Title: Risk Control Strategies
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Risk Control Strategies
When members of management have determined that risks from information security threats are creating a competitive disadvantage, they empower the information technology and information security communities to control the risks.

Once the project team for information security development has created the ranked vulnerability risk worksheet, the team must choose one of four basic strategies to control the risks that result from these vulnerabilities.

The four strategies are:
- Apply safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability (avoidance).
- Transfer the risk to other areas or to outside entities (transference).
- Reduce the impact should the vulnerability be exploited (mitigation).
- Understand the consequences and accept the risk without control or mitigation (acceptance).

Defend
1. The defend strategy is the preferred approach by preventing exploitation of the vulnerability.
2. The three common methods of defense are the application of policy, education and training and the application of technology.
3. A defense strategy is a security control that deflects attacks and minimizes the probability that an attack will succeed.

Transfer
Transference is the control approach that attempts to shift the risk to other assets, other processes, or other organizations.

One characteristic of excellent organizations is that they focus energy and resources on what they do best, while relying on consultants or contractors for other types of expertise. In other words, they “stick to their knitting...”

If an organization does not already have quality security management and administration experience, it should hire individuals or firms that provide such expertise.

This allows the organization to transfer the risk associated with the management of these complex systems to another organization with established experience in dealing with those risks.

Outsourcing is not without risks.

It is up to the owner of the information asset, IT management and the information security team to ensure that the disaster recovery requirements of the outsourcing contract are sufficient and have been met before they are needed for recovery efforts.

Mitigate
Mitigation is the control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.  This approach includes three types of plans: the incident response plan (IRP), the disaster recovery plan (DRP) and the business continuity plan (BCP).
Mitigation begins with early detection of an attack in progress and relies on the ability of the organization to respond quickly, efficiently and effectively.
Incident Response Plan
1. The actions that an organization should take while the incident is in progress are defined in a document called the incident response plan or IRP.
2. The IRP provides answers to questions that victims might pose in the midst of a disaster.  It answers questions like:
  - What do I do NOW?
  - What should the administrators do first?
  - Whom should they contact?
  - What should they document?

Disaster Recovery Plan
The most common mitigation procedure is the disaster recovery plan.

1. The DRP includes the entire spectrum of activities used to recover from an incident. The DRP can include strategies to limit losses before and during the disaster.
2. A DRP usually includes all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the disaster has ended.
3. DRP and IRP planning overlap to a degree. In many ways, the DRP is the subsection of the IRP that covers disastrous events. While some DRP and IRP decisions and actions are the same, their urgency and results can differ dramatically.
4. The DRP focuses more on preparations completed before and actions taken after the incident, while the IRP focuses on intelligence gathering, information analysis, coordinated decision-making, and urgent, concrete actions.

Business Continuity Plan
1. The third type of planning document within the mitigation strategy is the business continuity plan or BCP.
2. The BCP is the most strategic and long term of the three plans.  It encompasses the continuation of business activities if a catastrophic event occurs, such as the loss of an entire database, building or operations center.
3. The BCP includes planning the steps necessary to ensure the continuation of the organization when the scope or scale of a disaster exceeds the ability of the DRP to restore operations.

Accept
1. Acceptance of risk is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation. This may or may not be a conscious business decision.
2. The only acceptance strategy that is recognized as valid occurs when the organization has:
  - Determined the level of risk
  - Assessed the probability of attack
  - Estimated the potential damage that could occur from these attacks
  - Performed a thorough cost-benefit analysis
  - Evaluated controls using each appropriate type of feasibility
  - Decided that the particular function, service, information, or asset did not justify the cost of protection
3. This control or rather lack of control, is based on the assumption that it may be a prudent business decision to examine the alternatives and then possibly determine that the cost of protecting an asset does not justify the security expenditure.
4. If every vulnerability identified in the organization is handled by means of acceptance, it may reflect an inability to conduct proactive security activities and an apathetic approach to security in general.
5. Acceptance as a strategy is often mistakenly chosen based on the school of fish justification—that sharks will not come after a small fish in a school of other small fish.  But this reasoning can be very risky.

Terminate
Remind students that the final risk control strategy is for the business to terminate the activities that introduce the risk.