Risk management is
a popular buzzword in today’s business world, but many IT administrators have
only a vague idea of what it means and how it fits into their job descriptions.
Risk management is a fairly simple concept; it refers to the process of making
decisions based on an evaluation of the factors that present a threat to the
business. In IT, that means assessing your network’s vulnerabilities and threat
exposure, and taking the steps necessary to mitigate them.

There are several different components to risk management,
then:

  • A
    risk management framework that describes areas of responsibility and the
    stream of accountability within the organization or department.
  • Risk
    analysis, a process of identifying vulnerabilities and calculating
    financial and loss expectancy metrics.
  • A
    risk management plan, which lays out the way specific tools
    will be used to reduce the risks to an acceptable level.

If all this sounds like a bunch of MBA mumbo-jumbo to you,
you’re not alone.

Tips in your inbox

TechRepublic’s free Strategies that Scale newsletter, delivered each Tuesday, covers topics such as how to structure purchasing, when to outsource, negotiating software licensing or SLAs, and budgeting for growth.

Automatically sign up today!

Risk management in plain English

The steps involved in performing a risk analysis can be
broken down into a few categories:

  • Identifying
    the risks (in this case, the risks to your organization that are presented
    by your network).
  • Determining
    the potential impact of the threats.
  • Weighing
    the cost of safeguards against the impact of the threats.
  • Making
    the decision on how to address risks effectively and cost efficiently.
  • Implementing
    risk controls.
  • Assessing
    effectiveness.

A risk can be to the company’s assets (a risk that can
result in financial loss, such as the exposure of the company’s trade secrets
to a competitor, or violation of regulatory statutes such as HIPAA or the GLB
Act, which would result in fines and possibly other penalties). Some risks are
to the company’s mission (risks that interfere with employees’ performance of
their jobs, such as a denial of service attack that brings down the network).
Of course, these categories can overlap; a single vulnerability may threaten
both assets and mission.

The impact refers to the severity of the threat and the
probability of a loss resulting from it. Probability x severity = the risk
exposure.

The next step is to determine the cost/benefit ratio of the
various measures you can take to reduce or eliminate the risk, and making
decisions based on that information. Risk management formulae can tell you how
much you can expect to lose per year to a specific threat. This gives you an idea of how much you can cost effectively spend on a
specific threat.

Risk management software

Of course, all of this calculation can be done manually but
it’s much easier to let software do it for you. Some popular enterprise level
packages include:

Some of these and other risk management software packages
provide evaluation versions or “lite” versions.
However, commercial risk assessment software tends to be expensive. For example,
Enterprise Risk Assessor (ERA) Lite costs over $5000.

Starting small

But what if your company is still small? Does that mean you
don’t need a risk management program? On the contrary, because small businesses
usually operate on tighter budgets, with less surplus funds, it’s more
difficult for your small company to absorb a large loss than for a large
organization. Thus, identifying and managing your risks is, in many ways, even
more important. But your needs are different, and so is your ability to fund a
risk management program.

No matter what size your business is, you should have a
written business plan. Risk management should be a part of that plan, rather
than a standalone project. And it should be looked at as an ongoing process,
rather than a short-term project. Risks, especially in the IT area, are
constantly changing.

Even if your organization can’t afford a complex commercial
risk management solution or the high per-hour rates of professional risk
management consultants, there are tools available that you can use to make risk
assessment and control easier. Microsoft provides a free, comprehensive
Security Risk Management Guide on the TechNet Website that can help get you
started, at no cost. The file is a bit over 2 MB.

EDITOR’S NOTE: You
can download Microsoft’s Security Risk Management Guide at http://www.microsoft.com/technet/security/topics/policiesandprocedures/secrisk/default.mspx.

The guide is not specific to Microsoft products; it is, in
their words, “technology agnostic.” It’s a 139 page document in PDF format, and
covers risk management concepts, risk management practices and comparison of
different approaches (reactive vs. proactive, quantitative vs. qualitative),
phases of the risk management process, details of risk assessment, how to
conduct the decision support phase, tips for implementing control solutions,
and how to measure the effectiveness of the program.

The download is more than a “how to” guide. It also includes
XLS tools for gathering data, summarizing and prioritizing risk, as well as a
sample project schedule.

These tools can be used by organizations in any industry,
and of any size.

Scaling risk management

The basic concepts of risk management don’t change as your
business grows, but your implementation of risk controls probably will. Your
security risk management “team” may start out as one person; as the organization
grows, so should the team. The risk management process evolves along with your
overall security framework.

Free tools can remain useful even if you decide to implement
more sophisticated software solutions. The software simply makes the process more
automated. Building a solid knowledge of risk management practices while the
organization is small will help you to retain control over the process when it
becomes more automated, rather than simply relying on the software to do
everything for you.

Even if your company can’t afford a risk management package
now, you should plan ahead as you begin to formulate your initial risk
management plan, so that you’ll already know which package is right for you
when the time comes and what’s required to implement it. That will make the
transition much smoother.