Now that we know our threat,
we now need to think about how we would treat the
risk with that specific threat.
ISO 27005: Information Security Risk management has 4 possibilities
when we think about responses to risk treatment.
There is something in the updated language called
modification which used to be mitigation,
which I do like the update because a mitigation is an assumption.
A modification is a fact.
You changed the environment,
but you don't know that you actually mitigated it so it's a nice update.
Retention has replaced this idea of acceptance because when you really think
about it, is an organization really accepting the risk.
No, they're just retaining the system in the same way that it was before.
Avoidance is a really good terminology because that one didn't change much,
except they change that you could avoid the specific thing that is
causing the risk rather than avoiding the whole ecosystem.
And sharing is a really great update as well because it's
really not transferring the risk fully.
So modification is a course of action that would implement
the controls that are both technical, environmental,
or cultural.
Can you go back to the data center that we said is
threatened by flooding in the previous clip?
What might be a modification step to take?
Yes, you could move the servers up to the fifth floor away from the flood zone.
You should make sure that you don't exceed this thing called the ALE,
the annual loss expectancy, without some real business justification.
Retention means retaining the risk without further action.
In our previous case with the threat of the data center flooding,
we decide that we are going to do nothing, but business as usual.
So we're not taking any extraordinary precaution or steps,
and we need to make sure that there is formal acceptance by the business.
When we think of avoidance,
it's avoiding the activity or condition that precipitates the risk.
Avoid might be that we don't do business related to needing that data center,
but the new definition includes avoiding the specific threat.
And finally, when we think of sharing, the risk is shared with another party.
So this could be contractual, it could be subcontractual,
it could also be insurance of some type,
and we said that this was formally called transfer,
but this like the update of the other three terms makes more sense as we are
actually never going to transfer things like accountability,
and even responsibility cannot be fully transferred,
but we are sharing,
and the line or the watermark of the sharing could vary depending on the
type of service that you're consuming in the cloud.
Finally, let's look at applying the risk process.
If we were to put it in motion,
what are the activities that we should be thinking about?