Risk Management

Managing Risk

Calculate & Handle Risk

Practical

• Simple Risk Analysis: a quantitative, probabilistic risk measurement method
• ⭐️ Minimalist Risk Management: documentation to describe a simple risk management program

Link	Description
Phil Venables 12 Step Guide on Escalating Risk and Security Issues	Manage to Escalation Thresholds Create and Use Ceremonies Forewarning Escalation Building and Testing the Escalation Pipes Practices to Build a Culture of Risk Openness Reward the Messenger Escalate Issues Not Perceived Negligence Educate Yourself Circumvent Escalation Look for Escalation Failures in Incident Reviews / Post-Mortems Look for Escalation Opportunities in Pre-Mortems Whistle-blower Programs
Phil Venables Risk Appetite and Risk Tolerance - A Practical Approach	Define the Enterprise Risk Management Framework Develop a Risk Taxonomy Define Risk Limits and Thresholds Defined Levels of Approval for Policy Deviation Establish a Governance Framework Measure Effectiveness and Adjust
magoo The value of risk organizations

OKRs

Link	Description
magoo A key performance indicator for infosec organizations	Using probabilistic risk KPIs to direct complex risk engineering efforts > N regrettable customer exits resulting from aSEV0 Any party in {set of regulators} formally discusses a SEV0 with us A SEV0 with >$10M of losses A {set of bloggers and newspapers} publishes commentary on a SEV0 A SEV0 has confirmed, unauthorized access to customer data >% of total users impacted by a SEV0 involving an explicitly defined failure
magooHow to measure risk with a better OKR	How to write probabilistic OKRs Element Description Example OBJECTIVE Write an objective with a “risk scenario” Reduce the risk of “An adversary has accessed production from a developer laptop in Q3.” KEY RESULTS Choose milestones or metrics, and commit to a forecast
Building effective security OKRs

Communicating Risk

Link	Description
magoo Communicating risk across complex teams	Using threat modeling techniques for organizational risk planning
magoo Decomposing security risk into scenarios	Tabletop scenarios are an efficient means of communicating risk
magoo A risk based security project	Driving an awareness project with a risk measurement ethos

Forecasting

Practical

• Simple Risk Measurement: Forecasting playground

Theory

• Risk for Engineers
• A risk decomposition walkthrough
• Prediction of Adversarial Risk
• Scoring a risk forecast
• Quantifying your unknowns: A case for estimation in cyber security
• Forecasting techniques and measurement
• Attribution: Avoiding "We got 'em"
• Describing Vulnerability Risks
• Valuation of Non-Monetary Penalties
• Troubles with quantified risk

Examples

• Measuring "In The Wild" Exploitation
• Measuring a red team or penetration test.
• Forecasting BlueKeep
• Revisiting the Bluekeep Forecast
• Forecasting Supply Chain Compromise
• Forecasting NPM Security Advisories
• Forecasting Netspectre
• Enigma Forecasting Follow Up

Others

• Evidence of Absence: It’s impossible to prove that you haven’t suffered a security breach
• The next 50 years of cyber security: Making our risks as quantifiable and predictable as the weather