- In this lesson 24.3,
we're gonna talk about risk response and risk treatment.
Now risk appetite, risk tolerance,
cost, and external considerations are all factors
in determining the appropriate response to risk
and the appropriate treatment.
Now risk response is the responsibility
to determine how to respond to the outcome
of a risk analysis,
where risk treatment is to select one or more options
to address an identified risk.
So who responds to risk?
Well, I wanna do a risk response
authority illustration with you
just to talk about different levels of risk
and who in an organization
might be responsible for responding to it.
Again, this is just an illustration,
but it will give you a good sense
of how risk is responded to.
First, let's talk about timing.
Perhaps there's a policy in the organization that says,
initial results of all risk analysis must be presented
to executive management and business process owners
within seven days of completion.
Okay, so we got to report out within seven days.
Now the question is, what do we do about the results?
How do we respond to low risk,
elevated risk, and severe risk?
You may have a policy that says low risk
can be accepted by the business process owner.
Elevated risk must be responded to within 15 days
by the business process owner,
and treatment is at the discretion of senior management.
And then for severe risk, our policy might read,
severe risk must be responded to within three days.
And treatment is at the discretion
of executive management.
Because the higher level of risk, right?
The higher in the organization
we wanna go for saying this is okay or this is not okay
or this is what we're going to do about it.
So what our options if we do wanna treat the risk?
Well, we can avoid, transfer, mitigate, or accept.
Now avoiding risk is to either eliminate the cause,
which is very difficult,
or to terminate the associated activity.
So in our previous security in action, right?
When we had our e-commerce platform,
if we really thought the risk was too high,
we could stop doing e-commerce.
Now it was a ransomware attack that we talked about
and we probably can't eliminate the cause, right?
Of the ransomware attack.
We can't stop that adversary.
So our choice there would be to terminate
the associated activity.
We could transfer the risk.
Now transferring risk means that we're gonna assign the risk
to another party, which is generally insurance.
The risk is typically transferred
when the likelihood is low but the impact is high.
We can mitigate the risk, which is to reduce the impact
or the likelihood by implementing additional controls
or safeguards or process change.
Or we can say, that's cool.
We're good with it, right?
We can accept the risk, which means to acknowledge it
and to accept the level of risk and then monitor it.
Just make sure it stays stable.
That it doesn't change.
So avoid, transfer, mitigate, and accept.
Let's talk a little bit more about acceptance.
Risk acceptance is normally
when the risk level is acceptable
within predefined appetite and tolerance criteria.
And we don't need any further measures.
No further measures are needed to be considered.
We don't have to do anything else,
any other treatment except for monitoring.
Remember that risk appetite was broadly defined
as the level of risk
an entity was willing to accept in pursuit of its mission
and risk tolerance is tactical
and specific to the target being evaluated.
Now it's not always possible to avoid, transfer,
or mitigate a risk to an acceptable level.
Sometimes we're going to have to do
exceptions and exemptions.
A risk exception is a formal acknowledgement
that a risk has been identified,
but it's not feasible or practical to implement
our standard risk treatment or control measures.
Now workarounds may be implemented.
Exception handling is the process of approving an exception
on either a temporary or a permanent basis.
You know, maybe we're not going to do something about a risk
because it's a system that's gonna be retired
in two weeks or three weeks.
You know, maybe it's a risk exception
because the system is managed and monitored by somebody else
and we can't do anything about it,
but we may put some additional controls or some workarounds.
Now a risk exemption is a formal decision
not to address a risk at all.
Now it's generally implemented
when the potential impact of the risk is low
and the cost and the effort required to mitigate that risk
are disproportionate to the potential impact.
Now very critical component of the risk management program
is on-going monitoring, documentation, and reporting.
Risk monitoring is a continuous activity
that's used to identify trends,
failures, and/or opportunities
and respond in an efficient and appropriate manner.
Risk reporting is the process of communicating
our real-time risk
and our performance data to our stakeholders.
So here are some risk monitoring and reporting tools.
Risk registers, heat maps, dashboards, and metrics.
A risk register is a dynamic central repository
for all of our risk-related documentation,
our tracking, and accountability.
And it includes information about acceptance,
exceptions, and exemptions.
Heat maps are a visualization tool
that we can use to convey likelihood and impact.
Dashboards are a visualization tool
to convey our security posture.
And then there are metrics we can use.
And these are predefined measures,
usually in the form of what's known as a KRI,
a key risk indicator.
So let's talk more about KRIs or key risk indicators.
A key risk indicator are predictors
or early warning signals of unfavorable events
that can adversely impact an organization.
KRIs are indicators of emerging risks
and we have two types of KRI indicators.
We have leading indicators and lagging indicators.
A leading indicator
looks forward at future outcomes and events.
Now leading KRIs are measures
that are considered predictive in nature.
And they're derived from metrics
that help us to forecast future occurrences.
Where a lagging indicator looks back,
it looks back at what has happened.
Lagging KRIs are metrics based on historical measures
and lagging KRIs are used to identify trends.
So let's take a look at just some examples
of some key risk indicators.
We've got three categories here.
We've got some information system KRIs,
vendor management KRIs, and project management KRIs.
So our information system KRIs
may include percentage of applications
that are near or at end of life,
percentage of systems or devices
that are near or end of life,
or percentage of systems in use
that are no longer supported.
Vendor management KRIs might be things
like a trend of outstanding vendor issues,
outsourced projects that are experiencing delays,
or disputes with vendors.
Again, these would be measures of all of these.
And project management KRIs
might include a percentage of projects delayed,
a percentage of projects exceeding budget,
and a percentage of projects that are not fully staffed.
All of these things being indicative of an emerging risk.
And that my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
Let's do it.
An indicator that is a predictor of unfavorable events
that can adversely impact an organization.
One, two, three.
That's gonna be a KRI, a key risk indicator.
A dynamic central repository
for all risk-related documentation.
One, two, three.
The risk register.
Number three, selecting one or more options
for addressing and identified risk.
One, two, three.
That would be risk treatment.
Number four, reducing risk to an acceptable level.
One, two, three.
And that's risk mitigation or mitigating risk.
And five, the formal acknowledgement
that a risk has been identified
but it's not practical or feasible to address it.
One, two, three.
That is a risk exception, right?
And that brings us to a security in action.
This one's about risk response.
Your organization has been working
with an external consulting firm for many years.
The firm recently conducted
its annual risk analysis of a core system,
and they identified several systemic issues
and they determined the level of operational, strategic,
and reputational risk to be very high.
Now since the CISO is new to the organization,
the business process owner insists
that she should be the one to respond to the analysis.
What course of action would you recommend to the CISO?
Isn't an interesting situation, right?
You've been working with this external consulting firm
for many, many years and they recently did their annual,
so they do it every year, risk analysis of a core system.
And they identified several systemic issues.
So issues that you know are ingrained
and going on for a while.
And they say, "Oh geez, the operational strategic
and reputational risk
of whatever's happening here is very high."
We have this brand new CISO.
And so our business process owner says,
"Well, look, the CISO is brand new to this organization.
So you know, he or she shouldn't be the one that responds.
I should be the one that responds to the analysis."
And the CISO is kinda like, "Oh, what do I do?"
So what would you advise them?
Go ahead and put me on pause to jot down some notes
and come back with your recommendation.
Well, the identified risks impact the entire enterprise.
So the risk response should not be siloed
within a specific business unit where they came back
and said, operational, strategic, and reputational risk.
That doesn't belong at the business unit.
That's pretty significant.
And they said not only in those categories,
but it was very high.
Now the CISO should first consult policy
to see if there's a defined risk response workflow.
And if not, well this level of risk
really warrants immediate executive management
and perhaps even board of director attention.
Risk treatment options to be evaluated,
taking into consideration, certainly, the risk appetite,
include termination, mitigation, or acceptance.
Now acceptance, if we went down that path,
would require stakeholders
to acknowledge any risk exceptions.
But here's what else I'd wanna know.
If we've got these systemic issues
and this consulting firm has been doing
these annual risk assessments year over year over year,
how come we're only hearing about them now?
So I'd probably wanna look a little bit closer
at that consulting firm as well.
Doing all that, security in action.
There's your word cloud.
You know what to do.
There's a lot here
and these are all really important topics.
So make sure you're comfortable and confident.
And when you are, head on over to the next lesson
and I'll be waiting for you there.