Security Risk Management

Security risk management is the discipline of identifying what could harm an organization's information systems, judging how likely and how damaging each threat could be, and deciding what to do about it. It turns security spending into justified decisions grounded in threats, vulnerabilities, and business impact.

itCybersecurity fundamentals and governance

Security Risk Management

Security risk management is the discipline of deciding how much risk an organization accepts from threats to its information and systems, and what it does about the exposure it will not accept. It connects technical findings, such as a vulnerable service or a vendor with weak access controls, to business decisions about what to protect and how much to spend.

The work follows a loop:

frame the risk → assess the risk → respond to the risk → monitor the risk
      ↑                                                      │
      └────────────────── revise and repeat ─────────────────┘

Framing sets the rules for the assessment. Assessment produces the exposure picture. Response changes the exposure. Monitoring keeps the picture current. Revision feeds change back into the loop.

Risk is made of threat events, vulnerabilities, and impact

Risk is a function of the likelihood of a threat event and the magnitude of its impact. A threat source is the actor or circumstance that could cause harm, such as an external attacker, a negligent insider, or a flood. A threat event is the action or occurrence that exploits a weakness, such as a phishing message that captures credentials. A vulnerability is a weakness that a threat event could exploit, such as an unpatched service or a missing access review. A predisposing condition is a factor that makes a weakness more exploitable or more impactful, such as an exposed management interface.

Security Risk Management

Risk is made of threat events, vulnerabilities, and impact

Relevant careers