In this section of the course,
we are going to discuss Risk Management.
The Risk Management section of the course focuses
on Domain 1: Governance, Risk, and Compliance,
specifically objective 1.2, which states
that given a set of organizational security requirements,
you must be able to perform risk management activities.
In managing enterprise security risk,
it is critical to protect organizational assets
and ensure operational resilience.
This includes safeguarding data,
maintaining system reliability, and managing external risks.
Comprehensive frameworks
and assessment strategies help in this process
by identifying and mitigating potential threats,
while strategic responses and impact assessments
frame the policies an organization uses to manage its risk.
As we go through this section,
we will cover many topics related to Risk Management,
including Confidentiality, Integrity, Availability,
and Privacy Risk Considerations,
Risk Assessment Frameworks,
Risk Assessment and Response, Impact Analysis,
and Third-Party Risk Management.
First, we will look at Confidentiality Risk Considerations.
Confidentiality risk considerations are used to identify
and mitigate threats that could lead to unauthorized access
or disclosure of sensitive information.
Confidentiality risk consideration concepts
include incident response testing, encryption,
sensitive or privileged information data breach,
data leak response, and reporting.
Incident response testing is simulating security breaches
to assess and improve an organization's ability to detect,
respond to, and recover from incidents.
To guarantee the confidentiality of data on a network,
encryption is used to protect the sensitive data.
If data is not protected, then a breach of sensitive
or privileged data may occur.
A data breach occurs
when unauthorized individuals gain access
to confidential information.
A data breach can lead to significant damage,
if not properly addressed.
In response to a data breach,
data leak response includes actions taken to contain
and mitigate the impact of a data breach.
Data leak response procedures ensure
that incidents are documented
and communicated to relevant stakeholders,
including regulatory bodies.
This is the process of reporting.
Then, we will explore Integrity Risk Considerations.
Integrity is the assurance
that data remains accurate and unaltered,
and that any unauthorized changes are detectable.
Integrity risk considerations are those taken
to protect data and systems from unauthorized modifications
that could compromise their accuracy and trustworthiness.
Integrity Risk Considerations include interference,
hashing, remote journaling, and anti-tampering.
Interference refers to any unauthorized alteration
or disruption of data
or systems leading to integrity issues.
Hashing is a cryptographic process
that converts data into a fixed-size string of characters.
Hashing creates a unique digital fingerprint used to verify
that data has not been altered.
Next, remote journaling is the continuous transmission
of transaction logs to a remote location.
Through this process,
remote journaling provides a secure backup
that helps recover from integrity breaches.
Next, anti-tampering measures are designed to prevent
or detect unauthorized changes to hardware or software.
Anti-tampering measures ensure
that systems remain trustworthy.
In application, an organization might use hashing
to verify the integrity of critical files,
employ remote journaling to secure logs offsite,
and implement anti-tampering techniques
to protect against unauthorized modifications,
all working together to mitigate integrity risks.
After that, we will look
at Availability Risk Considerations.
Availability risk considerations ensure
that critical systems and data remain accessible during
and after disruptive events.
Availability risk considerations include Business Continuity
and Disaster Recovery Planning, Backups,
and Business and Continuity and Disaster Recovery Testing.
Business continuity and disaster recovery planning
develop strategies to maintain availability
or to quickly restore systems following a disaster.
Backups are a key to recovery in these situations.
Once plans and policies are developed,
regular business continuity
and disaster recovery testing verifies
that the processes in place can be effectively executed.
Next, we will explore Privacy Risk Considerations.
Privacy risk considerations include the use of biometrics,
data subject rights, and data sovereignty.
The use of biometrics introduces enterprise risk
in that sensitive biometric signatures must be protected.
Data subjects are the owners of the data
that is collected and stored.
Data subject rights include the ability of individuals
to control their personal information, including rights,
to access, correct, and delete their own data.
Data sovereignty is the idea that laws,
which govern how data can be collected, stored,
and used are based on where the data is stored or processed.
For example, if you are an American,
but your upcoming travel data is being stored in Europe,
the privacy of that data is subject to European laws,
not American laws.
Following that, we will look at Risk Assessment Frameworks.
A risk assessment framework is used to identify, assess,
and manage risks within an enterprise organization.
Frameworks further help enterprise organizations address
potential threats, ensure compliance with regulations
and protect assets and operation.
Commonly used risk assessment frameworks
include the National Institute of Standards and Technology
or NIST Risk Management Framework,
which focuses on integrating security controls
and continuous monitoring,
particularly in federal environments.
The International Organization for
Standards or ISO 27005,
which provides a standardized approach
to information security risk management.
The Committee of Sponsoring Organizations
of the Treadway Commission
or COSO Enterprise Risk Management Framework,
which emphasizes the alignment of risk management
with business strategy and objectives,
the operationally critical threat assessment
and vulnerability evaluation, also known as OCTAVE,
which helps organizations assess
and manage security risks specific
to their operational environment.
And finally, a Factor Analysis of Information Risk
or FAIR, which focuses on financial impact as a way
to prioritize and manage risk.
Then, we will explore Risk Assessment.
A risk assessment identifies, analyzes,
and evaluates potential risk impact,
and guides the implementation of mitigation strategies.
Risk assessment concepts include quantitative analysis,
qualitative analysis, risk appetite, risk tolerance,
and risk prioritization.
Let's take a moment to define each of these.
Quantitative analysis uses numerical data
and statistical methods to measure risk.
Qualitative analysis uses subjective non-numerical criteria
and the experience of analysts and subject matter experts.
Risk appetite is the amount
of risk an organization is willing to accept.
Risk tolerance is a specific level
of acceptable risk within an organization's risk appetite.
Risk prioritization is the ranking
of risks based on their potential impact and likelihood
to ensure the most critical risks are addressed first.
After that, we will look at Risk Response.
Risk response is the implementation of controls
to mitigate identified risk.
Risk response concepts include validation,
which confirms the accuracy
and completeness of identified risks; severity impact,
which quantifies the potential consequences
of validated risks, guiding prioritization;
and remediation, which results in the implementation
of actionable risk management and mitigation strategies.
Then, we will explore Impact Analysis.
Impact analysis in enterprise risk management
involves evaluating the potential consequences
of identified risks on organizational operations,
assets, and objectives.
This process quantifies how adverse events
could affect business continuity, financial performance,
and compliance, thereby enabling informed decision-making
and prioritization of risk mitigation efforts.
I will highlight impact analysis with extreme
but plausible examples.
Finally, we will explore Third-party Risk Management.
Third-party risk management involves assessing
and mitigating risks associated with external parties
that provide commodities or services to an organization.
Third party risk management considerations
include Subprocessor Risk,
which arises when a third-party vendor subcontracts work;
Vendor risk, which focuses on the potential impact
of direct suppliers to the organization;
and Supply Chain Risk,
which encompasses risks across all stages
of the supply chain, including both
subprocessors and vendors.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course.
And we will review each of those quiz questions fully
to ensure you can explain why the right answers were right,
and the wrong answers were wrong.
So, let's get ready to dive into risk management
in this section of the course!