Risk Management

Program: Security Foundations, Governance and Risk Module: Introduction to Risk Management Submodule: Risk Management

The previous submodule (01 · Risk Assessment) answered what are our risks and how big are they? This submodule answers the natural follow-up: what do we actually do with the risks we've identified?

Three framing questions:

1. How does an organization respond to each risk once it is known?
2. What controls (safeguards) can be used to deal with it, and what kinds are there?
3. What process keeps this working over time?

The answers, respectively: four risk responses, three categories and six types of controls, and the NIST Risk Management Framework's six-stage cycle.

---

1. Four Ways to Respond to a Risk

Once each risk is identified and its impact on each asset is understood, leadership has to make a decision about how to respond. There are effectively four options.

Response	What it means	Typical example
Mitigate (a.k.a. reduce / eliminate)	Apply controls that reduce likelihood or impact	Enable MFA to reduce password-guessing risk
Transfer (a.k.a. assign)	Push the risk to a third party	Cyber-insurance; outsourcing to a managed service provider
Accept	Consciously decide to live with the risk	Skip an expensive IPS if the asset it would protect isn't worth it
Ignore	Pretend the risk doesn't exist	Not a valid response — but often what happens in practice

1.1 Mitigate ≠ eliminate

You will hear "mitigate or eliminate" used interchangeably, but mitigate is the more accurate term. Almost no control fully eliminates a risk. The MFA example makes this concrete:

• MFA drastically reduces the risk of email compromise via password guessing.
• But attackers can still:
  • Guess/phish the second factor.
  • Find users who haven't enrolled and enroll on their behalf.

So "eliminated" almost always really means "reduced to an acceptable level."

1.2 Transfer — insurance and outsourcing

A small business cannot realistically stop a nation-state attack. Buying cyber-insurance or outsourcing to a managed-service provider lets the organization face threats it could not afford to counter alone. The risk still exists — it now sits on someone else's balance sheet.

1.3 Accept — deliberately

Acceptance is legitimate when the cost of safeguards outweighs the cost of losing the asset. Examples of costs to weigh: intrusion prevention systems, badge readers, hiring a security team.

Three rules for making acceptance safe:

1. Formal documentation — the acceptance is written down, with rationale.
2. Explicit approval — a named leader signs off.
3. Periodic review — the acceptance is reassessed as the offensive and defensive landscape changes.

Without those three, "accepted" degrades into "forgotten."

1.4 Ignore is not a response

Ignoring a risk is neither realistic nor valid. When an organization says it's "accepting" a risk, that has to be a documented, approved decision — not an unwritten policy of looking away.

---

2. Controls: Principles for Choosing Them

Controls (also called safeguards or countermeasures) are the concrete mechanisms an organization uses to enact its risk response. Three principles govern good control selection:

1. The control should cost less than what the asset is worth. Otherwise the math from Risk Assessment §5.3 goes negative.
2. The control should raise the cost of an attack. MFA doesn't make password compromise impossible, but it doubles the attacker's work.
3. The control must solve a real problem. Avoid deploying tools because a salesperson pitched them, or because the budget allowed it. Common failure mode: a flashy SIEM with no staff trained to run it.

2.1 A cautionary anecdote

A recurring finding in penetration-test reports: security tools themselves — deployed with default configurations and default passwords — become the initial foothold. Security tools are also attack surface; badly configured controls can add risk instead of removing it.

Before buying or building any control, security governance should ask:

• Does this solve an actual problem we have?
• Do we have the staff to monitor it?
• Is the staff trained to make proper use of it?

---

3. The Three Categories of Controls

Controls come in three categories, based on how they protect assets.

Category	How it works	Typical examples
Administrative	Policies and procedures that describe what should be done	"Databases must be protected from unauthorized access"; access-request workflows; onboarding checklists
Technical	Technology that enforces the administrative direction	Passwords, access-control lists, encryption, MFA, firewalls
Physical	Prevents unauthorized physical access to or damage of assets	Biometric readers, key locks, cages, cameras

The three categories layer on top of each other:

Administrative sets the intent, technical enforces it, physical bounds the environment in which enforcement can be trusted.

---

4. The Six Types of Controls

Cutting the same population of controls a different way, there are six types, based on when and how the control acts relative to an incident.

Type	When it acts	What it does	Examples
Deterrent	Before an attack	Makes the attacker think twice	Warning signs, electric fences, login banners, "you shall not misuse" notices
Detective	Before / during / after	Spots policy violations or intrusions	Authentication logs, application logs, SOC alerts, honeypots
Preventive	During an attack attempt	Blocks unauthorized access, modification, or destruction	Antivirus, passwords, MFA, firewalls
Corrective	After an event	Brings the system back to a normal state	Terminating a malicious connection, quarantining infected files
Recovery	After a significant event	Restores full functionality; an extension of corrective, with more complex capabilities	Off-site backups, DR sites, restore procedures
Compensating	Fills gaps in other controls	Adds protection where a primary control is weak or missing	Anti-phishing / spam filters when users are prone to phishing

4.1 A note about detective controls

Preventive controls are often over-emphasized relative to detective controls. Preventive controls age — they gradually lose effectiveness against evolving threats. Detective controls, well tuned, catch things preventive controls miss.

A classic illustration: a red team exploits very weak passwords only to discover that the account was a honeypot planted by the blue team specifically to detect intrusions. A detective control turned an attack into intelligence.

---

5. The NIST Risk Management Framework (SP 800-37)

Individual risk responses and control choices need to happen inside a process that runs continuously. NIST SP 800-37 — the Risk Management Framework (RMF) — is the reference process. Its central idea:

Near-real-time risk management. The RMF encourages teams to deploy a risk-management lifecycle that is fed new risks on a regular basis, producing leadership-ready information that supports risk-based decision-making and business continuity / disaster recovery.

The RMF has six stages, and it is explicitly cyclic — after monitoring you loop back to categorize.

5.1 The six stages at a glance

#	Stage	Central question
1	Categorize	What systems and data do we have, and how business-critical is each?
2	Select	Which baseline controls fit these systems + our local conditions?
3	Implement	Deploy those controls — and document goals, method, and location
4	Assess	Are the controls being used as intended, and are they meeting security requirements?
5	Authorize	Given actual behavior + cost, do we formally approve the controls for continued use?
6	Monitor	Are the controls still effective? Report the security state upward on a cadence

5.2 Stage-by-stage detail

• Categorize — Classify information systems and data using a business-impact analysis: data stored / processed / transmitted, and systems critical to operations.
• Select — Choose an initial baseline of security controls, then tailor to local conditions. Two cautionary examples:
  • 16-character passwords may fit workstations but are impractical for an industrial control system — high cost, low benefit.
  • Locking accounts after three failed logins may create a helpdesk deluge — or a self-inflicted denial-of-service if an attacker triggers lockouts on purpose.
• Implement — Deploy the controls and document what they do, how they were configured, and where they operate. Rationale: if the entire security team leaves, incoming staff should be able to read the docs and understand the program.
• Assess — Controls drift over time. Users given "8-character password with special chars, digits, upper, lower" will land on things like P@ssw0rd. It technically satisfies the rule and offers essentially no protection. Regular assessment catches that.
• Authorize — Explicit authorization decisions should weigh: the control's intended purpose, whether it actually addresses the risk (and doesn't create a new one), and whether the organization can sustain it operationally and financially.
• Monitor — Continuously watch for deviations and negative impacts. Report security posture to senior management so leadership always has a current picture.

5.3 Why the cycle matters

The RMF is not a one-off project. Monitoring routinely surfaces:

• New risks to feed back into Categorize.
• Deviations in how controls are being used.
• Financial insight — controls that are too expensive to justify, or budget headroom for stricter ones.
• Structural changes — e.g. moving fully to the cloud may eliminate physical-datacenter controls entirely, changing the categorization.

Each monitoring cycle can, and should, restart the loop with an updated risk posture.

---

6. Putting It All Together

The three ideas connect like this:

• Risk assessment feeds the pipeline.
• A response is chosen per risk.
• If the response is mitigate, controls are selected — categorized by how they act and typed by when they act.
• Every response and every control lives inside the RMF, which loops.

---

7. Key Takeaways

• There are four risk responses: Mitigate, Transfer, Accept, and (not really) Ignore. Only the first three are valid.
• Mitigate rarely means eliminate. MFA is the canonical example: it reduces, it doesn't remove.
• Transfer (insurance / MSPs) is how organizations face risks they cannot afford to counter alone.
• Acceptance requires formal documentation + explicit approval + periodic review. Anything less becomes drift.
• Every control should cost less than the asset, increase the attacker's cost, and solve a real problem — not be bought because the budget allowed it.
• Controls come in three categories (Administrative, Technical, Physical) and six types (Deterrent, Detective, Preventive, Corrective, Recovery, Compensating).
• Preventive controls are over-emphasized; detective controls catch what prevention misses (honeypot example).
• The NIST Risk Management Framework (SP 800-37) provides a six-stage cyclic process — Categorize → Select → Implement → Assess → Authorize → Monitor — for near-real-time risk management.
• The RMF is cyclic: monitoring feeds new risks back into categorization.

---

8. Glossary

Term	Definition
Risk Response	The chosen action for a given risk: Mitigate, Transfer, or Accept.
Risk Mitigation	Applying controls that reduce the likelihood or impact of a risk.
Risk Transfer	Assigning the risk to a third party via insurance or outsourcing.
Risk Acceptance	Formal, documented, approved decision to take no further action; periodically reviewed.
Safeguard / Countermeasure / Control	Interchangeable terms for the concrete mechanisms that enact a risk response.
Administrative Control	Policy- and procedure-based control that describes what should be done.
Technical Control	Technology-based control that enforces administrative direction (passwords, ACLs, MFA, encryption).
Physical Control	Control that prevents physical access or damage (biometrics, locks, cages).
Deterrent Control	Discourages an attack (warnings, banners, fences).
Detective Control	Identifies policy violations or intrusions (logs, SOC alerts, honeypots).
Preventive Control	Blocks unauthorized access, modification, or destruction (AV, passwords, firewalls).
Corrective Control	Brings a system back to normal after an event (kill connection, quarantine).
Recovery Control	Restores full functionality after a significant event (backups, DR site).
Compensating Control	Fills gaps in other controls (anti-phishing filter for users prone to phishing).
Honeypot	Decoy system or account whose only purpose is to be attacked, so defenders can detect the attack.
Risk Management Framework (RMF)	NIST SP 800-37; six-stage cyclic process for near-real-time risk management.
Categorize / Select / Implement / Assess / Authorize / Monitor	The six stages of the RMF.
Business Impact Analysis (BIA)	Analysis that categorizes systems and data by their criticality to business operations; feeds RMF stage 1.

---

9. What's Next

• 03 · Threat Modeling (planned) — structured techniques (STRIDE, PASTA, attack trees) for enumerating threats before an incident, feeding higher-quality inputs into the risk-management cycle.
• 04 · Business Continuity Planning(planned) — how the outputs of risk assessment and management get turned into a plan for keeping the business running when a risk is realized. Extends the Recovery and Corrective control types introduced here.
• Cross-reference from Module 1: 4 · Cybersecurity Policies and Procedures — administrative controls are the policy layer discussed there.