Fundamentals Risk Management
No organization can remove every danger. Budgets, time, and people limit what anyone can protect. Risk management helps leaders decide which dangers deserve attention first and how much to spend on each.
The Weather Forecast Example
A family plans a picnic. The forecast shows a 70 percent chance of rain. The family can cancel, move indoors, bring tents, or accept the weather. Each choice weighs the chance of rain against the cost of ruined plans. Risk management in cybersecurity follows the same thinking with systems and data in place of picnics.
Understanding Risk
Risk combines two ideas: how likely a bad event is and how much damage it causes.
RISK = LIKELIHOOD x IMPACT Likely event + small damage = Low to medium risk Rare event + huge damage = Medium to high risk Likely event + huge damage = Very high risk
The Risk Management Process
+----------+ +----------+ +----------+ +----------+
| Identify | --> | Assess | --> | Treat | --> | Monitor |
+----------+ +----------+ +----------+ +----------+
^ |
+--------------------------------------------------+
Identify
Teams list assets, threats, and weaknesses. A customer database, a payment website, and employee laptops each appear on the list.
Assess
Teams rate the likelihood and impact of each risk. Simple scales such as low, medium, and high work well for beginners.
Treat
Leaders choose a response for each risk.
Monitor
Conditions change, so teams review risks regularly and update the ratings.
A Simple Risk Matrix
| Likelihood / Impact | Low Impact | Medium Impact | High Impact |
|---|---|---|---|
| High likelihood | Medium | High | Critical |
| Medium likelihood | Low | Medium | High |
| Low likelihood | Low | Low | Medium |
Four Ways to Treat Risk
| Option | Meaning | Example |
|---|---|---|
| Avoid | Stop the risky activity | Retire an old system that nobody can secure |
| Reduce | Add controls to lower likelihood or impact | Install multi-factor authentication |
| Transfer | Shift the financial burden to another party | Buy cyber insurance or use a managed provider |
| Accept | Live with the risk knowingly | Accept a low risk on a test machine |
The Risk Register
A risk register is a shared table that records each risk and its status. Owners update it, and leaders review it.
| Risk | Likelihood | Impact | Rating | Treatment | Owner |
|---|---|---|---|---|---|
| Phishing steals staff passwords | High | High | Critical | Reduce with training and MFA | Security lead |
| Server disk fails | Medium | Medium | Medium | Reduce with backups | IT manager |
| Office flood | Low | High | Medium | Transfer with insurance | Operations |
Residual Risk
Controls rarely remove a risk completely. The leftover danger is residual risk. Leaders compare it with the organization's risk appetite, which describes how much danger the organization will tolerate. Residual risk above the appetite calls for more controls.
Good Habits
- Involve business owners, since they understand the value of assets.
- Use plain language in reports.
- Rank risks so that limited money goes to the biggest dangers.
- Review the register after every major change or incident.
Example: A Small Online Shop
An online shop lists its top dangers: stolen customer data, a payment page outage, and a supplier delay. Stolen data ranks as the highest risk because the likelihood is medium and the impact is severe. The owner spends the first budget on encryption and multi-factor authentication. A backup hosting plan covers the outage risk. The owner accepts the supplier delay and keeps extra stock for busy seasons.
Key Points
- Risk equals likelihood multiplied by impact.
- The cycle runs through identify, assess, treat, and monitor.
- Avoid, reduce, transfer, and accept are the four treatment choices.
- A risk register keeps decisions visible and accountable.