Incident Prediction · Topic 1 of 4
Risk Management and Risk Management Frameworks
Learn risk management concepts, the risk program lifecycle, treatment options and frameworks such as NIST RMF, ISO 31000 and ISO/IEC 27005 for CND 312-38.
- 4 min
- Includes a diagram
- Risk combines threat, vulnerability and asset value (or likelihood and impact).
- ALE = SLE x ARO, and SLE = asset value x exposure factor.
- The four treatments are avoid, mitigate, transfer and accept.
What it is
Risk is the potential for loss when a threat exploits a vulnerability in an asset. Risk management is the process of identifying, assessing, treating and monitoring that risk so it stays at a level the organization accepts.
Prediction in network defense starts here: knowing what could go wrong, how likely it is and how bad it would be, so the defender can spend effort where it matters.
How it works
Risk management concepts
| Term | Meaning |
|---|---|
| Asset | Anything of value: data, systems, people, reputation |
| Threat | A potential cause of harm |
| Vulnerability | A weakness a threat can use |
| Likelihood | Chance that the risk event happens |
| Impact | Damage if it happens |
| Inherent risk | Risk before any controls |
| Residual risk | Risk left after controls are applied |
| Risk appetite | How much risk the organization is willing to take |
A simple way to think: risk = threat x vulnerability x asset value, or risk = likelihood x impact.
| Assessment type | How it works |
|---|---|
| Qualitative | Rates risks as high, medium or low using judgment and a matrix |
| Quantitative | Uses numbers for loss |
Quantitative formulas:
- SLE (single loss expectancy) = asset value x exposure factor
- ARO (annualized rate of occurrence) = how many times a year it is expected
- ALE (annualized loss expectancy) = SLE x ARO
Example: an asset worth 100,000 with an exposure factor of 0.5 gives an SLE of 50,000. If it happens once every two years (ARO 0.5), the ALE is 25,000. A control that costs more per year than the loss it prevents is usually not worth buying.
Managing risk through a risk management program
| Phase | Activity |
|---|---|
| Context and scope | Set goals, scope, criteria and responsibilities |
| Risk identification | List assets, threats, vulnerabilities and existing controls |
| Risk assessment | Analyze likelihood and impact, then rank risks |
| Risk treatment | Choose and apply a response |
| Monitoring and review | Track risks, test controls, report |
| Communication | Keep management and staff informed |
The four treatment options:
| Option | Meaning | Example |
|---|---|---|
| Avoid | Stop the risky activity | Do not store card numbers |
| Mitigate (reduce) | Add controls to lower likelihood or impact | Patch, encrypt, segment |
| Transfer (share) | Move the loss to another party | Cyber insurance, outsourcing |
| Accept | Knowingly live with it, within appetite | A low risk with a high fix cost |
A risk register records each risk, its owner, rating, treatment and status. Risk is never zero. After treatment the defender accepts the residual risk formally.
Risk management frameworks (RMF)
| Framework | What it is |
|---|---|
| NIST Risk Management Framework (SP 800-37) | Seven steps for managing security and privacy risk in information systems, used in US government |
| NIST SP 800-30 | Guide for conducting risk assessments |
| ISO 31000 | General principles and process for risk management in any organization |
| ISO/IEC 27005 | Information security risk management, supports ISO/IEC 27001 |
| OCTAVE | Self directed method that focuses on critical assets and organizational risk |
| FAIR | A model for quantifying information risk in financial terms |
| COSO ERM | Enterprise risk management framework |
The NIST RMF steps in order are:
- Prepare
- Categorize the system and information
- Select controls
- Implement controls
- Assess controls
- Authorize the system to operate
- Monitor the controls
All frameworks follow the same loop: establish context, assess, treat and monitor. Choose by fit: ISO 27005 for an organization with an ISO 27001 system, NIST RMF for US federal systems, and FAIR when management wants numbers.
A worked example
A retailer finds that its customer database server runs unsupported software. The threat is a remote attack, the vulnerability is the lack of patches, and the asset is customer data. Likelihood is high and impact is high, so the risk is high.
The team compares options. Upgrading the server mitigates the risk. Moving payment data to a processor transfers part of it. The team chooses to mitigate, records residual risk in the register and sets a review date.
How the exam asks about this
- "Which risk response is buying cyber insurance?" → Risk transfer.
- "What is the risk that remains after controls are applied?" → Residual risk.
- "Which NIST RMF step comes after Implement?" → Assess.
What to remember for the exam
- Risk combines threat, vulnerability and asset value (or likelihood and impact).
- ALE = SLE x ARO, and SLE = asset value x exposure factor.
- The four treatments are avoid, mitigate, transfer and accept.
- The NIST RMF has seven steps starting with Prepare.
- Risk is never zero, so residual risk must be accepted by management.
Insurance transfers the financial loss, not the responsibility. Reputation damage and legal duties remain with the organization.
Common mistakes
Mixing up threat and vulnerability. The threat is the cause of harm, and the vulnerability is the weakness it uses.
Treating risk management as a one time project. It is a continuous cycle with regular review.
Spending more on a control than the loss it prevents. Compare the cost with the ALE.
Check yourself
What is residual risk?
The risk that remains after controls have been applied.
What is the formula for annualized loss expectancy?
ALE = SLE x ARO.
Which risk treatment fits buying cyber insurance?
Transfer.
Topic 1 of 4 in Incident Prediction
Test yourself on Incident Prediction
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.