5.1Risk Assessment in Practice

An information security manager cannot operate on a vague sense that "something seems risky." The job requires making visible, through numbers and criteria, which information asset carries how much risk against which threat, and then responding with priorities under limited budget and staff. Exam B tests the ability to apply this decision process to real workplace situations.

5.1.1Identifying and classifying information assets

• An information asset is anything an organization holds that must be protected. This must be surveyed broadly--not just information itself, such as customer lists, contracts, and design drawings, but also the servers, PCs, storage media, and software that handle it, and even personnel who hold operational know-how. If the inventory stage scopes the target too narrowly, the risk assessment that follows inherits the gap.
• Asset classification is fundamentally ranked by importance from the viewpoints of confidentiality (C), integrity (I), and availability (A). For example, HR evaluation data weighs especially heavily on confidentiality, while payment logs weigh especially heavily on integrity (not being tampered with)--evaluation must account for the fact that even among assets that are all "important," the property that most needs protecting differs by asset.

5.1.2Calculating risk values and risk acceptance criteria

• A representative formula for the risk value is risk value = threat x vulnerability x asset value (each factor is scored on a scale and multiplied). Threat is the likelihood of an event that could harm the asset (for example, a ransomware attack or insider misconduct). Vulnerability is a weakness the asset has (for example, an unapplied patch or a poorly designed access permission scheme). Understanding the multiplicative nature--if any one of the three factors is close to zero, the overall risk value also drops--is the foundation for calculation questions.
• A risk acceptance criterion is a threshold an organization sets in advance: "risk up to this level is acceptable; beyond it, a response is required." Without such a criterion, how a calculated risk value should be handled varies by whoever is in charge, and the consistency of the response is lost. It is considered desirable for management to approve the acceptance criteria based on the level of business impact.

5.1.3Building a risk response plan

• The four types of risk response are: risk mitigation (take countermeasures to reduce the threat or vulnerability--the most common); risk retention (accept it without countermeasures because it is within the acceptance criterion); risk avoidance (stop the business activity or service that is the source of the risk); and risk transfer (share the impact with a third party via insurance or outsourcing). The calculated risk value is compared against the acceptance criterion, and a judgment is made on which type to choose when the criterion is exceeded.
• A response plan does not end at deciding on a countermeasure--it must also clarify who is responsible for implementation, the deadline, and the required budget, and after implementation, re-evaluate the residual risk (the risk that remains even after the countermeasure). When the cost of a countermeasure greatly exceeds its risk-reduction benefit, choosing risk retention or avoidance on cost-effectiveness grounds is also a legitimate judgment.

Take the information systems department of a mid-sized company as an example of this flow. In its quarterly information asset inventory, the department identified a "customer management database"--holding customers' names, addresses, and purchase history--as one of its most critical assets, rating its asset value at "5 (highest)" on a five-point scale from a confidentiality standpoint. Next, envisioning "an information leak via unauthorized external access" as the threat to this database, the department rated the likelihood at "4 (high)" based on recent industry trends. From a vulnerability standpoint, interviews with staff and a system check found a known vulnerability on the server that had gone unpatched for six months, so vulnerability was rated "4 (high)." This yields a risk value of 5 x 4 x 4 = 80, which exceeds the predetermined risk acceptance criterion of "a risk value of 60 or higher requires a response plan to be drawn up promptly," so the person in charge begins building a response plan. Since the vulnerability itself--the unpatched state--can be directly addressed, they choose risk mitigation (applying the patch and strengthening access control), designating the system administrator as the person responsible, setting a two-week deadline, and requesting the necessary additional budget for approval. Assuming the vulnerability rating drops from "4" to "1 (low)" after the countermeasure is implemented, the residual risk falls to 5 x 4 x 1 = 20, which is below the acceptance criterion of 60, leading to a decision to switch to routine monitoring going forward. What matters here is the principle of not continuing countermeasures until the risk value reaches zero, but stopping the response once it falls below the acceptance criterion and redirecting limited resources to other risks.

5.1.4Section summary

• Information assets must be surveyed to include data, software, hardware, and personnel. Risk value = threat x vulnerability x asset value (multiplicative)
• A response plan is built only for risk that exceeds the risk acceptance criterion. There is no need to aim for zero
• Four response types: mitigation, retention, avoidance, transfer. After a countermeasure, re-evaluate residual risk and stop responding once it falls below the criterion