Adopting an event based approach in risk assessment involves a meticulous examination of the diverse
interactions that form an organization's operational ecosystem.
This comprehensive scrutiny is essential because it allows an organisation to map out the various channels
through which potential threats could access and compromise valuable business assets and their associated
desired service outcomes.
RDS.
This ecosystem is not insular.
It is a web of relationships that includes both external and internal parties, each with their own
connections and potential vulnerabilities.
External parties include clients whose engagement with the organization's assets may present risks,
partners and co contractors whose collaborative efforts are essential, yet may also serve as avenues
for threats and service providers like subcontractors and suppliers integral to operations but also
possible sources of risk.
Within the organization itself.
Internal parties such as technical and business service providers interact closely with the company's
data and systems.
These providers, along with subsidiaries, particularly those in different countries, introduce a
spectrum of risks stemming from varied regulatory standards and security practices.
The objective of identifying these parties is to achieve a clear perspective on the entire ecosystem
to highlight the most vulnerable spots.
The aim is to ensure no entity or interaction is left unexamined, since each may present a unique risk
to the organization.
Preliminary risk studies focusing on ecosystem awareness are crucial in this context.
Tools like figure eight three in the ISO standard serve as visual guides, aiding in the identification
and understanding of the network of interested parties.
By establishing this comprehensive awareness, an organization can pinpoint where it is most susceptible
to attacks.
It's a proactive measure identifying the weakest links before they are exploited.
This deep dive into the ecosystem not only illuminates the potential risk pathways, but also underpins
the subsequent stages of detailed risk analysis and the formulation of robust risk treatment strategies.
Ultimately, this approach arms the organization with the knowledge to fortify itself against the multifaceted
nature of information security threats.
In risk management.
Strategic scenarios serve as high level narratives that detail how a risk source might achieve its desired
service outcomes.
These.
These scenarios are crafted from a realistic viewpoint, taking into account the known risk sources
and events.
To construct these scenarios, risk managers embark on a process of deduction, starting with the risk
sources and questioning their potential actions and targets.
From the perspective of a risk source, one must consider the organization's business assets that are
likely targets to reach the DZ.
The scenario deepens by pondering whether the risk source might exploit critical interested parties
within the organization's ecosystem, especially those with privileged access to business assets.
The identification of these exposed elements lays the groundwork for drafting the strategic scenario.
This is achieved by outlining the sequence of events that a risk source would generate to reach its
objective, where infringement upon business assets represents the ultimate event, and those involving
the ecosystem are intermediate events.
Thus, the strategic scenario directly maps out the consequence assessment derived from the involved
events.
Visualization tools such as attack graphs or overlays on the ecosystem view of the information system
can effectively illustrate the potential attack paths.
These visual representations not only clarify the sequence of events, but also highlight the touch
points that could be exploited along the way.
However, crafting strategic scenarios isn't solely about plotting potential events.
It also involves a critical assessment of their likelihood.
This is where the asset based approach complements the process, by providing a method to gauge the
probability of these operational scenarios.
By integrating both the strategic view of potential events and the asset based perspective on their
likelihood.
Risk managers can develop a well-rounded, realistic assessment of potential security breaches and their
impact on the organization.
Let's give an example of an event based risk assessment for Health Secure.
In a comprehensive risk assessment, identifying the origin of each risk is crucial.
This is captured in the risk source column, which pinpoints whether the threat is posed by external
entities like hackers, natural phenomena, or even internal staff members who may inadvertently or
maliciously cause harm.
Equally important is recognizing the stakeholders involved.
The interested party column does just that.
It lists individuals or groups within the organization who have something at risk.
Health care providers dependent on EHR software, for instance, or IT personnel tasked with data center
maintenance.
The Strategic Scenario column then takes a step back, offering a broader view of how these risks could
potentially play out across the organization.
This narrative not only sets the stage for understanding the risks, but also prepares the organization
for potential outcomes.
Following this, the event scenario drills down into the specifics detailing the actual threat event
that could occur, such as a data breach or system outage.
The potential ramifications of these events are not to be overlooked, and the potential impact spells
out the dire consequences that could arise from each threat event.
Complementing this is the event likelihood column, which gauges the chances of the risk materializing,
thus informing how the organization should prioritize its defensive posture.
Finally, the level of risk encapsulates the assessment, blending the impact and the likelihood of
occurrence to provide a clear indication of how urgently each risk needs to be addressed.
This assessment is integral in shaping the organisation's risk response strategies, ensuring that the
most critical risks are managed with the utmost urgency, while lower level risks are monitored appropriately.
In a structured assessment of potential organisational risks, we consider a series of scenarios that
Health Secure Inc might face.
Firstly, there's the risk of software gaps in the EHR system being exploited.
This scenario, labelled number one, involves external hackers targeting the software used by health
care providers.
The event scenario is a data breach through software exploitation, which could have catastrophic consequences
for electronic health records.
Given the sophistication and motivation of these hackers, the event's likelihood is almost certain,
placing the level of risk as very high.
Scenario number two envisions the infiltration of cloud services due to weak encryption.
Here, cyber criminals pose the threat, with cloud service users standing to be affected should unauthorized
access occur, the level of disruption could be high.
The risk of this happening is very likely, indicating a high level of risk overall.
In the third scenario, malware distributors could spread malicious software through employee devices.
Internal staff who use these laptops are the interested parties at risk of moderate data loss.
The likelihood of such an infection is considered likely, making the risk level medium.
The fourth scenario contemplates a data center outage caused by a natural disaster.
The risk source here is natural events that could cause serious operational delays for IT operations.
Although the potential impact is serious, the likelihood of a natural disaster causing such an outage
is rather unlikely, leading to a low level of risk.
Lastly, scenario number five details the risk of security breaches resulting from insider threats.
A disgruntled employee might bypass security protocols, which could lead to a significant access breach
for the security management team.
However, the likelihood of this happening is unlikely, which means the risk level is very low.
Each scenario is assigned a number for reference, ranging from 1 to 5, and is evaluated to understand
the full spectrum of risks from those that are very high to those that are very low.
The assessment aids Health Secure, Inc. in prioritizing risk management efforts and ensuring the most
critical areas receive immediate attention.