Risk management is
a popular buzzword in today’s business world, but many IT administrators have
only a vague idea of what it means and how it fits into their job descriptions.
Risk management is a fairly simple concept; it refers to the process of making
decisions based on an evaluation of the factors that present a threat to the
business. In IT, that means assessing your network’s vulnerabilities and threat
exposure, and taking the steps necessary to mitigate them.
There are several different components to risk management,
risk management framework that describes areas of responsibility and the
stream of accountability within the organization or department.
analysis, a process of identifying vulnerabilities and calculating
financial and loss expectancy metrics.
risk management plan, which lays out the way specific tools
will be used to reduce the risks to an acceptable level.
If all this sounds like a bunch of MBA mumbo-jumbo to you,
you’re not alone.
Risk management in plain English
The steps involved in performing a risk analysis can be
broken down into a few categories:
the risks (in this case, the risks to your organization that are presented
by your network).
the potential impact of the threats.
the cost of safeguards against the impact of the threats.
the decision on how to address risks effectively and cost efficiently.
A risk can be to the company’s assets (a risk that can
result in financial loss, such as the exposure of the company’s trade secrets
to a competitor, or violation of regulatory statutes such as HIPAA or the GLB
Act, which would result in fines and possibly other penalties). Some risks are
to the company’s mission (risks that interfere with employees’ performance of
their jobs, such as a denial of service attack that brings down the network).
Of course, these categories can overlap; a single vulnerability may threaten
both assets and mission.
The impact refers to the severity of the threat and the
probability of a loss resulting from it. Probability x severity = the risk
The next step is to determine the cost/benefit ratio of the
various measures you can take to reduce or eliminate the risk, and making
decisions based on that information. Risk management formulae can tell you how
much you can expect to lose per year to a specific threat. This gives you an idea of how much you can cost effectively spend on a
Risk management software
Of course, all of this calculation can be done manually but
it’s much easier to let software do it for you. Some popular enterprise level
- COBRA Risk Consultant from
Commander from TruSecure
Risk Assessor from MethodWare
- Risk Register from Noweco
Some of these and other risk management software packages
provide evaluation versions or “lite” versions.
However, commercial risk assessment software tends to be expensive. For example,
Enterprise Risk Assessor (ERA) Lite costs over $5000.
But what if your company is still small? Does that mean you
don’t need a risk management program? On the contrary, because small businesses
usually operate on tighter budgets, with less surplus funds, it’s more
difficult for your small company to absorb a large loss than for a large
organization. Thus, identifying and managing your risks is, in many ways, even
more important. But your needs are different, and so is your ability to fund a
risk management program.
No matter what size your business is, you should have a
written business plan. Risk management should be a part of that plan, rather
than a standalone project. And it should be looked at as an ongoing process,
rather than a short-term project. Risks, especially in the IT area, are
Even if your organization can’t afford a complex commercial
risk management solution or the high per-hour rates of professional risk
management consultants, there are tools available that you can use to make risk
assessment and control easier. Microsoft provides a free, comprehensive
Security Risk Management Guide on the TechNet Website that can help get you
started, at no cost. The file is a bit over 2 MB.
EDITOR’S NOTE: You
can download Microsoft’s Security Risk Management Guide at http://www.microsoft.com/technet/security/topics/policiesandprocedures/secrisk/default.mspx.
The guide is not specific to Microsoft products; it is, in
their words, “technology agnostic.” It’s a 139 page document in PDF format, and
covers risk management concepts, risk management practices and comparison of
different approaches (reactive vs. proactive, quantitative vs. qualitative),
phases of the risk management process, details of risk assessment, how to
conduct the decision support phase, tips for implementing control solutions,
and how to measure the effectiveness of the program.
The download is more than a “how to” guide. It also includes
XLS tools for gathering data, summarizing and prioritizing risk, as well as a
sample project schedule.
These tools can be used by organizations in any industry,
and of any size.
Scaling risk management
The basic concepts of risk management don’t change as your
business grows, but your implementation of risk controls probably will. Your
security risk management “team” may start out as one person; as the organization
grows, so should the team. The risk management process evolves along with your
overall security framework.
Free tools can remain useful even if you decide to implement
more sophisticated software solutions. The software simply makes the process more
automated. Building a solid knowledge of risk management practices while the
organization is small will help you to retain control over the process when it
becomes more automated, rather than simply relying on the software to do
everything for you.
Even if your company can’t afford a risk management package
now, you should plan ahead as you begin to formulate your initial risk
management plan, so that you’ll already know which package is right for you
when the time comes and what’s required to implement it. That will make the
transition much smoother.