Risk Management Part 2
Today I went further into security controls and risk assessments, then moved into data privacy, the information lifecycle, and how storage media should be handled when it is no longer being used.
Security Controls
A security control is a safeguard put in place to reduce risk. There is no single control that works for every company or every system, so the right choice depends on the platform, vendor, users, and the risk being addressed.
Control categories
Categories describe where a control mainly comes from or how it is carried out.
Managerial
Controls that guide security through planning, policies, assessments, and oversight. A risk assessment or security policy would fit here.
Operational
Controls mostly carried out by people and everyday processes, such as awareness training, incident response, or reviewing backups.
Technical
Controls enforced by technology. Firewalls, MFA, encryption, endpoint protection, and access control lists are all technical controls.
Physical
Controls that protect people, equipment, and facilities. Locks, fences, cameras, lighting, and security guards are common examples.
Functional control types
A control can also be described by what it is supposed to do. A single control can fit more than one type depending on how it is used.
| Type | Purpose | Example |
|---|---|---|
| Preventive | Stops an incident before it happens. | MFA or a locked door |
| Deterrent | Discourages someone from trying. | Warning signs or visible cameras |
| Detective | Finds activity during or after an incident. | IDS alerts or log reviews |
| Corrective | Limits damage and restores normal operations. | Restoring a clean backup |
| Compensating | Provides another safeguard when the preferred control is not possible. | Extra monitoring for a legacy system |
| Directive | Tells people what they are expected to do. | Policies and required procedures |
Control Frameworks
Frameworks give organizations a common way to choose, organize, and review controls instead of making the entire security program up from scratch.
CSA Cloud Controls Matrix
The Cloud Security Alliance's CCM is built for cloud environments. It maps cloud security controls to common standards and helps both cloud providers and customers review their security.
PCI DSS
The Payment Card Industry Data Security Standard contains security requirements for organizations that store, process, or transmit payment card data.
Risk Assessments
A risk assessment helps a company figure out which threats actually matter, how much exposure it has, and where controls should be added or improved.
- Build awareness: use internal data and threat intelligence to understand the environment.
- Identify and analyze risk: look at the assets, threats, vulnerabilities, likelihood, and impact.
- Evaluate existing controls: see what is already reducing the risk and where the gaps are.
- Choose and implement controls: treat the risk based on the organization's priorities.
- Review it again: risks and systems change, so assessments need to be repeated.
Inherent risk is the amount of risk before controls are considered. Residual risk is what remains after the controls are in place. The goal is not always zero risk; it is to bring the remaining risk down to a level the organization can accept.
Risks can come from environmental events such as floods or power loss, person-made events such as attacks or mistakes, internal sources such as employees and company systems, or external sources such as vendors and threat actors.
Risk Treatment
Once a risk is understood, the organization has to decide what to do with it.
Mitigation
Add controls that lower the likelihood or impact. This is also called risk reduction.
Transfer
Share some of the financial or operational impact with another party, such as through insurance or a contract.
Avoidance
Stop the activity that creates the risk, or choose a different approach that removes it.
Acceptance
Understand the risk and choose to live with it because the cost of another treatment is not worth it.
Risk appetite is the overall amount and type of risk an organization is willing to pursue or keep. It helps guide which risks can be accepted and which need more attention.
Quantitative Risk
Quantitative analysis uses dollar amounts and expected frequency to estimate the cost of a risk. The main formulas build on each other:
| Term | Meaning | Formula or example |
|---|---|---|
| AV | Asset value | The full value of the asset |
| EF | Exposure factor | The percentage of value lost in one event |
| SLE | Single loss expectancy | AV × EF |
| ARO | Annualized rate of occurrence | Expected number of events each year |
| ALE | Annualized loss expectancy | SLE × ARO |
If an asset is worth $24,000 and one incident is expected to cause a 12.5% loss, the SLE is $3,000. If that incident is expected four times per year, the ALE is $12,000. That yearly estimate can be compared with the cost of a security control.
Qualitative Risk
Qualitative analysis uses ratings such as low, medium, and high when an exact dollar amount is not practical. Likelihood and impact are compared to decide the overall severity.
- A risk matrix compares likelihood and impact.
- A heat map makes the higher-priority risks easier to spot visually.
- A risk register tracks the risk, its owner, likelihood, impact, treatment, controls, and current status.
The ratings can be subjective, so the organization should define what each level means and use the same scale consistently.
The Information Lifecycle
Information needs protection for its entire life, not just while someone is actively using it.
- Collect: obtain only the information that is actually needed.
- Store: protect data at rest with access controls, encryption, and backups.
- Process: control how applications and users work with the data.
- Share: protect data while it moves and make sure it only reaches approved people.
- Archive or delete: follow retention rules, then securely dispose of data when it is no longer needed.
PII and PHI
PII
Personally identifiable information can identify or be linked to a person. Names, Social Security numbers, account numbers, addresses, biometrics, and combinations of personal details can all count.
PHI
Protected health information is identifiable health information protected under HIPAA when it is handled by a covered entity or business associate. Medical records, diagnoses, and billing details are common examples.
Data sovereignty means data can be subject to the laws and rules of the country where it is stored or processed. Cloud storage makes this important because the server may be in a different country than the user or company.
Privacy Techniques
| Technique | What it does |
|---|---|
| Anonymization | Removes or changes identifiers so the data can no longer reasonably be tied back to a person. |
| Pseudonymization | Replaces identifiers with aliases, but the data can still be reconnected using separately protected information. |
| Data minimization | Collects and keeps only the information needed for a specific purpose. |
| Tokenization | Replaces sensitive data with a token while the real value is kept in a protected system. |
| Masking | Hides part or all of a value when the full information does not need to be displayed. |
Pseudonymized information still needs protection because it can be linked back to the person when the additional information is available.
Media Sanitization and Destruction
Pressing delete or doing a quick format usually removes the file reference, not every copy of the data. Before media is reused, donated, returned, or thrown away, the organization needs a sanitization method that matches the media and the sensitivity of the information.
Clear
Uses logical techniques to protect against simple recovery. Overwriting may be used where the device supports it.
Purge
Uses stronger techniques that make recovery impractical, such as a supported sanitize command or cryptographic erase.
Destroy
Physically damages the media so it cannot be used again. Examples include shredding, pulverizing, or incineration by an approved service.
Degauss
Uses a strong magnetic field on magnetic media. It can work for some hard drives and tapes, but not SSDs or flash storage.
A technique that works for a magnetic hard drive may not work for an SSD. Cryptographic erase can be fast on a properly configured self-encrypting drive, but the encryption and key handling need to have been set up correctly beforehand.
Paper, film, and tape may need shredding, pulping, burning, or another approved destruction process. No matter which method is used, the asset inventory should be updated and the disposal should be recorded.