Fundamental principles and concepts of information security risk management
Domain 1 - Fundamental principles and concepts
ISO/IEC 27005:2022 gives guidance on managing information security risk without prescribing a single methodology. This domain tests precise use of the vocabulary on which every later step depends; candidates who confuse likelihood with vulnerability, or risk owner with control owner, fail scenario questions even when they know the process by heart.
Core concepts
- Risk is the "effect of uncertainty on objectives" (ISO 31000:2018). The effect can be positive, although information security practice concentrates on negative effects.
- Information security risk: the potential that a threat exploits a vulnerability of an asset or group of assets and thereby harms the organization.
- Risk is characterised by risk source, event, causes, consequences and likelihood. Likelihood combines the chance the event occurs with the chance that consequences follow.
- Consequences are outcomes affecting objectives; impact scales usually aggregate confidentiality, integrity, availability and business, financial, legal or regulatory harm.
- Risk criteria are the terms of reference for significance: risk appetite, acceptance thresholds, impact and likelihood scales, and escalation rules.
- A risk owner is accountable, and authorised, for a risk; a control owner is accountable for a control. They are not the same person by default.
- Residual risk is what remains after treatment, and it is what management formally accepts.
Principles
ISO 31000 principles - integrated, structured and comprehensive, customised, inclusive, dynamic, based on best available information, sensitive to human and cultural factors, continually improving - are inherited by 27005. Risk management is proportionate to the value protected and iterative, not an annual paperwork exercise.
Worked example
A file share holding 20,000 customer records sits behind a web server with a 60-day patch lag. Threat: an external attacker scanning for known vulnerabilities. Vulnerability: the patch lag. Consequences: regulatory fine, notification costs, reputation damage. Likelihood 4/5, consequence 4/5, matrix level 16 - high, above the appetite of 9. Because the level exceeds the acceptance threshold, the risk is escalated to the CIO, its risk owner.
Traps
Watch for: equating risk with threat or vulnerability; scoring inherent and residual risk without labelling which; believing transferred risk disappears (it is shared, and accountability stays); forgetting that some risks are opportunities.