Security Risk
Management – Part 1
Lecture 4
What is Risk Management (RM)
Risk management in information security refers to the process of identifying, assessing, and
mitigating risks to information assets and systems. It involves systematically analyzing
potential threats, vulnerabilities, and the impact of potential incidents, and implementing
measures to reduce risks to an acceptable level.
Basic Concepts
What is Risk?
In short Risk is the potential for loss, damage or destruction of assets or data.
What is RM Purpose?
To identify potential problems before they occur and to ensure the desired
business outcomes are achieved
What is Risk level?
levels are used for risk assessment
Identification of Assets
The asset is valued in terms of the impact of total loss of the asset in terms of confidentiality,
integrity and availability.
Criticality Risk Description & Necessary Actions Key
Ratings
High The loss of Confidentiality (C), Integrity (I), or Availability (A) could be H
expected to have a severe or catastrophic adverse effect on organizational
operations, organizational assets or individuals.
Medium The loss of confidentiality, integrity, or availability could be expected to M
have a serious adverse effect on organizational operations, organizational
assets or individuals.
Low The loss of confidentiality, integrity, or availability could be expected to L
have a limited adverse effect on organizational operations, organizational
assets or individuals.
Example: List of Identified Assets
DIU Asset List For Risk Management
SL Asset Particulars Criticality Location
1. DIU Core Teachers App H Cloud
Software
Attendance App H
HR&Admin App H
2. Network Core Router H Physical
Equipment
IP Phone M
Network Rack L
3. Supporting Fire Extinguisher M Physical
Equipment
Identification of Key Risk Indicators (KRI)
A key risk indicator (KRI) is a measure used in management to indicate how risky an activity is.
Key risk indicators are metrics used by organizations to provide an early signal of increasing risk
exposures in various areas of the enterprise. Here, the Key risk indicator (KRI) has been
identified based on Bangladesh Bank ICT Security Guideline, PCI DSS and SWIFT etc.
Example: KRI Based on Bangladesh Bank
ICT Security Guideline, PCI DSS and SWIFT
Policy, Guidelines, Framework
Key Risk Indicator (KRI)
Bangladesh Bank SWIFT PCI DSS
1. Authentication token/password 5.2.12, 5.2, 6.5.8, 8.1
theft / misconfigured 5.3.4, 5.4.2, 4.2 (8.1.1-8), 8.2
5.7.21 (8.2.1-6), 8.3
2. Deletion of logs and forensic 5.2.14, 1.2 10.1, 10.2
Evidence 6.1.7, 6.3.3
3. Compromise of trusted backup 7.3 2.5A 9.5,
data 9.6
4. Execution of malicious code 5.2.9 6.1 6.4,
6.5.2
Identification of Risk-Scenarios
Threats are ubiquitous and represent possible sources of negative impact to an organization.
Threats can be natural, environmental, social, technical and medical and can lead to disruptions
in operations which can adversely impact an organization.
Example: Identification of Risk-Scenarios
SN Threat category Threat-sources Risk Scenarios
1. Human Acts Of Human Error Or Failure Accidents, Disclosure Of
Passwords
2. Technical Software Failures OS/Database Crash
Hardware Failures HDD Damages
Obsolescence Outdated
Technologies
3. Forces Of Nature Natural Disaster Flood, Earthquakes
Environmental Pollution, Power Failure
Questions
Thanks!