Cyber Security Compliance and IT Jobs
We talk about the Cybersecurity IT Job Market and the impact of Covid-19. We also breakdown the differences between Risk Management Framework and Risk Assessment
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Google Podcasts | Pandora | iHeartRadio | Stitcher | TuneIn | Deezer | RSS
NIST SP 800-39 deals entirely with fixing the challenge of security risk in an organization. Chapter 2 of 800-39 discusses the basics of security risk management & chapter 3 goes into the process of applying security risk management across and organization.
The Fundamentals of Security Risk Management (Chapter 2, 800-39)
The philosophy security risks and how to manage information security at multiple levels of an organization are discussed in Chpt 2 of NIST SP 800-39. The three layers of security risk are:
Tier 1: Organization Level security risk management
Tier 1 addresses security risk from the organizations perspective. This include the implementation of the first component of security risk management which is called risk framing.
In tier 1 or security risk management, the management of the organization establishes governance structure that are in compliance with laws, regulations and policies. Tier 1 activities include establishment of the Risk Executive Function, establishment of the risk management strategy and determination of the risk tolerance.
Security Risk framing provides context for all the security risk activities within an organization, which affects the risk tasks of tier 1 & 2. The result of risk framing is Security Risk Management Strategy.
Security Risk Management Tier 2: Mission/Business Process
Tier 2 Security risk management tasks include: 1) defining the mission processes. 2) Prioritize the mission process with respect to the long term goals of the organization. 3) Define the type of information needed to successfully execute the mission/business processes, critical/sensitivity of the information and the information flows both internal and external of the information.
Tier 3: Information System Security Risk management
From the information system perspective, tier 3 addresses the following tasks:
Chapter 3 focuses on the step to have a comprehensive security risk management program. The tasks discussed include:
Risk Assessment
NIST 800-30 goes into Risk Assessment process. 800-39 covers from a high level. Risk assessment is threat & vulnerability identification and risk determination. Organizational risk framing is a prerequisite to risk assessments, because methods of risk assessment must be established by the contexts of the organizations risk.
Risk Response
Risk response identifies, evaluates, decides on, and implements appropriate courses of action to accept, avoid, mitigate, share, or transfer risk to organizational operations and assets, individuals, other organizations, and the Nation, resulting from the operation and use of information systems.
Risk identification is key to risk response. Risk types include:
Risk accept- is the appropriate risk response when the identified risk is within the organizational risk tolerance. Organizations can accept risk deemed to be low, moderate, or high depending on particular situations or conditions.
Risk avoidance– Organizations may conduct certain types of activities or employ certain types of information technologies that result in risk that is unacceptable. In such situations, risk avoidance involves taking specific actions to eliminate the activities or technologies that are the basis for the risk or to revise or reposition these activities or technologies in the organizational mission/business processes to avoid the potential for unacceptable risk.
Risk mitigation-adding management, technical, administrative safeguards to minimize identified risks to the system.
Risk share & transfer- Risk sharing or risk transfer is the appropriate risk response when organizations desire and have the means to shift risk liability and responsibility to other organizations. Risk transfer shifts the entire risk responsibility or liability from one organization to another organization (e.g., using insurance to transfer risk from particular organizations to insurance
companies).
Risk Monitoring Risk changes with each modification of the system. It’s important to monitor the changes of the risk of a system. Changes to threats can also change risk. This is where Continuous monitoring comes in.
Risk assessment table is usually a 2 dimensional matrix used to measure the likelihood of risk by matching vulnerability, assets, threats and/or impacts of threats to vulnerability of assets.
A risk assessment table can be homemade. Homemade might be best because the no one knows better than they organization the landscape within their information systems infrastructure, the threats associated or the importance of the assets should they get compromised.
The risk assessment model is decomposed in NIST SP 800-37, Guide for Risk Assessments.
The risk assessment model is designed to identify threat sources and events, identify vulnerabilities and predisposing conditions, determine likelihood of occurrence, determine magnitude of impact and finally determine risk. Some of the devices used to do this are risk register:
Risk Register Template – version a Risk Register Template – version b
The risk assessment model is only one part of the risk management process in DIARMF and other risk management frameworks:
As risk register is a tool in the form or spread sheet, application or database that you can use during risk assessments for risk identification. It allows the person conducting the risk assessment to log the threat, asset and impact and give some idea of the probability of the threat. It is used in DIARMF, DIACAP, project management and other risk management processes to help decision makers.
Its also known as a risk log.
Here is a risk register template I got from British Colombia gov site http://www.gov.bc.ca/fin/):
Here is another risk register template from the Israel Institute of Technology(webcourse.cs.technion.ac.il):
What is a risk assessment?
To answer this question we must first know what “risk” is.
There are many kinds of risks: financial risks, safety risks, investment risk. But we are talking about Security Risk. In the context of SECURITY, risk is the likelihood that something harmful (a threat) will happen to something of value (an asset). The asset must be vulnerable to the the harmful event.
A risk assessment is the process of identifying the actual risk. This done by identifying the threat, the asset, the associated weaknesses and countermeasures and then determining the impact should the threat harm the asset.
Risk identification is done with a risk assessment. NIST SP 800-30, Guide for Conducting Risk Assessments breaks down the entire process of risk determination, risk identification.
As described in the earlier post DIACAP Process:
Risk = ((Vulnerability * Threat) / Countermeasure) * Asset Value at Risk IT RiskRisk is the likelihood that a threat will compromise the weakness of an asset. So risk identification is based on knowing the threat, the vulnerability and the asset.
Risk assessment report_Example
