What are we going to do about risk?
This is where you should look at the risk treatment or risk response options.
Risk response can be risk acceptance,
and risk acceptance quite simply says if it happens,
it happens, we'll pay for it.
Risk avoidance says we're not going to participate in that risk‑laden activity.
Risk transference means we'll buy insurance or try to share the risk or,
in some way, pass the risk off to a third‑party.
And risk mitigation or reduction is where we'll use some types of
controls to reduce the amount of risk we face.
The important thing is that risk must be owned.
We come back to that old saying, if it's nobody's job, nobody does it.
And so the problem we have is that, in many cases with risk ownership,
we have to have someone accept that they are responsible for the risk.
Each risk should be communicated to management,
and a risk owner identified who determines what is the
appropriate response to that risk, whether to accept,
avoid, transfer, or reduce the risk.
Risk acceptance is really defined as the level of risk that senior management,
representing the risk owner, is willing to tolerate.
We can see here, for example,
management says we will set a risk acceptance level of $100,000.
Any risk which is less than that, such as risk A and C,
would be quite fine, and even risk D is only at that level,
so it's an acceptable level of risk.
But risks B and E exceed what is the acceptable level of risk.
Now we need to do something about those.
So we accept the ones that are at or below the risk
acceptance level, but when it comes to B,
maybe we actually have to say it's not cost effective to actually try
to reduce that risk down to risk acceptance level,
so maybe we'll just tolerate that.
A toleration or a tolerance of the risk is where we say yes,
it exceeds what is my desired risk acceptance level,
but I will allow that deviation.
In the case of risk E, maybe we need to reduce that risk.
In that case, we could do that through new and enhanced controls.
New and enhanced controls can reduce the risk from what was the
original risk level down we can see considerably,
but there is still a level of residual risk which
exceeds the risk acceptance level.
Residual risk is defined as the level of risk that remains
after the implementation of controls.
The goal of all of our work here in risk management is to ensure that that level
of residual risk is less than or equal to risk acceptance.
We saw that in the case, for example,
of Risk E. Even after putting in some controls,
we are unable to reduce the risk down to an acceptable level.
So the question comes, maybe that's a risk we should avoid.
Maybe we should stop manufacturing that product or investing in that
technology or close that office in a dangerous part of the world,
and that is what we would call then risk avoidance.
Risk transference is to transfer some of the risk to another party,
such as we buy insurance or we share the risk through maybe a joint
venture where several companies work together.
We often see this in financial investment.
Instead of one bank taking all the risk,
they'll share that risk with a number of other banks as well.
But then we need to monitor the risk.
We look at the logs and so we can see what's happening on the systems.
This is where we can use a tool,
such as a security information and event management,
or a SIEM tool,
and that will gather information from many logs and allow
us to see what's actually going on.
We can look at various threat intelligence feeds,
many of these are commercially available and some even for free.
We do risk assessments through being able to do a vulnerability
assessment and see whether or not our level has changed,
and we can do things like a penetration test,
try to break in,
act as if we were a hacker and see whether or not there are
vulnerabilities we are able to exploit.
We also monitor for various types of alerts or alarms that
could indicate some type of a problem.
The key points review.
The level of risk acceptance sets out the baseline for
what is the appropriate level of risk.
The goal of risk management is to ensure that residual risk is less than or
equal to the risk acceptance level set by the risk owner.