4.3Risk management

You cannot protect every weakness at once with equal force. Deciding "where" to direct limited budget and time is risk management. Its starting point is properly distinguishing a vulnerability—the weakness itself—from risk, which measures the prospect of that weakness becoming real harm. This section covers the difference between vulnerability and risk, the idea of ranking risk into low/medium/high/critical, choosing among the four risk responses—accept, reduce, transfer, avoid—and the relationship whereby a higher classification of the data handled brings greater risk—learned as the judgment of deciding "what to protect, and how far."

4.3.1Vulnerability and risk are different

• A vulnerability is the weakness itself lurking in a system or operation (an unapplied patch, a weak password, a misconfiguration). Risk is the prospect that the weakness is exploited and leads to real harm, roughly captured as likelihood times impact (asset value). A vulnerability does not translate into a fixed amount of risk.
• Even the same vulnerability, if unreachable from outside and hard to attack, has low likelihood and thus small risk. Conversely, on a server handling important personal data, the impact is large and thus the risk is large. So danger is not determined by "the count of vulnerabilities" alone—you must view risk by combining likelihood and impact.

4.3.2Ranking risk and the four responses

• Ranking risk combines likelihood and impact to sort each risk into a low/medium/high/critical band. It is prioritization for allocating limited resources to critical and high first, and a risk matrix (a likelihood-by-impact table) is commonly used.
• A risk response has four options: accept—take it as within tolerance given cost and other factors; reduce/mitigate—lower likelihood or impact with countermeasures (patching, defense in depth); transfer—shift the impact to others via insurance or outsourcing; and avoid—stop the risk-generating activity itself.
• Which to choose is decided by balancing the size of the risk against cost. Choosing costly avoidance for a small risk, or casually accepting a critical risk, is inappropriate. The finishing touch is grasping the residual risk that remains after the response and confirming it is at a tolerable level.

Suppose a scan finds the same vulnerability—"an old version of software remains"—on two internal servers. Thinking "same vulnerability, same danger" is wrong. The first is a test box accessible only from inside, handling dummy test data. The second is internet-facing production handling customers' personal data. Even with the identical vulnerability (weakness), risk is determined by likelihood times impact, so the second—more easily attacked from outside and with larger impact—carries far greater risk. This is the heart of risk management. So you rank each risk into low/medium/high/critical, placing the second as "critical" and the first as "low to medium." Next you choose a risk response. The second cannot be taken offline for business reasons, so avoidance is impractical, and you prioritize reduce (patch immediately and apply defense in depth). You might additionally transfer part of the impact via cyber insurance against a possible data breach. For the first server's small risk, a valid call may be to fold it into the patch plan while accepting it for now. The key: given the relationship that a higher classification of the data handled (personal, confidential) means larger impact and thus higher risk, choose priority and response by multiplying likelihood and impact, not by the mere presence of a vulnerability. Rather than protecting everything with equal force, pour resources into critical and high risks first—this judgment is the crux of risk management.

4.3.3Section summary

• A vulnerability is the weakness itself; risk is likelihood times impact—the same vulnerability yields different risk by likelihood and impact
• Rank risk into low/medium/high/critical and allocate resources to critical and high first
• Choose among the four risk responses—accept/reduce/transfer (insurance)/avoid—by balancing risk size against cost; higher data classification means greater risk