Risk Management

Risk mitigation involves reducing the severity of the loss or the likelihood of the loss from occurring. There are many technical controls that can be used to mitigate risk including authentication systems, file permissions and firewalls. Organization and security professionals must understand that risk mitigation can have both positive and negative impact on the organization. Good risk mitigation finds a balance between negative impact of countermeasures and controls and the benefit of risk reduction. A shorter-term strategy is to accept the risk, in the sense of accepting the necessity for creating contingency plans for that risk.

Modern software development methodologies reduce risk by developing and delivering software incrementally and providing regular updates and patches to address vulnerabilities and misconfigurations.

Outsourcing services can be an example of risk reduction. Hiring specialists to perform critical tasks to reduce risk can be a good decision and yield greater results with less long term investment. The ISO framework identifies several ways to manage risk:

1. Accept – periodically re-assess risks that are accepted in ongoing processes as a normal feature of business operations and modify mitigation measures.


2. Reduce – design a new business process with adequate built-in risk control and containment measures from the start.


3. Transfer – transfer risks to an external agency (a service level agreement or insurance company).


4. Avoid – avoid risks altogether would include measures such as physically disconnecting from the Internet.

Figure 12 – Ways to deal with risk

These strategies are not mutually exclusive. A good risk mitigation plan can include two or more strategies.