Unit 6: Risk Management, Data Protection and Compliance - Subjective Questions

Risk is the potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability. It represents the likelihood of a negative event occurring combined with its impact.

Key components and their relationship:

• Asset: Anything of value to the organization (data, hardware, software, people, reputation).
• Threat: Any circumstance or event with the potential to cause harm (e.g., malware, insider, natural disaster).
• Vulnerability: A weakness or flaw that a threat can exploit (e.g., unpatched software, weak passwords).

The relationship can be expressed conceptually as:

• A threat without a corresponding vulnerability poses little risk.
• A vulnerability with no threat to exploit it also presents low risk.
• Risk materializes only when a threat successfully exploits a vulnerability affecting an asset, resulting in impact.

The Risk Management process is a continuous, structured approach to identifying and handling risk. Its main phases are:

1. Risk Identification

   • Catalog assets, threats, and vulnerabilities.
   • Determine what could go wrong.

2. Risk Assessment / Analysis

   • Evaluate the likelihood and impact of each risk.
   • Can be qualitative (High/Medium/Low) or quantitative (numeric values).

3. Risk Response / Treatment

   • Decide how to handle each risk using strategies: accept, avoid, transfer, mitigate.

4. Risk Monitoring and Review

   • Continuously track risks, controls, and residual risk.
   • Adjust the strategy as the environment changes.

Note: Risk management is cyclical, not a one-time activity, because the threat landscape and business environment constantly evolve.

Organizations select from four primary risk response (treatment) strategies:

• Risk Avoidance: Eliminating the activity or exposure that causes the risk.

  • Example: Discontinuing a legacy service that cannot be secured.

• Risk Mitigation (Reduction): Applying controls to reduce likelihood or impact.

  • Example: Installing a firewall and patching systems to reduce intrusion risk.

• Risk Transference (Sharing): Shifting the risk to a third party.

  • Example: Purchasing cyber-insurance or outsourcing to a cloud provider.

• Risk Acceptance (Retention): Acknowledging the risk and choosing to tolerate it, usually when the cost of mitigation exceeds the potential loss.

  • Example: Accepting the minor risk of a low-value, non-critical internal tool.

Residual risk is what remains after a response strategy is applied, and it must be formally accepted by management.

Qualitative vs. Quantitative Risk Analysis:

Quantitative Risk Formulas:

• Single Loss Expectancy (SLE): The monetary loss from a single occurrence.
  

• Annualized Rate of Occurrence (ARO): The expected number of times a threat occurs per year.

• Annualized Loss Expectancy (ALE): The expected yearly cost of a risk.
  

Example: If an asset worth $100{,}000 has an EF of 0.25, then . If the threat occurs twice a year (), then .

ALE is used to justify whether a control (whose annual cost should be less than ALE) is worthwhile.

These metrics help plan for resilience and recovery:

• RTO (Recovery Time Objective): The maximum acceptable time to restore a system or service after a disruption. Defines how fast recovery must happen.

• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time. Defines how much data can be lost (drives backup frequency).

• MTTR (Mean Time To Repair): The average time required to repair a failed component and restore it to operation.

• MTBF (Mean Time Between Failures): The average operational time between failures of a repairable system; a measure of reliability.

Importance:

• RTO and RPO directly shape backup, replication, and disaster-recovery strategies.
• MTBF and MTTR help assess hardware reliability and plan maintenance.
• Together they ensure recovery objectives align with business tolerance for downtime and data loss.

A Risk Register is a central document (or tool) used to record, track, and manage all identified risks throughout their lifecycle. It serves as the primary artifact of the risk management process.

Typical components of a Risk Register:

• Risk ID: Unique identifier for each risk.
• Risk Description: Clear statement of the risk and its cause.
• Risk Category: Grouping (operational, financial, technical, etc.).
• Likelihood & Impact: Ratings or scores for probability and consequence.
• Risk Score / Inherent Risk: Combined measure before controls.
• Risk Owner: Person accountable for managing the risk.
• Mitigation / Response Plan: Actions and chosen strategy.
• Residual Risk: Remaining risk after controls.
• Status: Open, mitigated, closed, monitored.

Importance: It provides visibility, accountability, and a basis for prioritization and reporting to management.

Vendor Management is the discipline of overseeing third-party suppliers and service providers to ensure they deliver value while managing the risks they introduce. It covers selection, onboarding, monitoring, and offboarding of vendors.

Why it is critical for security:

• Expanded Attack Surface: Vendors often have access to systems and data, becoming a potential entry point for attackers (supply chain attacks).
• Shared Responsibility: A vendor's security weakness can directly cause breaches in your organization (e.g., SolarWinds, Target).
• Compliance Obligations: Regulations hold organizations accountable for data handled by their vendors.
• Business Dependency: Service outages at a vendor can disrupt operations.

Key practices:

• Conducting due diligence before onboarding.
• Defining security requirements in contracts.
• Ongoing monitoring and periodic reassessment.
• Clear offboarding to revoke access and recover data.

These are common agreement types used in vendor relationships:

• SLA (Service Level Agreement): Defines the specific, measurable level of service expected (e.g., 99.9% uptime, response times, penalties for non-compliance). It is performance-focused.

• MOU (Memorandum of Understanding): A formal but often non-binding agreement outlining the intentions and broad terms between parties. Expresses mutual understanding without strict legal enforceability.

• BPA (Business Partnership Agreement): Governs the relationship between business partners, including profit sharing, responsibilities, and decision-making authority.

• MSA (Master Service Agreement): An overarching contract that defines the general terms governing the relationship, under which specific work orders or SOWs are issued. It reduces the need to renegotiate common terms for each engagement.

Summary: SLA = service metrics, MOU = mutual intent, BPA = partnership terms, MSA = master framework for future work.

Managing a vendor through its full lifecycle ensures risk is controlled at every stage:

1. Vendor Selection & Due Diligence

   • Assess reputation, financial stability, and security posture.
   • Review certifications (e.g., ISO 27001, SOC 2) and conduct questionnaires.

2. Contracting & Onboarding

   • Embed security requirements, SLAs, and right-to-audit clauses in contracts.
   • Grant least-privilege access and establish data handling rules.

3. Ongoing Monitoring

   • Continuously assess performance against SLAs.
   • Perform periodic security reviews and reassessments.
   • Monitor for breaches or changes in risk.

4. Offboarding / Termination

   • Revoke all access and credentials.
   • Recover or securely destroy organizational data.
   • Confirm return/destruction via certification.

Key concepts: Due diligence (initial investigation) and due care (ongoing responsible oversight) span the entire lifecycle.

Audits vs. Assessments:

Internal vs. External Audits:

• Internal Audit:

  • Conducted by the organization's own staff.
  • Used for self-check, readiness, and continuous improvement.
  • Less objective but cheaper and more frequent.

• External (Third-Party) Audit:

  • Conducted by an independent outside firm.
  • Provides objective, credible attestation to regulators, partners, or customers.
  • Required for certifications (e.g., SOC 2, PCI DSS).

Together they provide both ongoing self-monitoring and independent validation.

Penetration Testing (Pen Testing) is an authorized, simulated cyberattack against a system to identify and exploit vulnerabilities, demonstrating real-world impact. It goes beyond vulnerability scanning by actively attempting exploitation.

Testing approaches based on tester knowledge:

• Black-box Testing:

  • The tester has no prior knowledge of the system.
  • Simulates an external attacker.
  • Realistic but time-consuming.

• White-box Testing:

  • The tester has full knowledge (source code, architecture, credentials).
  • Thorough and efficient; simulates a knowledgeable insider.

• Gray-box Testing:

  • The tester has partial knowledge (e.g., user-level access).
  • Balances realism and efficiency; simulates an attacker who has gained some access or an insider with limited privileges.

Phases typically include: reconnaissance, scanning, exploitation, post-exploitation, and reporting.

Data Classification is the process of categorizing data based on its sensitivity, value, and the impact of its unauthorized disclosure. It ensures appropriate controls are applied to each category.

Why it matters:

• Enables proportional security (strongest controls on most sensitive data).
• Supports compliance and efficient resource allocation.
• Guides handling, storage, and disposal.

A common commercial classification scheme:

• Public: No harm if disclosed (e.g., marketing material).
• Internal / Private: For internal use; limited harm if leaked.
• Confidential: Sensitive business data; significant harm if disclosed.
• Restricted / Highly Confidential: Severe harm; e.g., trade secrets, regulated data.

Government scheme often uses: Unclassified, Confidential, Secret, Top Secret.

Data states to protect: data at rest, in transit, and in use.

Clear data roles ensure accountability in data governance:

• Data Owner:

  • A senior/business executive accountable for a data asset.
  • Decides classification, authorizes access, and bears ultimate responsibility.

• Data Custodian:

  • Typically IT staff responsible for the technical protection and maintenance of data (backups, storage, enforcing controls).

• Data Steward:

  • Responsible for data quality, context, and proper use; ensures data is accurate and used appropriately per policy.

• Data Processor:

  • An entity (often a third party) that processes data on behalf of the data owner/controller, following their instructions (a key GDPR concept).

• Data Controller (related): Determines the purposes and means of processing personal data.

Summary: The owner is accountable, the custodian protects, the steward manages quality, and the processor acts on instructions.

GDPR (General Data Protection Regulation):

• EU regulation protecting the personal data and privacy of EU residents.
• Grants rights such as access, rectification, erasure ("right to be forgotten"), and portability.
• Imposes heavy fines (up to 4% of global annual revenue).

HIPAA (Health Insurance Portability and Accountability Act):

• US law protecting Protected Health Information (PHI).
• Mandates privacy and security safeguards for healthcare providers, insurers, and their business associates.

PCI DSS (Payment Card Industry Data Security Standard):

• A contractual/industry standard (not a law) protecting cardholder data.
• Applies to any entity that stores, processes, or transmits credit card data.
• Requires controls like encryption, network segmentation, and regular testing.

Common theme: All mandate safeguarding sensitive data, with penalties for non-compliance, driving organizational data protection programs.

PII (Personally Identifiable Information):

• Any data that can identify a specific individual, alone or combined.
• Examples: name, SSN, address, email, phone number, passport number.

PHI (Protected Health Information):

• Health-related information linked to an individual, protected under HIPAA.
• Examples: medical records, diagnoses, treatment history, health insurance details.

SPI (Sensitive Personal Information):

• A subset of PII whose disclosure could cause significant harm; requires stronger protection.
• Examples: racial/ethnic origin, religious beliefs, political opinions, sexual orientation, biometric and genetic data, financial account numbers.

Key distinction:

• All PHI and SPI are forms of personal data, but SPI is more sensitive and carries higher protection requirements.
• PHI is specifically health-related, while SPI covers broader sensitive categories.

These techniques protect sensitive data in different ways:

• Encryption:

  • Converts data into unreadable ciphertext using an algorithm and key.
  • Reversible with the correct key; protects data at rest and in transit.

• Tokenization:

  • Replaces sensitive data with a non-sensitive token; the real value is stored in a secure token vault.
  • The token has no mathematical relationship to the original (unlike encryption). Common in payment processing.

• Data Masking (Obfuscation):

  • Hides parts of data with symbols (e.g., ****-****-****-1234).
  • Preserves format while concealing sensitive values; used in test/display environments.

• Anonymization vs. Pseudonymization:

  • Anonymization: Irreversibly removes identifying information so individuals cannot be re-identified.
  • Pseudonymization: Replaces identifiers with pseudonyms; can be reversed using additional information kept separately.

Summary: Encryption and tokenization are reversible (with keys/vaults), masking conceals for display, and anonymization permanently de-identifies.

Personnel policies address the human element of security:

• Acceptable Use Policy (AUP):

  • Defines permitted and prohibited uses of organizational systems and data.
  • Sets expectations for email, internet, and device usage.

• Non-Disclosure Agreement (NDA):

  • A legal contract binding employees/vendors to keep confidential information secret.

• Onboarding:

  • Background checks, security awareness training, acceptable use acknowledgment, and provisioning of least-privilege access.

• Offboarding:

  • Prompt revocation of all access and credentials.
  • Return of assets and reminder of ongoing confidentiality obligations.

Other key policies:

• Clean Desk Policy and Password Policy.
• These policies reduce insider threats, accidental disclosure, and ensure consistent, enforceable security behavior.

These administrative controls reduce the risk of insider fraud and error:

• Separation (Segregation) of Duties:

  • Splits critical tasks among multiple people so no single individual controls an entire process.
  • Fraud prevention: Requires collusion to commit fraud, which is harder to achieve.

• Least Privilege:

  • Grants users only the minimum access needed to perform their job.
  • Benefit: Limits damage from compromised or malicious accounts.

• Job Rotation:

  • Periodically moves employees between roles.
  • Fraud prevention: Exposes irregularities a predecessor may have hidden; reduces dependency on one person.

• Mandatory Vacation:

  • Requires employees to take time off, during which someone else performs their duties.
  • Fraud prevention: Fraudulent activity requiring continuous concealment is likely to surface in their absence.

Collectively, these principles enforce checks and balances, deter wrongdoing, and improve detection.

Inherent Risk:

• The level of risk that exists before any controls or mitigation are applied — the "raw" risk.

Residual Risk:

• The risk that remains after controls have been implemented.
• Formula relationship:
  

Risk Appetite:

• The amount and type of risk an organization is willing to pursue or accept to achieve its objectives (a strategic, high-level statement).

Risk Tolerance:

• The acceptable variation or specific thresholds around the risk appetite for particular risks.

How they relate:

• An organization identifies inherent risk, applies controls to reduce it to residual risk, and then checks whether that residual risk falls within its risk appetite/tolerance.
• If residual risk exceeds tolerance, additional controls are needed; if within tolerance, the risk can be formally accepted.

Compliance means adhering to laws, regulations, standards, and internal policies that govern how an organization handles data and operates its systems.

Types of compliance:

• Regulatory (Legal) Compliance:

  • Mandated by law/government (e.g., GDPR, HIPAA, SOX).
  • Non-compliance can lead to legal penalties.

• Contractual Compliance:

  • Required by agreements with partners or industry bodies (e.g., PCI DSS).
  • Non-compliance can breach contracts and incur fines or loss of privileges.

• Internal Compliance:

  • Adherence to the organization's own policies and standards.
  • Enforced through audits and disciplinary measures.

Consequences of non-compliance:

• Financial: Fines, penalties, legal costs.
• Operational: Loss of licenses, business restrictions, or inability to process payments.
• Reputational: Loss of customer trust and brand damage.
• Legal: Lawsuits and sanctions against executives.

Compliance is verified through audits, assessments, and attestations, making it closely linked to the organization's governance and risk management programs.