CISAW Risk Management cheat sheet

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register

Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence

Risk requires a threat, a vulnerability, and an impact; none alone is sufficient

Inherent risk is before controls, residual risk after them - always state which is being scored

Control effectiveness and uncertainty affect any expected-loss comparison.

Four responses: avoid, mitigate, transfer, accept - each tied to cost-benefit and risk appetite

Transfer shifts financial consequence only; accountability and reputation stay with the enterprise

Acceptance requires documented sign-off by the accountable owner and residual risk within appetite

Match control type to intent: preventive, detective, corrective

Board reporting should be aggregated, trend-based, and referenced to appetite, not a raw register dump

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.