Let's consider an assortment of frameworks for
managing risk from both NIST and ISO.
ISO 31000, released in 2018, is a guidance standard,
and it is not intendant for certification.
The approach is such that it doesn't address specific or legal
requirements related to risk assessments,
risk reviews, and overall risk management.
But, it does consider the cloud environment by means of five elements.
This would include integration, design, implementation,
evaluation, and improvement.
It's actually the internal model that is used inside of Microsoft.
It, like many other frameworks,
would be inclusive of getting the sponsorship of
executive management in the organization.
ISO 27005, the information security risk management framework,
has a risk management approach that uses evaluation criteria,
impact, and assessment criteria,
and scope and boundaries that are related to risk treatment.
The idea of accepting risk and communicating the risk and monitoring
becomes an extremely important part to ensure that your understanding
of what the risks are today may actually be a different understanding
of what the risks are tomorrow.
NIST Special Publication 800‑39 focuses on managing
information systems security risk.
And it has a movement related to the assessing,
the responding, the monitoring of risk that's all based upon framing it.
NIST Special Publications 800‑37 is entitled the risk management framework.
Here is where we start off with categorizing the system and the
information process stored and transmitted in that system based
on an analysis of the impact of loss.
Then,
you select an initial security baseline of controls of that
system to help with the categorization, the impact,
to reduce the loss.
You implement the controls that describe how they are employed
within the system and its environment of operation.
Once you implement it,
you determine if they have been implemented correctly
and if they're operating as intended.
They also have a formal process of authorizing these controls,
based on a determination that the risk to the organizational,
operational, and asset loss is acceptable.
Finally,
they have deployment management that controls the instantiated
changes that need to be made to the environment.
NIST also has a framework for improving critical
infrastructure for cybersecurity.
It starts off with a core, and this focuses on a set of industry standards,
guidelines,
and practices in a manner that allows for a communication of cybersecurity
activities and outcomes across the whole organization.
There's what's called framework Tiers that measure the maturity of risk,
starting off with Partial at Tier 1, going all the way up to Adaptive at Tier 4.
These Tiers reflect a progression from informal reactive responses
to approaches that are agile and risk informed.
And the third part of it is a profile.
The profile represents the outcomes based on business needs that an
organization has selected from the categories and subcategories.
So it could be, where are we now at a current state,
and where do we want to be,
especially when it comes to financial elements of supporting your
business or mission drivers inside of your risk assessment.
Next,
let's break down the assessment process by looking at
qualitative and quantitative analysis.