Risk management

Risk management is the core of any security program: identify what can happen, how likely and severe it is, and decide what to do. Controls aren’t put in place “just because” but to treat concrete risks prioritized by their business impact.

Concepts

Asset        what has value (data, systems, processes, reputation)
Threat       what can cause harm (attacker, failure, disaster)
Vulnerability  the weakness the threat exploits
Risk         likelihood x impact (if the threat exploits the vulnerability)
Control      a measure that reduces risk (preventive/detective/corrective)

The process (ISO 27005 / NIST 800-30)

1. ESTABLISH CONTEXT   criteria, scope, risk appetite
2. IDENTIFY            assets, threats, vulnerabilities (see cti-modelado)
3. ANALYZE             estimate likelihood and impact (qualitative/quantitative)
4. EVALUATE            compare to the appetite -> prioritize
5. TREAT               choose a response (see below)
6. MONITOR/REVIEW      risk changes -> a continuous process

Risk treatment (the 4 Ts)

Treat (mitigate)   implement controls to reduce likelihood/impact
Transfer           insurance, outsourcing (the residual risk is still yours)
Tolerate (accept)  assume it (within appetite), documented and approved
Terminate (avoid)  don't do the activity that generates the risk
# RESIDUAL RISK always remains after treatment -> it must be within the appetite

Qualitative vs quantitative analysis

Qualitative   likelihood x impact matrix (high/medium/low); fast, communicates well
Quantitative  ALE = SLE x ARO (annual loss expectancy); numbers for investment decisions
  SLE = asset value x exposure factor ; ARO = annual frequency
# qualitative to prioritize; quantitative to justify spending on controls

Third-party and supply-chain risk

- providers inherit YOUR risk (SolarWinds, Log4Shell) -> due diligence
- assess providers (questionnaires, certifications), contracts, and continuous monitoring
- fourth party: your providers' providers matter too

Blue Team / GRC

Start from the business and risk appetite: controls treat prioritized risks, not fads.
Keep a live risk register (owner, treatment, residual risk, review).
Link with vulnerabilities (Vulnerability management), threat modeling (Threat modeling), and continuity (Business continuity (BCP/DRP)).
Manage third-party risk: due diligence and continuous provider monitoring.

Real cases and fines

SolarWinds/Log4Shell: supply-chain risk moved to the front of risk registers.
Control-investment decisions justified with ALE/ROSI to management.
Third-party breaches (processors, SaaS) that impacted their customers from lack of due diligence.

Testing checklist

Context and risk appetite defined with the business
Identify assets, threats, and vulnerabilities
Analyze likelihood and impact (qualitative/quantitative)
Prioritize and choose treatment (treat/transfer/tolerate/terminate)
Document residual risk (within appetite) and owner
Live risk register reviewed periodically
Third-party risk: due diligence and monitoring