How do you manage risk when you're not sure?

This is not an easy task, it is full of different challenges, but there are some different strategies that may help to manage and mitigate risk. 1. Start by collecting, and documenting the most likely or potential risks. 2. Establish a list of the most likely risk scenarios, and based on the uncertainties that may exist and impact an organization. 3. Conduct a risk assessment for each of the risk scenarios above, and understand and identify both the impact and the likelihood of each risk scenario occurring. 4. For each of the risks that are most likely and also have the most impact or disruption, focus on developing strategies and plans to try and mitigate, but not avoid the impact of some unforeseen event(s). 5. Communicate and share

Managing uncertainty is not about eliminating all risks but making informed decisions and taking steps to mitigate and adapt to the unknown. It’s an ongoing process that requires flexibility and resilience.

Managing unknown risk is always a challenge. One of the most effective way to do is to understand and know your environment and conduct periodic risk assessment to identify the risks and vulnerabilities. Additionally, based on the industry segment company should implement defence in depth controls across the environment to ensure they are protected across . The other must have is to have strong AI/ML based analytical platform to identify unknown patterns and to be able to detect and block the potential attacks right before executions.

The no. 1 step to is define very clearly business objectives and security objectives that tie to these business objectives. Unless you understand business context, it’s extremely difficult to understand relevant risks. Once you have the business content, the security objectives and underlying business objectives clear, the next step is to define and describe risk scenarios that are relevant for your organization and business. The key is to be relevant. They second important aspect is to be descriptive. If you cannot describe the risk scenario in 1-2 short lines it will most likely be vague and will result in value risk assessment. A successful risk assessment in security ensures the risk assessment connects to business consequences.

One method for better understanding uncertainty and to ensure you’re avoiding groupthink is to employ a method known as a Pre-Mortem. This was developed by Cognitive Psychologist Gary Klein, and it promotes feedback from the group on what you might be overlooking because your starting assumption is that the project HAS failed and you want to understand why. By projecting into the future you give people permission to express their real views.

Framework is great but the key is - how do you aggregate different risks across the organization to overall risk scenarios - how do you connect risks to overall business consequences - how do you tie the risk treatment to controls and actions - how do you monitor effectiveness - how do you report treatment’s effectiveness - how do you integrate with ERM These above questions need to be answered by whatever framework you use. Whether is cyber risk or project risk or financial risk, one can follow the standard ISO 27005 risk management process. The only addition you’d have with cyber risk is the threat actors matrix - aka motivation and capability something I have done in the organizations I built enterprise risk management for.

How to pick the best of both (ISO 27005 & NIST SP 800-30) worlds: - ISO 27005 features a complete risk management process that includes the assessment and treatment of risk - NIST SP 800-30 is mainly focused on risk assessments but does a better job at detailing how to assess risks. I prefer to follow the process as described in ISO 27005 and use the guidance provided by NIST to executer the assessment steps.

Choosing a framework is essential for any organization to have a guideline and be followed and an excellent way to measure maturity. However, people hear about frameworks A or B and always want to use the best ones. However, depending on the company's size, people resources or third-party contracts, the best framework can be expensive and time-consuming to implement. Sometimes less and more, if your company is not used to following a standard or needs more resources, I recommend adopting CIS controls v8, as it is easy to implement and cheaper than other market frameworks such as NIST, example. After reaching the desired maturity, you can change the framework without any headaches. Remember always to share the results with stakeholders.

I disagree with this being the second step. Determining your risk assessment methodology should be the first step in the process. I would also recommend using quantitative models that focus on financial impact over qualitative models that focus subjective high, medium and low ratings. Leaders trying to determine how best to handle security risk want to understand the potential financial impact in the next 1, 5, or 10 years if the risk is not mitigated v. the cost of mitigating the risk over that same time period.

Risk management in specialist spaces takes a village. You need domain specialists who translate for lay people. You need business experts who have time to contribute. You need governance people who create connective tissue for collaborative assessment. You need the foundations of risk profile visibility and systems / data / vendor governance to move beyond reacting to individual incidents, audit points, projects, or procured solutions. That needs consistent investment and work to mature. Moving to risk management by design, whether for security, privacy, quality, safety. One missing piece is structured means to surface uncertainty. Sometimes a risk cannot be estimated. Especially dealing with novel tech and complex supply chains.

In quantitative risk analysis, organizations attempt to determine the actual costs and probabilities of risks. - The Asset Value (AV) represents the replacement value for the asset. - The exposure factor (EF) is the financial loss that results from the realization of a risk, expressed as a percentage. - The Single Loss Expectancy (SLE) is calculated by multiplying the asset value with the exposure factor, representing the financial loss for each occurrence of the risk. - The Annualized Rate of Occurrence (ARO) describes the probability of the risk and is usually expressed as the number of times per year. - Finally, the Annualized Loss Expectancy (ALE) is the Single Loss Expectancy multiplied by the Annualized Rate of Occurrence.

Effective risk management in companies is crucial. The article states that the third step involves applying qualitative and quantitative methods to assess risks. Qualitative methods like ranking by likelihood and impact offer simplicity and speed but can be subjective. On the other hand, quantitative methods provide precision and objectivity through numerical data but may require more time and effort. Depending on data availability and complexity, employing a combination of both is often the best approach. This balanced strategy ensures a comprehensive understanding of risks, aiding in informed decision-making.

When the impact of risks are quantified in a financial manner, organizations can make better decisions how to manage these risks. Accept, Avoid, Mitigate or Transfer

You will have a combination of both quantitive and qualitative, depending upon the nature of the risk, vis a vis the business model

Regular monitoring of external security events is also important for accurate evaluation of current risk levels. External incidents offer insights into emerging threats and vulnerabilities, which may also pertain to one's own environment. By analysing these events, organisations can recalibrate their risk ratings, ensuring that both the impact and likelihood levels of potential threats are current. Without this continuous adjustment, entities might underestimate a threat's severity or overlook it entirely. Conversely, they might over-allocate resources to outdated risks. Regular reflection based on external events ensures a dynamic, informed, and proportionate response, keeping security postures both relevant and robust.

When we talk about risk, we talk about probabilities and uncertainties. An insurance company, for example, lives on chance and has calculations to define the assumptions, margin of error and delays. The most essential thing in all of this is always to make it clear which method was used, remembering that we have many. In addition to those mentioned in the article, we have Event Simulation, Regression Analysis, Hazard Analysis of HACCP, Markov Chain Analysis, etc.

I can see the benefits of detailed calculation in terms of detailed financial risk limits management etc, but I am not sure it has a place at the executive risk management level (unless its a roll up of trading positions and value at risk). Unfortunately, if detailed calculations are included, there is an erroneous belief that this represents a higher level of certainty / knowledge and this may create an overconfidence around the management of the risk…..think 2008, excel spreadsheets and financial risk management. There is a danger that people may get blinded by the science and ignore the risk?

Implementing risk treatment options requires a careful, well-planned, and flexible approach. It entails making educated decisions to safeguard your organization while keeping the broader objectives and values of your business in consideration.

Managing risks can be as much work as managing any complex IT project and sometimes even more, as threats can be escalated to different areas of business, systems, people, physical systems, etc. After identifying the risk, we have four options: Avoidance, Transfer, Mitigation (Risk Reduction) or Acceptance! But the most important thing is that we involve the right people, as many risks do not fall under security or IT. Sometimes, we identify them, but another area can be the leader in managing, updating the risk and reporting! In summary, the fifth step in risk management involves taking concrete actions to address identified risks.

Adding risk ownership, ensuring monitoring and follow up as well as reporting on effectiveness are some of the key final steps that make the difference of day and light. It’s the difference between whether your risk management is just a formal paperwork or does it provide an accurate (to the extent possible) picture and an effective way to manage your risks. Ultimately, cyber risk is a business risk.

Based on risk treatment option taken, continuous monitoring is essential especially where the risk is accepted or reduced to ensure the risks remains with the organisation’s risk appetite and mitigations applied remain effective. Where risks are transferred or shared, for instance acquiring a cyber insurance; organisations need to align with their insurance of providers on what is in and out of scope before hand to avoid uncomfortable conversations and endless blame games in the near future.

You can't implement risk treatment options without assigning risk owners. In addition, accepting a risk is not a treatment option. When you accept the risk, you have decided that the risk is already at an acceptable level and treatment is not necessary. When a risk is accepted, it is critical to obtain the acceptance in writing from the risk owner. When risk owners have to document their acceptance of the risk, they are less likely to blindly accept risk, since the risk is tied back to them.

The lessons learned are fundamental for constant improvement in projects, whether security or not. When we talk about risk, it is even more critical, as threats can cause a reputational impact on a company, which is one of the biggest concerns. Share the lessons learned with those involved in the project, not just with the interested area. Everyone can share their share of lessons learned in a large project. Don't forget to keep a risk matrix continually updated, accessible and publicized!

Develop hypothetical scenarios to anticipate various outcomes. This can help you prepare for a range of possibilities, including worst-case scenarios.

Many people overthink risk. Remember, we all manage risk everyday in our lives and we all have different risk tolerances. On a daily basis, we chose to accept. avoid, transfer or mitigate risk. Managing cybersecurity risk is no different. If you are just starting a formal risk management program at your company, keep it simple at first. Let it mature naturally, but don't let perfect be the enemy of good when you are starting a cybersecurity risk management program.

Cyber risk is a business risk just like any other risk in the organization. It has its nuances like a unique threat landscape affecting the risk likelihood and thereby overall risk. For example your risk impact would change considering a nation state in the picture versus a script kiddies giving different motivations and resources - which affects the likelihood. However, the process should be standardized. That’s the key to ensuring you can integrate cyber risk management as a part of the enterprise risk management.

We often generalize cyber risk management as an exercise in improving our mean times for detection, response, resolution, and insert any other appropriate SLA driven process. These are important metrics to be sure, but as others have stated cyber risk is business risk, which begins with first adopting a clear methodology to having the right visiblity on the totality of the risk environment. Not just what the outputs from the security stack are providing.

Where uncertainty is not easily quantifiable or measurable, one practical rule that always proves its value, is to identify the worst case scenario. In doing this, you are seeking to codify the most disastrous of outcomes and evaluate (a) your ability to respond and (b) the extend and type of the damage. In this way, you are able to evaluate in a structured and modelled manner, if the current response capability is reasonable and adequate, and also whether additional measures are necessary now to prevent and / or detect the sources of the risk. Try it and let me know of your experiences!

We must remember that understanding risks is a function of everyone in the organization and not just the security team; however, we have to convey this sensitivity with a lot of genuinely frank conversation and trust, involving stakeholders and the responsible business areas.