Module 1.2: Risk Management Process

Learning Objectives

By the end of this module, you will:

• Define all key risk terminology and their relationships
• Explain the risk management lifecycle
• Differentiate qualitative from quantitative risk assessment
• Identify and explain all four risk treatment options
• Understand risk appetite, tolerance, and how they guide decisions
• Apply risk concepts to real-world scenarios

---

What is Risk?

Definition: Risk is the possibility of something bad happening, combined with how bad it would be if it did happen.

Formal: Risk = Likelihood × Impact (of a threat exploiting a vulnerability to harm an asset)

The Building Analogy

Imagine you're building a house:

• Asset: Your house (what you're protecting)
• Threat: A hurricane (what could cause harm)
• Vulnerability: The house has no storm shutters (weakness)
• Risk: The hurricane could destroy your unprotected windows
• Likelihood: You live in Florida (hurricanes are frequent) = HIGH
• Impact: Destroyed windows → water damage → $50,000 = HIGH
• Risk level: HIGH × HIGH = CRITICAL → you need storm shutters (control)

If you lived in Colorado (low hurricane likelihood), the risk drops even though the vulnerability still exists.

---

Key Risk Terminology

| Term | Definition | Example | |------|-----------|---------| | Asset | Anything of value | Customer database, server, building, employee, reputation | | Threat | Potential cause of unwanted incident | Hacker, earthquake, disgruntled employee, malware | | Threat agent/actor | Entity that carries out the threat | Script kiddie, nation-state, insider, natural disaster | | Vulnerability | Weakness that can be exploited | Unpatched software, weak password, unlocked door | | Risk | Likelihood × Impact | Probability of ransomware encrypting unpatched server | | Exposure | Extent an asset is exposed to threats | Internet-facing server has more exposure than air-gapped | | Countermeasure/Safeguard | Control that reduces risk | Firewall, patch, training, lock | | Residual risk | Risk remaining AFTER controls are applied | Never zero! | | Inherent risk | Risk BEFORE any controls | The raw, unmitigated risk |

The Risk Equation Visualized

THREAT exploits → VULNERABILITY in → ASSET → causes IMPACT
    ↑                                              ↓
LIKELIHOOD (probability)              RISK = Likelihood × Impact
    ↓
COUNTERMEASURE (reduces likelihood or impact)
    ↓
RESIDUAL RISK (what remains after controls)

Threat Categories

| Category | Subcategory | Examples | |----------|-------------|----------| | Natural | Weather, geological | Hurricane, earthquake, flood, tornado, wildfire | | Human - Intentional | Malicious actors | Hackers, terrorists, disgruntled employees, competitors | | Human - Unintentional | Accidents/errors | Misconfiguration, accidental deletion, lost laptop | | Environmental/Technical | Infrastructure | Power failure, HVAC failure, hardware crash, network outage |

---

Risk Management Lifecycle

┌─────────────────────────────────────────────────────┐
│                                                       │
│   IDENTIFY → ASSESS → TREAT → MONITOR → (repeat)    │
│                                                       │
└─────────────────────────────────────────────────────┘

Phase 1: Risk Identification

• Goal: Find all risks that could affect the organization
• Methods:
• Vulnerability scanning (automated discovery of weaknesses)
• Penetration testing (simulated attacks)
• Threat modeling (systematic analysis of threats)
• Asset inventories (you can't protect what you don't know about)
• Interviews and workshops with stakeholders
• Review of past incidents and industry threat intelligence
• Audit findings
• Output: Risk register (master list of identified risks)

Phase 2: Risk Assessment

• Goal: Determine how likely each risk is and how bad it would be
• Methods: Qualitative, quantitative, or hybrid analysis
• Output: Prioritized risk list (which risks need attention first)

Phase 3: Risk Treatment

• Goal: Decide what to do about each risk
• Options: Avoid, Mitigate, Transfer, Accept
• Output: Risk treatment plan (who does what by when)

Phase 4: Risk Monitoring

• Goal: Track risks over time, detect new risks, verify controls work
• Methods: Continuous monitoring, periodic reviews, KRI (Key Risk Indicators)
• Output: Updated risk register, management reports

> 📝 Critical Concept: Risk management is CONTINUOUS, not one-time. The threat landscape changes constantly.

---

Risk Assessment: Qualitative vs Quantitative

Qualitative Risk Assessment

Uses subjective ratings to evaluate risk. Faster, easier, but less precise.

Risk Matrix Example:

| | Low Impact | Medium Impact | High Impact | |---|---|---|---| | High Likelihood | Medium Risk | High Risk | Critical Risk | | Medium Likelihood | Low Risk | Medium Risk | High Risk | | Low Likelihood | Low Risk | Low Risk | Medium Risk |

Likelihood Scale: | Rating | Meaning | Approximate Frequency | |--------|---------|----------------------| | High | Very likely to occur | Multiple times per year | | Medium | Possible | Once per year | | Low | Unlikely | Once in several years | | Very Low | Rare | Once in a decade or less |

Impact Scale: | Rating | Financial | Operational | Reputation | |--------|-----------|-------------|------------| | High | >$1M | Critical systems down | National news coverage | | Medium | $100K-$1M | Significant disruption | Regional/industry news | | Low | <$100K | Minor inconvenience | Internal awareness only |

Quantitative Risk Assessment

Uses numerical values and financial calculations. More precise, but requires more data.

Key Formulas:

| Formula | Meaning | Example | |---------|---------|---------| | AV (Asset Value) | What's the asset worth? | Server = $50,000 | | EF (Exposure Factor) | % of asset lost in incident | Flood damages 40% = 0.4 | | SLE = AV × EF | Single Loss Expectancy | $50,000 × 0.4 = $20,000 | | ARO (Annual Rate of Occurrence) | How often per year? | Flooding = 0.1 (once per 10 years) | | ALE = SLE × ARO | Annual Loss Expectancy | $20,000 × 0.1 = $2,000/year |

Cost-Benefit Analysis: A control is justified if its annual cost < ALE reduction it provides.

• ALE before control: $2,000
• ALE after control: $200
• Savings: $1,800/year
• Control cost: $500/year
• Net benefit: $1,300/year → JUSTIFIED

When to Use Each

| Qualitative | Quantitative | |-------------|-------------| | Quick initial assessment | When precise financial data needed | | Limited data available | Justifying expensive controls to management | | Many risks to evaluate | Insurance decisions | | Broad prioritization | Budget allocation | | Most common on CC exam | Awareness level for CC exam |

---

Risk Treatment Options

1. Risk Avoidance

Definition: Eliminate the risk entirely by not engaging in the risky activity.

Examples:

• Don't store credit card numbers → eliminates PCI compliance risk
• Don't allow employees to use personal devices → eliminates BYOD risk
• Don't build data center in flood zone → eliminates flood risk

When appropriate: When risk is too high and no acceptable mitigation exists, OR when the activity isn't essential.

Downside: May miss business opportunities.

2. Risk Mitigation (Reduction)

Definition: Reduce either the likelihood or the impact (or both) of a risk.

This is the MOST COMMON response.

Examples:

• Install firewall → reduces likelihood of network intrusion
• Implement MFA → reduces likelihood of unauthorized access
• Deploy backups → reduces impact of data loss
• Security training → reduces likelihood of phishing success
• Patch systems → reduces likelihood of exploitation

3. Risk Transfer (Sharing)

Definition: Shift the risk (usually financial impact) to a third party.

Examples:

• Cyber insurance → transfers financial impact to insurer
• Outsourcing to MSP → transfers operational risk (partially)
• SLAs with vendors → contractually transfers availability risk
• Cloud services → transfers some infrastructure risk

Important: You can transfer FINANCIAL impact, but you can NEVER transfer ACCOUNTABILITY. If your customer data is breached at a vendor, YOU are still accountable to your customers.

4. Risk Acceptance

Definition: Acknowledge the risk and choose not to take further action.

Requirements for proper risk acceptance:

• Risk must be formally documented
• Must be approved by management (risk owner)
• Must be within organizational risk tolerance
• Must be reviewed periodically
• Residual risk after other treatments may be accepted

Examples:

• Small website with no sensitive data → accept risk of defacement (cost to protect exceeds cost of incident)
• Legacy system being retired in 6 months → accept known vulnerability rather than expensive patch

> ⚠️ Exam Trap: "Do nothing" without formal documentation is NOT risk acceptance—it's negligence. Proper acceptance requires a conscious, documented decision by an authorized person.

---

Risk Appetite, Tolerance, and Threshold

| Concept | Definition | Analogy | |---------|-----------|---------| | Risk Appetite | Amount of risk an org is WILLING to take | "I'm comfortable driving 70mph" | | Risk Tolerance | Acceptable VARIATION from desired risk level | "I'm okay anywhere from 65-75mph" | | Risk Threshold | The MAXIMUM level before action is required | "At 80mph, I must slow down" |

Who defines these?: Senior leadership/Board of Directors (strategic decision)

Impact on security:

• High appetite: Fewer controls, faster innovation, more risk
• Low appetite: More controls, more restrictions, less risk
• Financial institutions typically have LOW risk appetite
• Startups typically have HIGHER risk appetite

---

Risk Identification Methods

Vulnerability Assessment

• Automated scanning of systems for known weaknesses
• Tools: Nessus, Qualys, OpenVAS
• Identifies but does NOT exploit vulnerabilities
• Non-intrusive, safe to run on production

Penetration Testing

| Type | Knowledge | Simulates | |------|-----------|-----------| | Black box | No prior knowledge | External attacker | | White box | Full system knowledge | Insider threat | | Gray box | Partial knowledge | Semi-privileged attacker |

• Actively EXPLOITS vulnerabilities (with permission)
• Proves real-world impact
• More invasive, requires careful scoping

Threat Modeling

• Systematic identification of threats to a system/application
• STRIDE model (Microsoft):
• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

---

NIST Risk Management Framework (RMF)

1. CATEGORIZE → What type of system? What's its impact level?
2. SELECT → Choose appropriate security controls
3. IMPLEMENT → Deploy the selected controls
4. ASSESS → Verify controls work correctly
5. AUTHORIZE → Management accepts the residual risk
6. MONITOR → Continuous oversight and updating

Key point: RMF is a CONTINUOUS cycle, not a one-time activity.

---

The Risk Register

A living document that tracks all identified risks:

| Field | Purpose | |-------|---------| | Risk ID | Unique identifier | | Description | What could happen | | Category | Type (technical, operational, etc.) | | Likelihood | How probable | | Impact | How damaging | | Risk level | Combined rating | | Risk owner | Who's responsible | | Treatment | Avoid/mitigate/transfer/accept | | Controls | What's being done | | Status | Open/mitigated/closed | | Review date | When to reassess |

---

Practice Questions

1. An organization decides to purchase cyber insurance. Which risk treatment is this?

• A) Avoidance
• B) Mitigation
• C) Transfer ✅
• D) Acceptance

2. What is residual risk?

• A) Risk before any controls
• B) Risk that remains after controls are applied ✅
• C) The maximum acceptable risk
• D) Risk that has been transferred

3. SLE = $100,000 and ARO = 0.5. What is the ALE?

• A) $200,000
• B) $100,000
• C) $50,000 ✅
• D) $500,000

4. Which risk treatment is MOST appropriate when a vulnerability exists in a system being decommissioned next month?

• A) Avoidance
• B) Transfer
• C) Acceptance ✅ (documented, time-limited)
• D) Mitigation

5. Who has the authority to accept risk on behalf of the organization?

• A) The security analyst
• B) The system administrator
• C) Senior management/risk owner ✅
• D) The auditor

6. A company decides not to collect customer credit card numbers, using a third-party payment processor instead. This is:

• A) Risk mitigation
• B) Risk avoidance ✅
• C) Risk transfer
• D) Risk acceptance

7. What does a qualitative risk assessment use?

• A) Dollar values and formulas
• B) Subjective ratings like High/Medium/Low ✅
• C) Annual loss expectancy
• D) Return on investment calculations

8. Risk appetite is BEST defined as:

• A) The maximum risk level that triggers action
• B) The amount of risk an organization is willing to take ✅
• C) The risk remaining after controls
• D) The probability of threat occurrence

9. Which phase of the NIST RMF involves verifying that controls work correctly?

• A) Select
• B) Implement
• C) Assess ✅
• D) Monitor

10. An organization outsources its email to a cloud provider. A data breach occurs at the provider. Who is ACCOUNTABLE to affected customers?

• A) The cloud provider only
• B) Both equally
• C) The organization that owns the customer relationship ✅
• D) Neither—it's the customers' responsibility

---

*End of Module 1.2 - Next: 1.3 Security Controls*