- [Instructor] Cybersecurity teams have
a wide variety of risk identification, assessment,
and management tools at their disposal.
You've already learned about many of them
in this course.
Risk visibility and reporting techniques ensure
that the results of these risk management processes are
clearly documented and tracked over time.
The core tool that most organizations use
for maintaining ongoing visibility into risks is
the risk register.
The risk register is a centralized document
that attracts information about the nature
and status of each risk facing the organization.
Risk registers may be used on an organization wide basis
or they may be used to track the risks associated
with a single project or subject domain.
In some cases risk registers may be
referred to as risk logs.
Risk registers vary from organization to organization,
but they typically contain the following
types of information.
A description of each risk.
A categorization scheme used to group the risks
into similar segments.
The results of a risk assessment including
the probability and impact of each risk.
And a risk rating calculated by multiplying
the probability and impact scores.
The risk register may also include actions taken
to manage the risk including specific
risk mitigation steps that are either completed
or still in progress.
Here's an example of a risk register
that I helped develop with a group called Educos.
This is a tool used to help higher education
IT organizations manage high-level technology risks
facing their institutions.
For example, the first risk here is stated
as IT governance and priorities are not aligned
with institutional priorities.
It then goes on to explain the cause
and potential impact of that risk.
If we move further down to risk number four,
it talks about what might happen if the institution
lacks a succession plan for key IT leaders.
This risk register also includes a place
for organizations to input the likelihood, impact,
and time horizon that they think
this risk might face their institution.
For example, if I think about my own organization
and assess that I really don't have
any secession plan in place, I might rate
the likelihood of this risk as high,
give it a value of three.
I then might go on to say the impact
of this is maybe a two.
It might have a medium impact on my organization.
If I lose a key leader and don't have
a succession plan in place, in the time horizon
I might think that my current leadership team is
pretty stable so I'm going to rate this a one.
I color coded these risks green, yellow, or red depending
upon whether they were low, medium, or high,
and then it computed a risk score
as the product of those three values.
When developing a risk register,
the organization has many sources
of information available to help populate
the register with risks.
These include the results of formal
risk assessments conducted by the organization,
audit findings identified by internal
or external auditors, risks identified by members
of the IT team, and threat intelligence information
contributed by third parties.
Threat intelligence is playing an increasingly
important role in many organizations' efforts
to maintain visibility into the risks that they face.
By sharing threat intelligence,
organizations may pool their knowledge
to help combat external threats
either by purchasing a threat intelligence
service from a vendor or by joining
a threat intelligence sharing consortium.
Threat intelligence sharing efforts provide
an anonymized way for organizations
to communicate with each other about the nature
and characteristics of attacks that they experience.
Threat intelligence information may be used
to monitor risk trends in a general way
or this information may be used operationally
to create for example a blacklist of IP addresses
known to be the source of attacks.
Today's cybersecurity environment is complex
with many different risks facing organizations.
The use of risk registers, threat intelligence,
and similar solutions help organizations
maintain visibility into these risks
as the seek to manage them.