Effective Risk Treatment Strategy for Critical Vulnerabilities

B.

Risk acceptance is the practice of accepting certain risk(s), typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.

For your exam you should know below information about risk assessment and treatment: A risk assessment, which is a tool for risk management, is a method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls.

A risk assessment is carried out, and the results are analyzed.

Risk analysis is used to ensure that security is cost-effective, relevant, timely, and responsive to threats.

Security can be quite complex, even for well-versed security professionals, and it is easy to apply too much security, not enough security, or the wrong security controls, and to spend too much money in the process without attaining the necessary objectives.

Risk analysis helps companies prioritize their risks and shows management the amount of resources that should be applied to protecting against those risks in a sensible manner.

A risk analysis has four main goals: Identify assets and their value to the organization.

Identify vulnerabilities and threats.

Quantify the probability and business impact of these potential threats.

Provide an economic balance between the impact of the threat and the cost of the countermeasure.

Treating Risk - Risk Mitigation - Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented.

Examples of risk mitigation can be seen in everyday life and are readily apparent in the information technology world.

Risk Mitigation involves applying appropriate control to reduce risk.

For example, to lessen the risk of exposing personal and financial information that is highly sensitive and confidential organizations put countermeasures in place, such as firewalls, intrusion detection/prevention systems, and other mechanisms, to deter malicious outsiders from accessing this highly sensitive information.

In the underage driver example, risk mitigation could take the form of driver education for the youth or establishing a policy not allowing the young driver to use a cell phone while driving, or not letting youth of a certain age have more than one friend in the car as a passenger at any given time.

Risk Transfer - Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company.

Let us look at one of the examples that were presented above in a different way.

The family is evaluating whether to permit an underage driver to use the family car.

The family decides that it is important for the youth to be mobile, so it transfers the financial risk of a youth being in an accident to the insurance company, which provides the family with auto insurance.

It is important to note that the transfer of risk may be accompanied by a cost.

This is certainly true for the insurance example presented earlier, and can be seen in other insurance instances, such as liability insurance for a vendor or the insurance taken out by companies to protect against hardware and software theft or destruction.

This may also be true if an organization must purchase and implement security controls in order to make their organization less desirable to attack.

It is important to remember that not all risk can be transferred.

While financial risk is simple to transfer through insurance, reputational risk may almost never be fully transferred.

Risk Avoidance - Risk avoidance is the practice of coming up with alternatives so that the risk in question is not realized.

For example, have you ever heard a friend, or parents of a friend, complain about the costs of insuring an underage driver? How about the risks that many of these children face as they become mobile? Some of these families will decide that the child in question will not be allowed to drive the family car, but will rather wait until he or she is of legal age (i.e., 18 years of age) before committing to owning, insuring, and driving a motor vehicle.

In this case, the family has chosen to avoid the risks (and any associated benefits) associated with an underage driver, such as poor driving performance or the cost of insurance for the child.

Although this choice may be available for some situations, it is not available for all.

Imagine a global retailer who, knowing the risks associated with doing business on the Internet, decides to avoid the practice.

This decision will likely cost the company a significant amount of its revenue (if, indeed, the company has products or services that consumers wish to purchase)

In addition, the decision may require the company to build or lease a site in each of the locations, globally, for which it wishes to continue business.

This could have a catastrophic effect on the company's ability to continue business operations Risk Acceptance - In some cases, it may be prudent for an organization to simply accept the risk that is presented in certain scenarios.

Risk acceptance is the practice of accepting certain risk(s), typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.

For example, an executive may be confronted with risks identified during the course of a risk assessment for their organization.

These risks have been prioritized by high, medium, and low impact to the organization.

The executive notes that in order to mitigate or transfer the low-level risks, significant costs could be involved.

Mitigation might involve the hiring of additional highly skilled personnel and the purchase of new hardware, software, and office equipment, while transference of the risk to an insurance company would require premium payments.

The executive then further notes that minimal impact to the organization would occur if any of the reported low-level threats were realized.

Therefore, he or she (rightly) concludes that it is wiser for the organization to forgo the costs and accept the risk.

In the young driver example, risk acceptance could be based on the observation that the youngster has demonstrated the responsibility and maturity to warrant the parent's trust in his or her judgment.

The following answers are incorrect: Risk Transfer - Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company.

Let us look at one of the examples that were presented above in a different way.

Risk Avoidance - Risk avoidance is the practice of coming up with alternatives so that the risk in question is not realized.

Risk Mitigation -Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented.

Sam, the security manager, has performed a risk analysis on all critical vulnerabilities reported by an IS auditor, and some of the risks have a cost-benefit analysis that shows the cost of risk mitigation is higher than the potential loss that could be incurred. In such a scenario, Sam should recommend a strategy to senior management for treating these risks.

The different strategies for treating risks are:

A. Risk Mitigation: This strategy involves implementing countermeasures, controls, or safeguards to reduce the likelihood or impact of a risk. In this case, if Sam recommends risk mitigation, it means he is suggesting that the senior management implement controls to mitigate the risks even if the cost of implementing those controls is more than the potential loss that could be incurred. However, this option is not viable in this scenario since the cost of risk mitigation is higher than the potential loss that could be incurred.

B. Risk Acceptance: This strategy involves accepting the risk and not implementing any controls to mitigate the risks. In this case, if Sam recommends risk acceptance, it means he is suggesting that senior management accepts the risks, even if the cost of risk mitigation is higher than the potential loss that could be incurred. Risk acceptance may be an option if the potential loss is low or if the cost of implementing controls is prohibitive.

C. Risk Avoidance: This strategy involves avoiding the risk altogether by not engaging in the activity that poses the risk. In this case, if Sam recommends risk avoidance, it means he is suggesting that senior management avoid the activity that poses the risk. However, this option may not be feasible in this scenario since the risks are critical vulnerabilities, which may be unavoidable in the financial institute's operations.

D. Risk Transfer: This strategy involves transferring the risk to another entity, such as an insurance company or a third party. In this case, if Sam recommends risk transfer, it means he is suggesting that senior management transfer the risk to another entity. However, this option may not be feasible if the potential loss is high or if the cost of transferring the risk is prohibitive.

Based on the above, the best strategy for Sam to recommend to senior management for treating these risks is Risk Acceptance. Senior management should accept the risks even if the cost of risk mitigation is higher than the potential loss that could be incurred. However, it is important to note that risk acceptance should only be an option if the potential loss is low or if the cost of implementing controls is prohibitive.