97 Things Every Information Security Professional Should Know

Chapter 91. Risk Management in Information Security

Trevor Bryant

Risk management can seem daunting and less exciting than other positions. However, it is a comprehensive program that recognizes, understands, and describes the potential risks that can impact the security and privacy of the organization’s delivery of services. The program is about managing the security and privacy risks at all levels and not just the information systems. It is a complex undertaking that requires the entire organization, from leaders, planners, or managers to those developing, implementing, or analyzing. Individuals that manage risk are those that know how the business functions; the services it provides to customers, partners, and employees; how it makes money; and more. Individuals in risk management have an eagle-eye view of how the business works and comes together.

Risk management activities impact every aspect of the organization and comprise framing, assessing, responding, reducing, and monitoring. Framing risk is based on the assumptions, constraints, tolerance, properties, and trade-offs. The assumptions are how risk is assessed, responded to, and monitored. Constraints impede the ability to assess, respond, and monitor. Tolerance is the degree of uncertainty to be accepted. Examples of priorities and trade-offs are varying importance of business functions, timeframes to address risk, or ...