract. This option is adopted in case of black swan: incidents with huge impact but little likelihood.