Risk Management, Compliance and Legal Issues
Risk Management
Risk language is precise and heavily tested. Risk is the combination of the probability of an event and its consequence; assets have vulnerabilities, threats exploit them, and controls modify likelihood or impact. Learn the calculation chain:
- Asset value (AV) - replacement or business worth.
- Exposure factor (EF) - percentage of the asset lost in a single event.
- Single loss expectancy (SLE) = AV × EF.
- Annualised rate of occurrence (ARO) - expected events per year.
- Annualised loss expectancy (ALE) = SLE × ARO.
Use ALE to justify a control: if a control costs less than the ALE it removes, it is usually worth buying. Note the residual risk after the control.
Qualitative analysis uses ordinal scales and scenarios and is faster and cheaper; quantitative analysis uses monetary values and is more defensible but assumes good data. Risk treatment options are mitigate (apply a control), transfer (insurance, contract), avoid (stop the activity) and accept (documented decision by the accountable owner), with risk appetite/tolerance defining what may be accepted.
Business impact analysis underpins continuity: identify critical processes, define RTO, RPO and MTD, and set recovery priorities. Control categories: preventive, detective and corrective; administrative, technical and physical. Frameworks worth naming are NIST RMF, ISO 31000/27005 and OCTAVE, and third-party/supply-chain risk must be assessed and monitored, not assumed.
Traps: residual risk is what remains after controls and must be signed off by the business owner, not by IT. Transferring risk does not eliminate it. A vulnerability alone is not a risk until a threat can exploit it against something valuable.
Worked example: a server worth 100,000 is 40% destroyed per incident, twice a decade. SLE = 40,000; ARO = 0.2; ALE = 8,000. A control costing 3,000 per year that prevents half the incidents removes 4,000 of ALE - justified.
Compliance and Legal Issues
Compliance is the evidence that obligations are met; law and contract are the obligations. Distinguish the main regimes and who enforces them: GDPR protects EU/EEA data subjects regardless of where the controller sits, with lawful basis, data subject rights, breach notification (~72 hours), DPO requirements and transfer restrictions; HIPAA governs US protected health information; PCI DSS is a contractual standard from the card brands, not a statute; SOX mandates financial reporting controls for US public companies; GLBA covers financial privacy; FISMA applies to US federal agencies.
Contracts matter too: NDAs, SLAs, data processing agreements, and the security clauses that allocate liability with vendors. Know intellectual property families (copyright, patent, trademark, trade secret) and that trade secrets survive only while confidentiality does.
Privacy principles to recognise: collection limitation, purpose specification, data minimisation, use limitation, accuracy, storage limitation, security safeguards, openness, accountability. Retention schedules should be driven by legal requirement and business need - keeping data longer than necessary is itself a risk.
Audit and assurance: internal versus external audit, ISO/IEC 27001 certification (a management system), SOC 1 (financial controls), SOC 2 (security, availability, confidentiality, processing integrity, privacy) and SOC 3 (public summary). Evidence types in investigations: best evidence is the original; hearsay and copies are weaker. Maintain chain of custody, hash seized media, document every transfer, and remember eDiscovery holds.
Traps: PCI DSS is not a law, and compliance does not equal security. GDPR obligations can follow a non-EU company. "We are certified" answers a management-system question, not a technical-control question. Legal hold overrides a routine deletion schedule.
Worked example: a customer requests erasure. Confirm identity, check whether a legal hold or statutory retention duty applies, then delete or anonymise across production, backups per policy, and third processors - and log the decision.