5.3 Information Security and Risk Management Strategies

Risk Assessment

Risk assessment involves identifying potential threats and vulnerabilities, and the impact they could have on an organization’s assets. It requires a thorough understanding of the organization’s infrastructure, data, and business processes. By employing methodologies such as threat modeling and vulnerability assessments, organizations can prioritize risks based on their likelihood and potential impact, enabling them to allocate resources more effectively.

Policy Development

Policy development follows risk assessment as a critical step in articulating the organization’s stance on various security issues. Policies provide a formal set of guidelines that dictate how assets should be protected and how security incidents should be managed. These policies should be clear, concise, and easily understandable, ensuring that all stakeholders, from the CEO to the newest employee, are on the same page regarding security expectations and responsibilities. Additionally, IT managers should ensure that the organization maintains adequate documentation such as acknowledgment forms and training records to track employee training.

Control Implementation

Control implementation involves putting into place the necessary safeguards to mitigate identified risks. These controls can be administrative (policies and procedures), technical (such as firewalls and encryption), or physical (like security cameras and access controls). The key is to establish a balanced mix of these controls to create a multilayered security environment. Control effectiveness should also be regularly reviewed to ensure they are performing as intended.

Training and Awareness

Training and awareness programs are essential for cultivating a culture of security within an organization. Employees are often the first line of defense against cyber threats, so it is vital that they are equipped with the knowledge and tools they need to recognize and respond to potential security incidents. Regular training sessions, coupled with awareness campaigns, can significantly reduce the risk of human error, which is a leading cause of data breaches.

Monitoring and Auditing

Monitoring and auditing are crucial for maintaining visibility over the organization’s security posture. Continuous monitoring of network traffic, user activities, and system configurations ensures that any anomalous behavior can be detected and addressed promptly. Auditing provides a retrospective analysis, helping to uncover security lapses and ensure compliance with relevant laws and policies.

Response and Recovery

Finally, response and recovery involve being prepared to act when a security incident occurs. An organization should have in place a plan for incident response, which is a predetermined set of procedures and steps taken to identify, investigate, and respond to a potential security incident. After identifying the breach, an organization should have procedures for containing the threat, eradicating the malicious elements, and recovering any lost data. Post-incident analysis is also important, as it provides insights that can be used to strengthen the organization’s defenses against future attacks.

By effectively addressing these core components, organizations can build a resilient ISRM strategy that can protect their assets, maintain stakeholder trust, and ensure the continuity of their operations. Each component is important, and only when they are seamlessly integrated can an organization truly safeguard itself in the digital age.

ISO/IEC 27001

ISO/IEC 27001 is a globally recognized standard for the establishment and certification of an information security management system (ISMS), a framework that helps organizations manage their information security by defining policies, procedures, and controls. Developed by the International Organization for Standardization (ISO), ISO/IEC 27001 sets out the criteria for assessing and treating information security risks tailored to the needs of the organization. The standard encompasses both the technical and organizational aspects of information security, ensuring an integrated approach.

The significance of ISO/IEC 27001 lies in its universal applicability across industries and organizations of any size. It provides a robust framework that helps organizations secure their information assets, enhance their resilience against cyber threats, and establish trust with stakeholders. By achieving certification, organizations demonstrate their commitment to information security, which can lead to competitive advantages, improved client relationships, and compliance with legal and regulatory requirements.

The ISO/IEC 27001 standard is structured into ten main clauses, with the last six dedicated to the ISMS requirements:¹⁸

1. Scope: Defines the boundaries and applicability of the ISMS
2. Normative references: Lists the standards referenced in ISO 27001
3. Terms and definitions: Clarifies the terminology used in the standard
4. Context of the organization: Explains the internal and external factors that can impact the ISMS
5. Leadership: Emphasizes the importance of top management’s involvement and the establishment of an information security policy
6. Planning: Covers risk assessment and the process of establishing information security objectives
7. Support: Encompasses resources, competence, awareness, communication, and documented information
8. Operation: Deals with the execution of the processes and controls necessary to manage information security risks
9. Performance evaluation: Involves monitoring, measurement, analysis, evaluation, internal audit, and management review
10. Improvement: Focuses on continual improvement of the ISMS

Although not one of the clauses, guidance on implementing specific controls is discussed in Annex A.

The principles of ISO/IEC 27001 are organized around a risk-based approach, and this ensures that the ISMS is tailored to the specific risks faced by the organization. The approach promotes a culture of continuous improvement, transparency, and accountability.

National Institute of Standards and Technology

Imagine taking the role as the new chief information security officer of a bank and the CEO asks you, “How secure are we?” How would you approach answering this question? Or where could you go to get the information? One place to start would be with the National Institute of Standards and Technology (NIST). NIST is a nonregulatory federal agency within the U.S. Department of Commerce that helps to set standards and guidelines to ensure the security and privacy of information systems. NIST’s contribution to U.S. cybersecurity is significant, as the agency provides resources, best practices, and frameworks to assist organizations in safeguarding their information.

The NIST Special Publications 800 series is a collection of documents that cover various aspects of information security. These publications provide guidelines, recommendations, and best practices to help organizations manage and protect their information systems. Comparing the practices of your hypothetical bank against the guidelines set forth by NIST could help you answer your boss’s question about security. One of the most notable contributions from NIST is the framework for improving critical infrastructure cybersecurity, commonly known as the NIST Cybersecurity Framework. This framework comprises five domains: identify, protect, detect, respond, and recover (refer to Figure 5.7). Each domain involves specific security activities that, when implemented, provide organizations with a strategic view of their cybersecurity posture.

Numerous organizations across different sectors have adopted NIST standards to enhance their cybersecurity practices. For example, a financial institution might align its security policies and procedures with NIST’s best practices to improve its resilience against cyber threats. In the health-care sector, a hospital might use NIST guidelines to secure patient data and ensure HIPAA compliance. These real-world applications demonstrate the versatility and effectiveness of NIST standards in bolstering cybersecurity defenses and fostering a culture of security awareness and compliance.

Other Compliance Frameworks and Regulations

There are several frameworks and regulations in addition to NIST, NIST-800, and ISO/IEC 27001 that guide information security policy within an organization. Many of these depend on the nature of the business, the type of data that is collected, or even the geographic location of the business’s headquarters.

• The Federal Information Security Management Act (FISMA) is a U.S. law that is part of the E-Government Act of 2002. It is designed to bolster information security across federal agencies, and it establishes a comprehensive framework that mandates agencies to develop, document, and implement security programs to protect information and assets. FISMA emphasizes a risk-based policy for cost-effective security, requiring agencies to conduct regular risk assessments, implement security measures, and undergo continuous monitoring. Compliance with FISMA demonstrates an organization’s commitment to protecting governmental information and assets.
• The Health Information Technology for Economical and Clinical Health (HITECH) Act, enacted in 2009, represents significant legislation in health information technology and privacy. It aims to promote the adoption and meaningful use of health information technology, while also strengthening the privacy and security provisions of HIPAA. HITECH introduced stricter enforcement of HIPAA rules and increased penalties for noncompliance, emphasizing the need for health-care providers and related entities to safeguard electronic protected health information (ePHI). It also incentivized the implementation of electronic health records (EHRs), marking a transformative step in the modernization of health-care data management and security.

Phase 1: Risk Identification

The initial phase of developing an RMP, identifying potential risks, is the priority. This process involves using various techniques and tools to uncover vulnerabilities, threats, and potential impact on organizational assets. A strengths, weaknesses, opportunities, and threats (SWOT) analysis is a commonly used method that helps in understanding both internal and external factors that could pose risks. When applied to risk identification in ISRM, SWOT becomes a powerful instrument in the hands of cybersecurity professionals. The SWOT analysis in Figure 5.10 shows how it has been used and adapted to meet the needs of a team assessing their own information security. By evaluating the strengths of an organization, such as robust security policies or advanced technological infrastructure, professionals can form policies that enhance brand value, increase employee awareness to reduce attacks, and make data-informed decisions regarding system upgrades.

Figure 5.10 This hypothetical SWOT analysis completed by an information security team strategizes against threats to an IT system in a social media company. (attribution: Copyright Rice University, OpenStax, under CC BY 4.0 license)

The assets at risk in an organization can be vast and varied, including tangible assets such as hardware and intangible assets such as data and intellectual property. Protecting these assets requires a clear understanding of their value and the potential repercussions of any compromise. To aid in this process, a range of tools and technologies is available. Scanners, for instance, can automatically detect vulnerabilities in a network, while AI-based solutions offer advanced capabilities to predict and identify emerging threats. By employing these tools and methodologies, organizations can develop a clear and actionable understanding of their risk landscape, laying the foundation for effective risk management.

Phase 2: Risk Assessment

The risk assessment phase is a critical stage in the RMP, where the organization dives into the potential likelihood and impact of various identified risks. This process is like a detective’s investigation, where each clue helps in prioritizing risks based on their severity. Imagine a team of cybersecurity experts evaluating a network system, much like detectives combing through a crime scene. They identify potential threats and vulnerabilities, such as what types of data are at risk, what protections are currently in place, and what additional measures are necessary to close any security gaps.

This phase is not just about finding problems, but also about devising strategies to mitigate them. Through risk assessments, ISRM professionals can make data-driven decisions to align security measures with organizational objectives. The comprehensive nature of risk assessment technologies and approaches highlights the need for ISRM professionals to have a similar breadth and depth of knowledge. With the appropriate certifications and continuous learning, these professionals can contribute to a safer and more secure digital landscape.

The two predominant assessment methods are quantitative and qualitative.

• Quantitative assessment: Quantitative assessments are often viewed as more time intensive than qualitative but can be more accurate when evaluating risk. The impact of the risk is often evaluated in the context of the expected cost of the risk. One method used in quantitative risk assessment is expected monetary value (EMV) analysis, which is a mathematical calculation for determining the expected monetary impact of risks: it multiplies the dollar cost of a risk by the probability of that risk occurring and then adds the values together for all risks. A decision tree analysis is another quantitative method that is more visual than EMV (Figure 5.11). The decision tree includes each risk, along with its financial impact and the probability associated with each risk. The project manager then can see the path that offers the least impact (cost) on the project. Regardless of the method chosen, quantitative risk assessment involves calculations that give a monetary value to the impact of the risks to the project.
• Qualitative assessment: Qualitative impacts can be categorized as high, medium, and low with the probability of occurrence ranked on a scale from very likely to highly unlikely. Even though the assessments are more subjective than the quantitative approaches, there are methods that can facilitate the processes. For example, a brainstorming session with key stakeholders or with the project team could generate a list of potential risks. Additionally, in-depth interviews with experts or stakeholders can identify risks and begin to assess the impact and probability. A SWOT analysis can be used as well. In particular, the internal weaknesses and the external threats can be considered risks to evaluate in the project.

Figure 5.11 This hypothetical decision tree analysis shows how it can help a project manager visualize the various risks associated with a project. Through calculations such as EMV, the project manager can quantify the path that offers the least impact. (attribution: Copyright Rice University, OpenStax, under CC BY 4.0 license)

Another method used when conducting the qualitative assessment of risks is the Delphi method, which involves rounds of questionnaires sent to individuals with expertise who provide anonymous responses in which they identify risks and assess their impact and probabilities. The project manager will analyze the responses after each round to look for commonalities. Then, the compiled results are presented to the experts again and they have the opportunity reevaluate the responses and amend the list. The end result of the Delphi method is a list of risks that the experts have arrived at through this consensus-building process. Whatever method is used for conducting the qualitative assessment of the RMP, the important factor is to get input from various stakeholders and experts in the field to identify the risks and then organize the risks based on their impact and probability of occurrence. Figure 5.12 illustrates the contrast between quantitative and qualitative assessments when applied to an organization that specializes in IP generation.

Figure 5.12 This hypothetical scenario shows the two lenses of conducting a risk assessment: qualitative and quantitative. (attribution: Copyright Rice University, OpenStax, under CC BY 4.0 license)

A risk matrix is a visual representation of the identified risks categorized by both impact and probability. A risk matrix can be used with both qualitative and quantitative assessments. In qualitative assessments, the matrix will be populated with categories that are subjective, such as high probability or low impact, whereas a quantitative risk matrix would include the numerical measures of these values. Often the matrix is color coded with a predetermined color scheme to help quickly identify those risks that have the highest impact or probability.

In Figure 5.13, the highest-risk items are highlighted in red with the lower-risk items in green. Each risk matrix can be evaluated by the project manager to determine which risks should be monitored more closely and to prioritize the highest impact items. Then, the RMP can address the appropriate risk mitigation strategies for those higher priority items while putting less focus on risks with minimal overall impact on the project.

Figure 5.13 A risk matrix assists leaders in quantifying risks that may affect the organization. (credit: modification of work “Risk matrix (FAA Safety Risk Management Policy, 8040.4B)” by U.S. Department of Transportation Federal Aviation Administration/Wikimedia Commons, Public Domain)

Phase 3: Risk Mitigation Strategies

Uncertainty in projects cannot be eliminated, but it can be mitigated. Some broad mitigation strategies include being proactive and developing a plan to deal with risks if they materialize. Each identified risk should have a strategy attached so that there is a plan in place to minimize the impact of the risk on the project. These broad strategies offer some general decisions that can be made with each risk; however, the actual activities used to alleviate the impact will need to be tailored to the specific risk. Figure 5.14 lists broad strategies for dealing with risk.

Figure 5.14 Developing action plans on how to deal with each risk in RMP can save time and money in the long run. (attribution: Copyright Rice University, OpenStax, under CC BY 4.0 license)

The first strategy, acceptance, describes a situation where the risk, impact, and probability are known, and the project team makes the decision to accept the impact. The risk might be at a level where it would not have a meaningful impact on the overall project. In some cases, the benefit of accepting the risk outweighs any negative impacts from the risk. Generally, the acceptance strategy is used when there are minimal impacts to the cost, the schedule, or team performance. It is important to continue to monitor the risk to ensure the impact remains at an acceptable level. Overall, the project continues to move forward without substantive consequences to the project plan and deliverables.

In the avoidance approach, the project team develops strategies to prevent the risk from occurring. For example, to avoid the risk of a new CRM system not functioning properly, the system could be tested with key stakeholders to make sure it meets performance measures. With risk avoidance, the project manager might consider moving resources from one part of the project (such as personnel or funding) to another part to help reduce the risk. Risk avoidance is used when there are risks to performance and could involve having backup vendors in case one vendor cannot fulfill what they are contracted to do. Avoiding risks to the schedule may involve setting realistic deadlines that are not too aggressive.

The control approach to mitigating risks involves trying to minimize the impact of risks. This involves consistent monitoring and having a plan in place to proactively respond to the risks. For example, tracking expenses against the expected budget at regular intervals can help the project team identify when line items are at risk of going over budget. When the project manager notices this, they can then implement strategies to manage the expense in that line to control the risk of going over budget. To control the risk of going over schedule, the project manager can keep close tabs on the time needed for tasks and redelegate as needed to make sure the project stays on time.

The transfer strategy can be used to shift the risk—and thus the impact—to another entity associated with the project. However, this approach may not be the best strategy because unintended consequences can arise. For example, if the project is running behind schedule, the project manager could transfer the cause of that delay to an individual team member rather than to the project team as a whole. Although the project team’s reputation might be preserved somewhat, this kind of action could greatly impact the team dynamics. Likewise, if the impact of a product’s failure is transferred to a particular vendor used to produce the product, the business relationship could be altered, even if the costs of the failure are no longer the responsibility of the project team. Caution should be used when choosing this strategy because of the additional consequences that could result.

Finally, the watch strategy involves essentially taking no action but having activities in place in the project plan to consistently monitor the risk for changes that could either increase the probability of occurrence or increase the impact. Strategies such as tracking the actual expenses versus budgeted expenses on a regular basis, or having project team updates on the status of action items, can be used to watch for changes. Monitoring is a key strategy that should be used for all risks identified and should be a key component of the RMP. The bottom line with any of the approaches to risk mitigation is to invest time on the front end of the planning process to be proactive in how the project team responds to risk.

Phase 4: Monitoring and Review

The implementation of risk mitigation strategies is not the end of the risk management process. In fact, mitigation requires ongoing attention and diligence to ensure its effectiveness and adaptability to new threats and changes in the organization’s environment. This phase emphasizes the necessity of continuous monitoring and regular reviews to maintain the integrity of the RMP.