Cybersecurity Risk Management

CHAPTER 1 Cybersecurity Risk Planning and Management

Overview of Chapter and Objective

This chapter is the most foundational section of the book because it discusses how to establish knowledge of the systems in place and how to inform management of those systems’ risk profiles. It also discusses how to develop plans for dealing with the highest priority risks. The goal is to help the reader develop an understanding necessary to manage cybersecurity risk to systems, assets, data, and capabilities.

Johnson Transportation is one of the world’s largest shipping companies. Joanna, the director of network management inside the company’s IT department, is walking toward the office kitchen to get a cup of afternoon coffee when she passes a colleague’s office.

Out of the corner of her eye, she sees that the screen on his desk suddenly goes dark.

As she walks past another colleague’s desk, another screen goes dark. She keeps walking and sees that screens are blacking out as far as she can see. She wonders if there has been a power failure in the server room, which has twice shut down systems suddenly. She heads back to her desk.

Her phone is ringing, and a junior IT engineer is sitting in her office. She has a growing sense of dread that something is really, fundamentally wrong. Tom, the company’s CIO, calls her to ask if she has any information on the computer blackouts. Joanna tells him she has no idea what happened or where the problem originated.

She checks with John, the head ...