Information security risk management, or ISRM, is the process of managing risks associated with the use of information technology. It involves identifying, assessing, and treating risks to the confidentiality, integrity, and availability of an organization’s assets. The end goal of this process is to treat risks in accordance with an organization’s overall risk tolerance. Businesses shouldn’t expect to eliminate all risks; rather, they should seek to identify and achieve an acceptable risk level for their organization.
This is the process of combining the information you’ve gathered about assets, vulnerabilities, and controls to define a risk. There are many frameworks and approaches for this, but you’ll probably use some variation of this equation:
Risk = (threat x vulnerability (exploit likelihood x exploit impact) x asset value ) - security controls
Note: this is a very simplified formula analogy. Calculating probabilistic risks is not nearly this straightforward, much to everyone’s dismay.
Once a risk has been assessed and analyzed, an organization will need to select treatment options:
Regardless of how a risk is treated, the decision needs to be communicated within the organization. Stakeholders need to understand the costs of treating or not treating a risk and the rationale behind that decision. Responsibility and accountability needs to be clearly defined and associated with individuals and teams in the organization to ensure the right people are engaged at the right times in the process.
Rinse and Repeat
This is an ongoing process. If you chose a treatment plan that requires implementing a control, that control needs to be continuously monitored. You’re likely inserting this control into a system that is changing over time. Ports being opened, code being changed, and any number of other factors could cause your control to break down in the months or years following its initial implementation.
There are many stakeholders in the ISRM process, and each of them have different responsibilities. Defining the various roles in this process, and the responsibilities tied to each role, is a critical step to ensuring this process goes smoothly.
Process Owners: At a high level, an organization might have a finance team or audit team that owns their Enterprise Risk Management (ERM) program, while an Information Security or Information Assurance team will own ISRM program, which feeds into ERM. Members of this ISRM team need to be in the field, continually driving the process forward.
Risk Owners: Individual risks should be owned by the members of an organization who end up using their budget to pay for fixing the problem. In other words, risk owners are accountable for ensuring risks are treated accordingly. If you approve the budget, you own the risk.
In addition to risk owners, there will also be other types of stakeholders who are either impacted by, or involved in implementing, the selected treatment plan, such as system administrators/engineers, system users, etc.
Here’s an example: Your information security team (process owner) is driving the ISRM process forward. A risk to the availability of your company’s customer relationship management (CRM) system is identified, and together with your head of IT (the CRM system owner) and the individual in IT who manages this system on a day-to-day basis (CRM system admin), your process owners gather the information necessary to assess the risk.
Assuming your CRM software is in place to enable the sales department at your company, and the data in your CRM software becoming unavailable would ultimately impact sales, then your sales department head (i.e. chief sales officer) is likely going to be the risk owner. The risk owner is responsible for deciding on implementing the different treatment plans offered by the information security team, system administrators, system owners, etc. and accepting any remaining risk; however, your system owner and system admin will likely be involved once again when it comes time to implement the treatment plan. System users—the salespeople who use the CRM software on a daily basis—are also stakeholders in this process, as they may be impacted by any given treatment plan.
Managing risk is an ongoing task, and its success will come down to how well risks are assessed, plans are communicated, and roles are upheld. Identifying the critical people, processes, and technology to help address the steps above will create a solid foundation for a risk management strategy and program in your organization, which can be developed further over time.