WELCOME

One school of thought says it takes five years to change an organisation's culture. Another view says you can do it over a weekend. Yet another view says that changing the leadership will change the culture. All these ideas have their merits and their proponents. But the surest way I've seen to change the culture in order to improve performance is to train people. With new skills, people have more options to deal with situations in the workplace. This means they can and do ap

One element often missing or inadequate is ensuring and assessing the effectiveness of security risk management and security assessments. Indicators The following are examples of some indicators which should be evident in a security risk assessment or management system. Accountability-risk acceptance. The individual who accepted the risk is clearly identified. Accountability-risk treatment. The individual who is responsible for treating the risk is clearly identified. Existin

This methodology has minor adaptations from ‘FIGURE 11.3 Expansion of AS/NZS 4360:2004 Risk Management Process for Security Risk Management’ in SRMBOK (2009) to reflect the updates to ISO31000:2018. Individual elements are described in more detail in the SRM-AM under Threat Assessment, Vulnerability Analysis, Criticality Assessment and Risk Treatments. This model is not necessarily the best or only model. Nor does it need to be followed in a step by step process. It is design

The following Framework graphics have been adapted from the SRMBOK organizational resilience model in SRMBOK (FIGURE 11.2). The main change is to simplify the diagram and establish Objectives rather than Capability as the key outcome. Security-in-depth provides layers of protection to protect resources, in order to sustain capability. The purpose of capability however is to support achievement of objectives. The following graphic illustrates one way of structuring a security

Security Frameworks The following is a partial list of sources for security-related frameworks. Their presence here is not an endorsement, just a resource if you are looking for more references. I have not included links as these change all the time, but an online search will reveal their latest incarnations. ANSI Australian Government Protective Security Policy Framework (PSPF) CIS v7 CISQ Control Objectives for Information and Related Technologies (COBIT) COSO FedRAMP FISMA

These definitions are not comprehensive. Please consider them simply as brief clarifications to indicate their use in this blog. Unless...

Vulnerability Analysis A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology systems, energy supply systems, water supply systems, transportation systems, and communication systems. Vulnerability analysis is related to Business Impact Analysis (BIA) but takes a particular f

Attacker Perspective When considering how various attackers might view your organization, it may be helpful to plot them on a matrix like...

When risk assessments get too complex or time-consuming, it is usually because the wrong tool is being applied to the job. As security risk professionals, we need a range of tools to suit the size of the task at hand. Here are a few examples of what that might look like when increasing the level of complexity. TAKE 2 - Simply take 2 minutes to think before undertaking a potentially risky behavior, such as walking down a dark alleyway or pressing ’Send’ on that email STEP BACK

Another risk maturity model worth considering is the Australian Government Commonwealth Risk Management Capability Maturity Model.¹ This model outlines the following levels: Fundamental Developed Systematic Integrated Advanced Optimal It also provides criteria for measuring them against the following nine elements: Establishing a risk management policy Establishing a risk management framework Defining responsibility for managing risk Embedding systematic risk management into

Security Risk Management Body Of Knowledge (SRMBOK) The SRMBOK maturity model addresses the following four levels: Level 1 INITIAL Level 2 BASIC Level 3 REPEATABLE Level 4 OPTIMIZING The model also addresses six categories of maturity: Overview Culture Systems Experience Training Management Assessment descriptors for each of the categories are outlined below. Overview Compliance-only approach. Risk appetite is not defined. No framework developed. No senior management support.

Report Headings Example 1 The following is one example of how to structure a Security Risk Assessment. TERMS AND DEFINITIONS TABLE OF CONTENTS EXECUTIVE SUMMARY SCOPE, CONTEXT AND CRITERIA ASSET CRITICALITY ASSESSMENT THREAT ASSESSMENT RISK CONTROL EFFECTIVENESS ASSESSMENT SECURITY RISK REGISTER & TREATMENTS ANNEX: ASSESSMENT METHODOLOGY Asset Criticality Assessment Threat Assessment Risk Control Effectiveness (RCE) Assessment Risk Assessment Report Headings Example 2 The fol

Project Brief Headings Example The following is one example of how to structure a consultant's brief or request for quotation to conduct a Security Risk Assessment. You can download a 6 page example and template from www.srmam.com. EXECUTIVE SUMMARY OBJECTIVES SCOPE CONTEXT PROGRAM Timelines Project Management Project Liaison Conduct of the Project 6. SECURITY RISK ASSESSMENT Reference Documents Outcomes Indicative Terms Of Reference Scope, Context, Criteria Methodology

Security Plan Headings Example The following is one example of how to structure a Security Plan. You can download a template from www.srmam.com. Note: Plans may differ based on the focus and nature i.e. whilst an event security plan and a critical infrastructure protection plan will be underpinned by the same principles they may be significantly different in layout, focus, and even approach. FOREWORD INTRODUCTION Scope Purpose References METHODOLOGY Developing the Plan Securi

The Nature of Risk Treatments Here are several levels of expenditure to consider when implementing treatments: Sunk costs – funds that...

Treatment Plans - A Brief Template The following headings may be suitable for many treatment registers. Serial (Treatment ID) Treatment Description Risks Treated (Risk IDs) Initial Cost Ongoing/Recurrent Cost Priority Cost Implications For Other Activities Acceptance (Yes/No) Actionee (The recipient of an action item; the person assigned responsibility for a specific task or issue.) Due Date Writing Risk Treatments - 4As Risk treatments and recommendations can benefit from th

Eight Step Process For Selecting Risk Treatments The following process can help identify treatments for complex risks. It can be used for a facilitated brainstorming workshop, as report headings, and stakeholder engagement. What is the risk? The risk statement must be comprehensive, leaving no room for error about what is really meant. Why is it a risk? What are the root causes and vulnerabilities? How will it impact objectives? What is/are the source/s of the risk? What are

Selecting Risk Treatments ISO31000 suggests applying one or more of the following approaches to treating risks: Avoiding the risk by...

📷 The following elements provide an example of a high level overview of complex risk treatments. Each risk treatment in theTreatment Register might for example, require a single page outlining the following elements. That single page, might constitute an overview of a multi-million dollar, multi-year project. Description: high level description of the treatment Actions: three to seven steps required to implement Achieved when: criteria or person which will determine completi

Communication and consultation is an iterative, two (or more) way process, which applies at all stages of risk management. Miscommunication can also be a source of risk and a barrier to reacting to it Visual Risk Models For Communication The following tools can be useful for communicating risk visually: Swiss-Cheese Hierarchy of Controls Ishikawa Diagrams Root Cause Analysis Risk Matrices Bubble Charts Ishikawa Diagrams Also called fishbone diagrams, herringbone diagrams, cau