Risk Management Strategies - CompTIA Security+ SY0-701 - 5.2

Summary

The script outlines various risk management strategies employed by organizations, including risk transfer through cybersecurity insurance, risk acceptance with policy exemptions or exceptions, risk avoidance, and risk mitigation via investments like next-generation firewalls. It emphasizes the importance of risk reporting, a dynamic document that lists and describes tracked risks, guiding management in making informed business decisions.

Takeaways

• 🔄 **Risk Transfer**: Organizations can transfer risk by moving it under the control of a different party, like purchasing cybersecurity insurance.
• 🛑 **Risk Acceptance**: Companies may choose to accept risks, allowing them to decide how to handle the risk, which is a common approach.
• 🚫 **Policy Exemptions**: Risk acceptance can involve exempting certain policies, such as not patching a device that cannot be updated but is not connected to the network.
• 🛠 **Policy Exceptions**: Organizations may create exceptions to security policies, like delaying patching if it causes critical software to crash.
• 🚫 **Risk Avoidance**: A strategy to completely avoid risk by removing it from the organization, eliminating the need for additional risk management.
• 🛡 **Risk Mitigation**: Investing in solutions like next-generation firewalls to reduce the impact of certain risks, such as those from the internet.
• 📋 **Risk Reporting**: Tracking risks through reports that list all risks, their descriptions, and handling strategies, often referenced by upper management.
• 🔄 **Continuous Updates**: Risk reports are usually constantly updated to include critical and emerging risks for consideration in business decisions.
• 🔑 **Management Involvement**: Upper management, especially those making business decisions, rely on risk reports for information on what to purchase and how to handle risks.
• 📈 **Business Decision Impact**: Risk reports play a crucial role in informing business decisions, particularly on risk management strategies and investments.
• 🗂 **Documented Risks**: The script emphasizes the importance of documenting all risks and their management strategies for organizational awareness and decision-making.

Q & A

What is one strategy an organization might use to deal with risk?

One strategy is to transfer the risk, which involves moving the risk under the control of a different party, such as through the purchase of cybersecurity insurance.

What does it mean for a company to accept the risk?

Accepting the risk means the company decides to keep the risk and determine how to handle it, which is a common course of action.

Can you provide an example of when a company might accept the risk by exempting their existing policies?

An example is when a company has a policy that every device must receive patches, but they have a piece of equipment that the manufacturer does not support patching or updating, leading to an exemption for that device.

What is an exemption in the context of risk management?

An exemption is an exception to the standard security policy, granted under specific circumstances, such as when a device cannot be patched due to manufacturer restrictions.

How might a company handle a conflict between required patching timeframes and operational issues?

The company can create an exception to the policy, allowing more time to update their software to work better with the patches, thus resolving the conflict.

What is another risk management strategy besides transferring or accepting the risk?

Another strategy is to completely avoid the risk by removing the source of the risk from the organization.

Can you give an example of risk mitigation?

An example of risk mitigation is investing in a next-generation firewall to reduce the issues associated with internet connectivity.

How can an organization track multiple risks?

An organization can track risks through risk reporting, which lists all the risks being tracked, describes each risk, and outlines how to handle them.

Who typically references the risk report in an organization?

Upper management, especially those who need to make business decisions on purchases and risk handling, commonly reference the risk report.

What kind of information does a risk report usually contain?

A risk report usually contains a list of all tracked risks, descriptions of each risk, how to handle them, and often includes critical and emerging risks that should be considered by management.

How frequently is a risk report updated?

A risk report is usually a document that is constantly updated to reflect the current state of risks and any new developments.

Outlines

00:00

🛡️ Risk Management Strategies

This paragraph discusses various strategies an organization might employ to manage risk. It highlights risk transfer, such as purchasing cybersecurity insurance, and risk acceptance, which involves making a conscious decision to handle the risk internally. The text also touches on exemptions to security policies, such as allowing certain devices to remain unpatched under specific conditions. Additionally, it mentions risk avoidance, where the risk is entirely eliminated, and risk mitigation, like investing in a next-generation firewall to reduce internet-related risks. The paragraph concludes with the importance of risk reporting, which serves as a document for tracking and managing risks, and is crucial for upper management in making informed business decisions.

Keywords

💡Risk Transfer

Risk transfer is a strategy where the risk is moved from one party to another, effectively shifting the responsibility of potential losses. In the context of the video, cybersecurity insurance is given as an example of risk transfer, where the financial burden of a cyber attack is shifted to the insurance company. This strategy is crucial for organizations looking to safeguard against unforeseen events that could impact their operations.

💡Risk Acceptance

Risk acceptance is the decision to live with a risk, acknowledging its presence and choosing not to take any further action to avoid or reduce it. The video mentions that this is often the most common course of action for companies. An example provided is the exemption of certain policies, such as not updating the operating system on a piece of manufacturing equipment due to the manufacturer's policy, which demonstrates how organizations may accept risks when they believe the cost or effort of mitigation outweighs the potential threat.

💡Policy Exemption

A policy exemption is a deliberate deviation from a standard policy, often due to unique circumstances or constraints. The script uses the example of a device running on an unsupported operating system that cannot be patched, leading to an exemption from the company's policy requiring regular updates. This concept is integral to risk management as it allows for flexibility in response to specific situations that do not fit the general rule.

💡Security Policy

Security policy refers to the set of rules and guidelines that an organization establishes to protect its assets from potential threats. The video discusses how these policies might be excepted or modified in certain situations, such as when a device cannot receive necessary updates, illustrating the balance between maintaining security standards and accommodating practical limitations.

💡Risk Avoidance

Risk avoidance is the strategy of eliminating a risk entirely by removing the source of the potential harm. The video suggests that by completely avoiding the risk, there is no need for additional risk management. This strategy is about preventing the risk from occurring in the first place, which can be more effective than trying to mitigate or transfer the risk after it has arisen.

💡Risk Mitigation

Risk mitigation involves reducing the likelihood or impact of a risk. The video provides the example of investing in a next-generation firewall to reduce the risk associated with internet connectivity. This strategy is about taking proactive steps to lessen the potential negative effects of a risk, even if it cannot be completely avoided.

💡Risk Reporting

Risk reporting is the process of documenting and communicating the risks that an organization faces, along with their potential impacts and how they are being managed. The script highlights the importance of this document for upper management, as it provides a constantly updated list of risks, including critical and emerging ones, which aids in making informed business decisions.

💡Critical Risks

Critical risks are those that pose a significant threat to an organization's operations, assets, or reputation. The video mentions that risk reporting should include critical risks, emphasizing their importance for management to consider when making business decisions. These risks require immediate attention and strategic planning to prevent or minimize potential damage.

💡Emerging Risks

Emerging risks are new or evolving threats that may not have been previously identified or may have gained significance due to changes in the environment or technology. The script notes that risk reporting should also contain information on emerging risks, which is crucial for staying ahead of potential threats and adapting risk management strategies accordingly.

💡Business Decisions

Business decisions refer to the choices made by management that determine the direction and success of an organization. The video script underscores the role of risk reporting in informing these decisions, particularly in relation to risk management strategies and the purchase of resources or technologies to mitigate potential threats.

💡Next-Generation Firewall

A next-generation firewall is a network security device that goes beyond traditional firewalls by offering advanced features such as intrusion prevention, application awareness, and secure access. The video uses this as an example of a risk mitigation strategy, where investing in such technology can help an organization reduce the risk associated with internet connectivity.

Highlights

Organizations can use various strategies to manage risk.

Risk transfer involves moving risk to a different party, like purchasing cybersecurity insurance.

Accepting risk is a common approach where a company decides how to handle the risk.

Risk acceptance can involve exempting existing policies, such as for devices that cannot be patched.

An exemption may be granted for devices that cannot be updated, as long as they are isolated from the network.

Exceptions to security policies can be created when necessary, such as when patches cause software issues.

Avoiding risk completely removes the need for additional risk management.

Risk mitigation involves taking steps to reduce risk, like investing in next-generation firewalls.

Risk reporting is a method to track and manage risks within an organization.

Risk reports list all tracked risks and provide descriptions and handling strategies.

Upper management often refers to risk reports for making informed business decisions.

Risk reports are updated regularly to include critical and emerging risks.

Management should consider risk reports when making decisions on purchases and risk handling.

Risk management strategies are essential for organizations to protect against potential threats.

The transcript provides insights into effective risk management practices in organizations.

Understanding different risk management strategies can help organizations make better-informed decisions.

Risk management is a continuous process that requires ongoing monitoring and adaptation.

Transcripts

An organization might use a number of different strategies

to deal with risk.

One of these strategies might be to transfer the risk.

That means we move the risk under the control

of a different party.

A very good example of risk transfer

would be the purchase of cybersecurity insurance.

Another alternative might be that the company simply

accepts the risk.

This is usually the most common course of action,

and it allows the company to decide what they would

like to do with that risk.

There may be times when a company accepts the risk,

and they do it by exempting their existing policies.

There may be a case where a particular security policy

cannot be followed, and so an exemption is required.

For example, an organization may have purchased a large piece

of equipment used for manufacturing,

and that equipment uses the Windows operating system.

But the manufacturer of that equipment

says that they do not support patching or updating

the operating system on that device.

That means that the monthly Microsoft updates could not

be applied, but there is a company policy

that says that every device must receive those patches.

In that example, the company management

may approve an exemption just for that device,

provided the device is not connected to the network.

There might also be cases where the risk is accepted

but there is an exception to the security policies

you have in place.

An example of this might be that the organization has decided

that every device must be patched

within three days of the patch being made public.

But during their testing, the company

finds that this month's set of patches

causes a critical software package to crash.

To resolve this conflict between the time frame required

to patch and the patch being operational,

the company can create an exception.

In this example, the company may have an exception

that allows them to wait more than three days so they

can update their software to work better with these patches.

Another risk management strategy would be

to completely avoid the risk.

That means that there would not be a need

to provide any additional risk management

because that particular risk has been completely removed

from the organization.

And in some cases, we may be able to mitigate the risk.

For example, if we're concerned about risk coming

from the internet, we may want to invest

in a next-generation firewall, which

mitigates some of the issues associated

with that connectivity.

An organization may have tens or even

hundreds of risks that need to be tracked.

And one way to track these is through the use

of risk reporting.

This creates a list of all of the risks

the company is tracking and allows

for a description of each of those risks

and how to handle them.

This is a document that's commonly

referenced by upper management, especially

the management that needs to make business decisions on what

to purchase and how to handle these risks.

This is usually a document that is constantly updated,

and it usually contains critical risks and emerging risks,

especially those risks that should be considered

by the management of the company when making additional business

decisions.