EDUCATION, RISK, ITRMS

⚖️ Risk analysis - IT Risk Management System (ITRMS)

Seven topics on risk analysis - how risks arise, how to model threats (DFD + STRIDE), how to assess and process risks according to international practice (ISO 31000, ISO/IEC 27005, NIST SP 800-30 and RMF, FAIR). Figures will apply to fiction, designed for training.

Basic concept of risk

Risk anatomy - from danger to risk

Risk anatomy Threats use vulnerability that affects the asset; risk is the product of probability and effect; controls reduce the initial risk to the remainder. Risk anatomy Risk = function (danger, vulnerability, asset value) → Probability × impact Threatened Source attacker, error, stichia Irritability weak spot, lack of control Assets data, system, service Risk scenario "which may occur and how it works" RISK = Probability × Impact (Likelihood × Impact) the more valuable the asset, the more impact Initial risk inherent - no controls Residual risk residual - after controls safety controls ↓ ISO 31073:2022, ISO/IEC 27005:2022 (No 3); NIST SP 800-30 Rev.1

In practice

Helps to describe risk as a scenario, not just as a "weak spot." Risk exists only if there is a source of threat, vulnerability AND a valuable asset.

Reference

ISO 31073:2022 (dictionary substituted by ISO Guide 73:2009), ISO/IEC 27005:2022, NIST SP 800-30 Rev.1.

Safety Note

The residual risk is assessed, not the initial risk: decisions are made on what remains after controls. The risk appetite determines how much remaining risk is acceptable.

Risk Management Life Cycle

ITMS process - ISO/IEC 27005:2022 & ISO 31000:2018

Risk management process Five steps of the process - context, identification, analysis, evaluation, processing - with continuous communication and monitoring and feedback loop. IT Risk Management Process (ITRMS) Cycle recurs - regularly and after significant changes ↔ Communication and consultation (in the whole process) Context volume, criteria risk appetite accounting for assets Identification threat, insult. scenarios risk register Analysis probability × effect quality / quantum. risk level 4. Evaluation compared to the benchmark priority processing? 5. Treatment 4 T, controls residual risk reception, SoA √ review and repeat (PDCA) Monitoring and review (through process) ISO/IEC 27005:2022 (process), ISO 31000:2018 (6. nod.), NIST SP 800-39 (programma), SP 800-37 RMF Article 21 (2a) of the NIS2 requires "risk analysis and information system security policy" - this is its process

In practice

One process, repeated for everything, fits both ISO 27001 ISMS and NIS2. Steps are the same, only volume and criteria change.

Reference

ISO/IEC 27005:2022, ISO 31000:2018, NIST SP 800-39, NIST SP 800-37 Rev. 2 (RMF).

Safety Note

Risk analysis is not a one-off document. It is reviewed regularly and after each major change (new system, incident, new threat) - outdated analysis is misleading.

Step-by-step threat identification

DFD, confidence limits and STRIDE

Data flow threat model Four steps: classify protected data, on the map where they are stored and through which channels travel (data flow diagram with confidence limit), record threats by STRIDE for each element and assess risks. Below STRIDE by elements table. DFD + STRIDE What protects, where stored, through which channels travel, what is the risk 1 Classification of data to be protected 2 On the map DFD where stored, channels 3 STRATEGY which may go wrong 4 Assessing risk probability × effect › › › Trust Boundary User outside untrusted area ① HTTPS / TLS 1.3 path data, in transit Web application process ② TLS, ACL Database Confidential stored data, at rest STRIDE by Element - which threat classes refer to each element of DFD DFD Element S T R I D E External side user / side 3 – – – – Process application, service Data flow channel – – – Data repository DB, files, at rest – – S - Spofing T - Tampereing R - Repudiation I - Information disclosure (depletion) D - Denial of service (availability) E - Elevation of privilege (privilegies)

Data Flow Chart (DFD): Rectangle = External side, Circle = Process, Open Rectangle = Data Storage, Arrow = Data Flows; Disrupted line = Reliability boundary where data crosses zones and focuses threats.

Here is a brief summary. A step-by-step method, STRIDE by elements and an example with an online store is in the guide Danger Modelling.

In practice

Threatening modeling systematically answers four questions (Threat Modeling Manifesto): which we create, that can go wrong, what we do and whether we did well enough. DFD shows where the data is stored and through which channels travel; STRIDE by elements helps not forget any threat class.

Reference

Microsoft STRIDE, Thread Modeling Manifesto 2020, OWASP Thread Modeling, NIST SP 800-154, PASTA, LINDDUN, ISO/IEC 27005:2022, MITRE ATT&CK.

Safety Note

Models early and repeatedly - at every architectural change. Start with the most valuable assets ("crown jets") and the limits of reliability where data cross zones - there is the greatest risk. Each entry of the identified threat into the risk register shall be assessed (possibility × impact) and link to control (4 T).

Qualitative assessment

Risk matrix - Probability × effect (5×5)

Risk matrix Five times five heat map: the probability of a vertical axis, impact on the horizontal; the color increases from low (green) to critical (red). Risk matrix 5×5 Risk level = Probability × effect (cell number) EMPLOYMENT → 5 Very high 5 10 15 20 25 4 High 4 8 12 16 20 3 Medium 3 6 9 12 15 2 Low 2 4 6 8 10 1 Very low 1 2 3 4 5 1 Not applicable. 2 Small 3 Medium 4 Large 5 Catastr. IMPACT → Risk level Low (1/174) Medium (52) High (10±14) Critical (15 TEU25) Processing priority Critical → immediately High → planned Medium → Monitors Low → Accepts ISO/IEC 27005:2022 (Quality scale), NIST SP 800-30 Rev. 1 (Quality, impact and risk scales)

Scale (3×3, 5×5) and thresholds must be aligned to the organisation's risk appetite - matrix is a communication tool, not an accurate measurement.

In practice

Rapidly classify many risks according to severity and show where to start. Simple and understandable for management and people without technical knowledge.

Reference

ISO/IEC 27005:2022, NIST SP 800-30 Rev.1 (appendix G/H/I), ISO/IEC 31010 (technical).

Safety Note

The matrix is subjective: the same "high' risks may not be comparable. For big decisions (investments, cyber insurance), add quantitative analysis.

Quantitative assessment

Risk of money - ALE, ROSI and FAIR

Quantitative risk analysis The ALE calculates the chain from asset value to annual loss, ROSI formula and FAIR model breakdown. Quantitative analysis - Cash risk Figures are invented - for methods of illustration ALE calculation chain (NIST/factor method) AV, Asset value 50 000 € (database + idle) × EF (impact factor) = 20% SLE, one event is lost. = AV × EF = 10 000 € × ARO (annual frequency) = 0,5 ALE, annual loss = SLE × ARO = 5 000 € / year ROSI, return on security = (ALE before - ALE after - cost) costs FAIR model (factor breakdown) Risk (Annual Loss) = LEF × LM LEF event frequency (dangers × insults) LM loss amount (primary + consequences) Quantitative vs qualitative - Qualitative: fast, subjective (matrix) - Quantitative: cash, requires data - FAIR: international quantum standard Often used both - matrix for triage, ALE/FAIR for large decisions NIST SP 800-30 Rev. 1, FAIR (The Open Group O-RT / O-RA), ISO/IEC 27005:2022

In practice

ALE shows the expected annual loss in cash - it justifies budget controls and compares whether control costs less than the risk it eliminates (ROSI).

Reference

NIST SP 800-30 Rev. 1 (SLE/ARO/ALE), FAIR / The Open Group O-RT, O-RA, ISO/IEC 27005:2022.

Safety Note

Quantitative numbers look exactly, but it's only as good as the data behind them. Rare events with a huge impact (right risk) are not assessed by ALE - add to the scenarios.

Risk Treatment Options

Four options (4 T) and acceptance of residual risk

Risk treatment Four treatment options - mitigate, transfer, accept, avoid - and initial risk reduction to the residual risk accepted by the risk holder. Risk treatment - 4 T ISO/IEC 27005: modify, share, save, avoid Change put in place controls which: decreased probability or impact ISO: "modify' e.g.: MFA, encryption Transfer transfer risk half partially (does not disappear altogether) ISO: "share' e.g. insurance, contract Tolerate voluntarily accepted of appetite auc ISO: "retain' e.g.: low risk Avoid ceases operation; or renounces the asset, causing risk ISO: "avoid' e.g.: remove function Initial risk therent Residual risk residual → accepts risk owner treatment (4 T) ↓ Risk Register: ID, scenario, owner, probability, impact, level, processing, controls, residual, maturity. The selection of controls shall be documented in the applicability declaration (SoA, ISO/IEC 27001 6.1.3) - why each Annex A control is included/no. The remaining risk is formally accepted by the risk agent (not IT) - it is a business or technical responsibility.

In practice

For each above appetite risk one or more of the 4 T options shall be selected and entered in a risk register with the responsible and due date.

Reference

ISO/IEC 27005:2022 (processing options), ISO/IEC 27001:2022 6.1.3 + Annex A (SoA), NIST SP 800-37 Rev. 2 (Authorize).

Safety Note

"Train" does not mean getting rid of: insurance covers part of the loss, but reputation and responsibility remain. Risk can only be accepted knowingly and in writing.

Standard and Compliance Card

Risk management standards and their links to NIS2 and ISO

Landscape of risk management standards Eight standard groups: general framework, infosec risk, NISTs, quantitative, strategic, risk techniques, sectoral regulation and EU/LV relevance. Landscape of risk management standards ISO 27005 is ISO 31000 infosec-specific version - often overlapping General framework ISO 31000:2018 principles, process ISO 31073:2022 risk dictionary COSO ERM transfer of business risk. Information security ISO/IEC 27005:2022 infosec risk transfer. ISO/IEC 27001 6.1 risk requirements for ISMS ISO/IEC 27002 control catalogue NIST SP 800-30 Rev.1 risk assessment SP 800-37 (RMF) 7 step frame SP 800-39 risk programme Quantitative FAIR (Open Group) O-RT / O-RA OCTAVE Allegro CERT/SEI method ALE / ROSI cash risk Strategic NIST CSF 2.0 Governor, Identify ISACA Risk IT COBIT Risk Domain risk appetite board level Risk techniques ISO/IEC 31010 31+ weigh FMEA, bowtie cause/effect analysis scenarios time / "what-if" Sectoral regulation DORA financial ICT risk TIBER-EU hazard-led tests GDPR 35. DCIA - Data Risk EU / LV eligibility NIS2 21.2.a) risk analysis (claim) National and EU acts EN implementation Reg. 2024/2690 EU technical specification. Choose method by purpose: ISO 27005 ISMS-am, NIST RMF system authorisation, FAIR money decisions - the process remains the same.

In practice

Helps to choose the method according to the purpose of certification (ISO 27005), authorisation system (NIST RMF) or money decisions (FAIR) - not starting from scratch.

Reference

ISO 31000, ISO/IEC 27005, ISO/IEC 31010, NIST SP 800-30/37/39, NIST CSF 2.0, FAIR, NIS2, GDPR.

Safety Note

Article 21 (2a) of the NIS2 requires a direct risk analysis. This is further determined by national legislation and EU Implementing Regulation 2024/2690 - linking the risk register to them.

Abbreviations

All abbreviations used in the guide (original and meaning).

ITRMS
IT Risk Management System - IT risk management system.
ISO/IEC
International Organization for Standardization / International Electrotechnical Commission - International Standards Organizations.
NIST SP
NIST Special Publication - publication series of the U.S. National Standards Institute.
RMF
Risk Management Framework - NIST Risk Management Framework (SP 800-37).
CSF
Cybersecurity Framework - NIST cybersecurity framework (2.0).
ISMS
Information Security Management System - Information Security Management System (ISO/IEC 27001).
SoA
Statement of Application - Application declaration (ISO/IEC 27001 6.1.3).
PDCA
Plan-Do-Check-Act - plans to carry out the testing (continuous cycle of improvement).
AV
Asset Value - asset value.
EF
Exposure Factor - impact factor (the lost part of the asset).
SLE
Single Loss Expectancy - Loss of one event (AV × EF).
ARO
Annualized Rate of Occurrence - the annual frequency of the event.
ALE
Annualized Loss Expectancy - Annual Loss (SLE × ARO).
ROSI
Return on Security Investment - Return on security investments.
FAIR
Factor Analysis of Information Risk - quantitative risk model.
LEF
Loss Event Frequency (FAIR).
LM
Loss Magnitude - amount of loss (FAIR).
O-RT / O-RA
Open Group Risk Toxonomy / Risk Analysis - FAIR Standards.
4 T
Treat, Transfer, Tolerate, Terminate - minimize, transfer, accept, avoid.
NIS2
Network and Information Security Directive 2.
DORA
Digital Operational Resilience Act - EU Digital Resilience Regulation (financial sector).
TIBER-EU
Three Intelligence-based Ethical Red Teaming - threat intelligence based tests.
GDPR
General Data Protection Regulation - General Data Protection Regulation.
DPIA
Data Protection Impact Assessment (GDPR 35).
COSO ERM
Committee of Sponsoring Organizations · Enterprise Risk Management.
COBIT
Control Objectives for Information and Related Technologies (ISACA).
OCTAVE
Operationally Critical Threat, Asset and Vulnerability Evaluation (CERT/SEI).
FMEA
File Mode and Effects Analysis - analysis of types and consequences of errors.
IKT
Information and Communication Technologies (ICT).
STRIDE
Spooofing, Tampereing, Repudiation, Information breakdown, Denial of service, Elevation of privilege - Microsoft threat classification.
DFD
Data Flow Diagram - data flow diagram (external sides, processes, storages, flows, reliability limits).
PASTA
Process for Attack Simulation and Three Analysis - 7 stage risk-oriented threat modelling methodology.
LINDDUN
Privacy threat modelling framework (linked to GDPR/DPIA).
ATT&CK
Adversarial Tactics, Techniques & Common Knowledge - MITRE attacker tactics and technique base.