This document discusses risk management. It defines risk as where assets, vulnerabilities, and threats intersect. It describes identifying threats and assessing risk through scoring matrices. It then discusses ways to reduce risk such as eliminating threats, reducing vulnerabilities, and applying controls. Finally, it discusses ongoing risk management including reassessing risk over time and keeping risk at an acceptable level.

1. FSO Consulting Services
Introduction to
RISK MANAGEMENT

2. FSO Consulting Services
RISK MANAGEMENT
 Risk and Risk Factors
 Risk Assessment
 Ways to Address Risk
 Applying Controls to Reduce Risk
 Managing Risk
 Discussion

3. FSO Consulting Services
WHAT IS RISK? WHAT IS A THREAT?
Risk is where assets, vulnerabilities,
and threats intersect.
RISK
Threats

4. FSO Consulting Services
WHAT IS RISK? WHAT IS A THREAT?
A threat is something (or someone)
that could have a negative impact
on something of value.

5. FSO Consulting Services
RISK FACTORS
 Factors are elements that are multiplied to
determine risk
 Seriousness – how harmful is the threat?
 Likelihood – what are the chances the threat will
exploit a vulnerability?
 Vulnerability – a weakness that could be
exploited
 Impact – what will the damage be if exploited?

6. FSO Consulting Services
IDENTIFYING THREATS
Identify from two angles
 Where the threat might come from
 Everhear of China or Iran?
 What about insider threats?
 How about that Internet thing?
 What kinds of problems might arise?
 Shortage of cleared people?
 Scope creep?

7. FSO Consulting Services
RISK ASSESSMENT: SCORING
 Create a matrix of threats and factors:
Threat Seriousness Likelihood Vulnerability Impact Score
Cyber attack: 4 4 5 4 320
hostile nation

8. FSO Consulting Services
REDUCING RISK
What can you do?
 Eliminate the threat
 Reduce the seriousness of the threat
 Reduce the likelihood of the threat
 Reduce your vulnerability
 Lower the impact

9. FSO Consulting Services
REDUCING RISK
What can you do?
 Eliminate the threat
 Reduce the seriousness of the threat
 Reduce the likelihood of the threat
 Reduce your vulnerability
 Lower the impact

10. FSO Consulting Services
RISK ASSESSMENT: SCORING
 Apply controls
 Forexample, install a UTM appliance
 Rescore:
Threat Seriousness Likelihood Vulnerability Impact Score
Cyber attack: 4 4 2 4 128
hostile nation
 Harden servers to reduce the impact of an
intrusion
 You could cut that score in half

11. FSO Consulting Services
ADDRESSING RISK
Ways to address risk?
 Risk avoidance
 Also reduces opportunity
 Risk transfer
 Insurance, partnerships,
coalitions
 Risk acceptance
 Do nothing

12. FSO Consulting Services
RISK MANAGEMENT
 Identify Risk
 Assess Risk
 Reduce Risk
 Manage Risk
 Re-assess periodically
 Add new threats when identified
 Address in priority order
 Keep risk at an acceptable level

13. FSO Consulting Services
DISCUSSION & QUESTIONS