A new security manager at a 600-person logistics company gets a simple request from the CEO: list the ten things most likely to hurt the business this year, and say how badly. The IT team has a vulnerability scan with 4,000 findings and firewall logs showing millions of blocked connections a day, yet nobody can produce that list. Plenty of security data and no picture of risk is where many organizations start.
On the CompTIA Security+ SY0-801 exam, risk management sits under objective 5.2, which expects you to explain how risk management processes affect an organization's security. This lesson covers the first half of that process: identifying risks from the assets you own, giving each risk an owner, and assessing and analyzing risks so they can be scored and compared. The rest of the section covers the dollar calculations, the treatment decision, and the register and business context that hold it all together.
Risk management is a cycle that never really finishes
The threat intelligence section introduced risk as the meeting point of likelihood and impact: the chance that a threat exploits a vulnerability, weighed by the harm that follows. Risk management is the repeatable process an organization uses to find those risks and decide what to do about them. It runs as a loop:
- Identify: find the assets, the threats to them and the weaknesses those threats could use.
- Assess and analyze: estimate likelihood and impact, score each risk and sort the list.
- Treat: decide to mitigate, transfer, avoid or accept each risk.
- Monitor and review: track the risks and the controls, and feed changes back into identification.
The loop never finishes because its inputs keep changing. A new SaaS application, an acquisition, a new regulation or a new exploit technique can each create risks that weren't on last quarter's list. Some assessments run on a calendar, often annually, and others are triggered by events such as a major incident or a new system going live.
Several published frameworks describe the cycle. NIST SP 800-30 is the U.S. government's guide to conducting risk assessments, NIST SP 800-37 defines the Risk Management Framework used for federal systems, ISO 31000 gives general risk management guidelines, and ISO/IEC 27005 applies them to information security. Their vocabulary differs slightly, but the loop is the same, and Security+ tests the concepts rather than one framework's terms.
Risk identification starts with an inventory of what you have
You can't assess risk to something you don't know you own, so asset identification comes first: hardware, software and SaaS subscriptions, data sets, network services, facilities, key people and roles, and the third parties that hold your data or run your processes. The inventory itself is maintained through asset management, which has its own section; risk identification uses it and adds the business view.
For each asset, record what it does for the business, what data it holds and what depends on it. Value comes from that dependency, not from the purchase price. A $3,000 server running the dispatch system that schedules every truck matters far more than a $40,000 test cluster nobody would miss for a week.
With the assets known, you identify what could go wrong with each one. Useful sources include vulnerability scans and penetration test reports, threat intelligence about groups targeting your industry, incident and help desk history, audit findings, vendor security notices, and workshops with the people who run each process. Those people often know a process's weak spots better than any tool does.
Write each risk as a risk statement that names a cause, an event and a consequence. "Cyber attack" is not a risk; this is:
RISK-014
Cause: Staff email accounts are protected by a password only
Event: An attacker phishes a password and deploys ransomware on the file servers
Consequence: Dispatch and billing stop for up to five days; customer data may be stolen
A statement this specific tells you which controls would change it and who would feel the harm. That second point leads directly to ownership.