WELCOME

Business impact levels (BILs) measure the potential impact a disruption or loss of a particular business function or asset would have on an organization. BILs are often used to prioritize risks and inform risk management decisions. They are an essential input for example, to risk assessments, including when assessing consequence ratings of risk events. To conduct a BIL analysis, an organization typically follows these steps: Identify business functions and assets: First, the

Risk matrices can be used effectively based on thorough hazard/threat assessments and asset analyses. These inputs can provide granularity and rigor to the risk assessment process and help to ensure that risks are accurately characterized and prioritized. It is essential to recognize that risk matrices are just one tool in the risk management toolkit, and they should be combined with other techniques to provide a more comprehensive understanding of risks. For example, threat

One of the things that I do is build software. These days, I'm more of an end user, and for the past few years, I've been a bit selfish by focusing on building software I want to use myself. That isn't my first preference, and in truth, I'd rather buy commercial off-the-shelf (COTS) software or rent SaaS. I've written about some of my favorite software in an article on how to write a non-fiction book. But today, I wanted to discuss picking a risk management software platform.

For most of us, Microsoft Excel has been the default starting point for risk assessment tools. There is, however, an ever-increasing...

Some key models that can be helpful for security risk assessment and management, depending on the context, include the following. The NIST Cybersecurity Framework (CSF) is a risk-based framework that provides a common language and system for organizing and prioritizing cybersecurity activities. It consists of five core functions (Identify, Protect, Detect, Respond, and Recover), associated outcomes, and categories. The ISO/IEC 27001 standard is a widely-adopted international

Three-point estimation is one way to calculate a realistic estimation using a best-case estimate, worst-case estimate, and most...

Culture is the set of encouraged and acceptable behaviors, discussions, decisions and attitudes toward taking and managing risk within a group. Automaticity is the term psychologists give to the skilled action that people develop through repeatedly practising the same activity, for example, driving a car. Behaviors learned to the point of “automaticity” are not easily changed by conscious control. High-Reliability Organizations (HROs) have successfully avoided catastrophes in

The following matrix shows an example of how three different risks are plotted on a matrix to reflect those risks' uncertainty. For...

P90, P50, P10 Another approach to using multiple point estimation involves using probabilities which do not add up to 100%. We might for example, say that an arson attack on your office is 90% likely (Probability = 90% or ‘P90’) to be put out quickly by the state of the art fire suppression system with a loss of less than $100,000. There might, hypothetically, be a 50% chance (P50) that the fire could cause $2million damage, but it would be very unlikely (P10) to cause a cata

One school of thought says it takes five years to change an organisation's culture. Another view says you can do it over a weekend. Yet another view says that changing the leadership will change the culture. All these ideas have their merits and their proponents. But the surest way I've seen to change the culture in order to improve performance is to train people. With new skills, people have more options to deal with situations in the workplace. This means they can and do ap

Risk management comes in many forms, but one approach, which I call the 3As, looks at three different risk management styles: Actuarial -...

One element often missing or inadequate is ensuring and assessing the effectiveness of security risk management and security assessments. Indicators The following are examples of some indicators which should be evident in a security risk assessment or management system. Accountability-risk acceptance. The individual who accepted the risk is clearly identified. Accountability-risk treatment. The individual who is responsible for treating the risk is clearly identified. Existin

This methodology has minor adaptations from ‘FIGURE 11.3 Expansion of AS/NZS 4360:2004 Risk Management Process for Security Risk Management’ in SRMBOK (2009) to reflect the updates to ISO31000:2018. Individual elements are described in more detail in the SRM-AM under Threat Assessment, Vulnerability Analysis, Criticality Assessment and Risk Treatments. This model is not necessarily the best or only model. Nor does it need to be followed in a step by step process. It is design

The following Framework graphics have been adapted from the SRMBOK organizational resilience model in SRMBOK (FIGURE 11.2). The main change is to simplify the diagram and establish Objectives rather than Capability as the key outcome. Security-in-depth provides layers of protection to protect resources, in order to sustain capability. The purpose of capability however is to support achievement of objectives. The following graphic illustrates one way of structuring a security

Security Frameworks The following is a partial list of sources for security-related frameworks. Their presence here is not an endorsement, just a resource if you are looking for more references. I have not included links as these change all the time, but an online search will reveal their latest incarnations. ANSI Australian Government Protective Security Policy Framework (PSPF) CIS v7 CISQ Control Objectives for Information and Related Technologies (COBIT) COSO FedRAMP FISMA

These definitions are not comprehensive. Please consider them simply as brief clarifications to indicate their use in this blog. Unless...

Vulnerability Analysis A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology systems, energy supply systems, water supply systems, transportation systems, and communication systems. Vulnerability analysis is related to Business Impact Analysis (BIA) but takes a particular f

Attacker Perspective When considering how various attackers might view your organization, it may be helpful to plot them on a matrix like...

When risk assessments get too complex or time-consuming, it is usually because the wrong tool is being applied to the job. As security risk professionals, we need a range of tools to suit the size of the task at hand. Here are a few examples of what that might look like when increasing the level of complexity. TAKE 2 - Simply take 2 minutes to think before undertaking a potentially risky behavior, such as walking down a dark alleyway or pressing ’Send’ on that email STEP BACK

Another risk maturity model worth considering is the Australian Government Commonwealth Risk Management Capability Maturity Model.¹ This model outlines the following levels: Fundamental Developed Systematic Integrated Advanced Optimal It also provides criteria for measuring them against the following nine elements: Establishing a risk management policy Establishing a risk management framework Defining responsibility for managing risk Embedding systematic risk management into