Information Security Risk Management

  1. Frameworks and Standards
    1. NIST Risk Management Framework
      1. Framework Overview
        1. RMF Purpose and Objectives
          1. Framework Components
            1. Implementation Approach
            2. Special Publication 800-37
              1. RMF Steps and Tasks
                1. Categorize Information Systems
                  1. Select Security Controls
                    1. Implement Security Controls
                      1. Assess Security Controls
                        1. Authorize Information Systems
                          1. Monitor Security Controls
                          2. Roles and Responsibilities
                            1. Authorizing Official
                              1. System Owner
                                1. Information System Security Officer
                                2. Documentation Requirements
                                  1. System Security Plan
                                    1. Security Assessment Report
                                      1. Plan of Action and Milestones
                                    2. Special Publication 800-53
                                      1. Security Control Catalog
                                        1. Control Families
                                          1. Control Baselines
                                            1. Control Enhancements
                                            2. Control Selection Process
                                              1. Baseline Selection
                                                1. Tailoring Activities
                                                  1. Supplementation
                                                  2. Control Implementation Guidance
                                                    1. Implementation Approaches
                                                      1. Assessment Procedures
                                                    2. Special Publication 800-30
                                                      1. Risk Assessment Methodology
                                                        1. Risk Assessment Process
                                                          1. Risk Assessment Techniques
                                                            1. Risk Assessment Documentation
                                                            2. Threat and Vulnerability Analysis
                                                              1. Threat Source Identification
                                                                1. Vulnerability Assessment
                                                                  1. Risk Determination
                                                              2. ISO/IEC 27000 Series
                                                                1. ISO 27001 Information Security Management Systems
                                                                  1. ISMS Requirements
                                                                    1. Context of Organization
                                                                      1. Leadership and Commitment
                                                                        1. Planning and Risk Assessment
                                                                          1. Support and Operation
                                                                            1. Performance Evaluation
                                                                              1. Improvement
                                                                              2. Certification Process
                                                                                1. Stage 1 Audit
                                                                                  1. Stage 2 Audit
                                                                                    1. Surveillance Audits
                                                                                      1. Recertification
                                                                                      2. Annex A Controls
                                                                                        1. Control Categories
                                                                                          1. Control Implementation
                                                                                            1. Control Assessment
                                                                                          2. ISO 27005 Information Security Risk Management
                                                                                            1. Risk Management Process
                                                                                              1. Context Establishment
                                                                                                1. Risk Assessment
                                                                                                  1. Risk Treatment
                                                                                                    1. Risk Acceptance
                                                                                                      1. Risk Communication
                                                                                                        1. Risk Monitoring and Review
                                                                                                        2. Risk Assessment Guidelines
                                                                                                          1. Asset Identification
                                                                                                            1. Threat and Vulnerability Analysis
                                                                                                              1. Risk Analysis and Evaluation
                                                                                                              2. Risk Treatment Options
                                                                                                                1. Risk Modification
                                                                                                                  1. Risk Retention
                                                                                                                    1. Risk Avoidance
                                                                                                                      1. Risk Sharing
                                                                                                                    2. Other ISO 27000 Standards
                                                                                                                      1. ISO 27002 Code of Practice
                                                                                                                        1. ISO 27003 Implementation Guidance
                                                                                                                          1. ISO 27004 Measurement and Metrics
                                                                                                                            1. ISO 27035 Incident Management
                                                                                                                          2. COBIT Framework
                                                                                                                            1. COBIT Overview
                                                                                                                              1. Framework Purpose
                                                                                                                                1. Governance and Management Objectives
                                                                                                                                  1. Process Framework Structure
                                                                                                                                  2. Governance Objectives
                                                                                                                                    1. Evaluate, Direct and Monitor (EDM)
                                                                                                                                      1. Strategic Alignment
                                                                                                                                        1. Value Delivery
                                                                                                                                          1. Risk Management
                                                                                                                                            1. Resource Management
                                                                                                                                              1. Performance Measurement
                                                                                                                                              2. Management Objectives
                                                                                                                                                1. Align, Plan and Organize (APO)
                                                                                                                                                  1. Build, Acquire and Implement (BAI)
                                                                                                                                                    1. Deliver, Service and Support (DSS)
                                                                                                                                                      1. Monitor, Evaluate and Assess (MEA)
                                                                                                                                                      2. Risk Management Integration
                                                                                                                                                        1. Risk Governance
                                                                                                                                                          1. Risk Strategy
                                                                                                                                                            1. Risk Assessment
                                                                                                                                                              1. Risk Response
                                                                                                                                                            2. FAIR Framework
                                                                                                                                                              1. FAIR Overview
                                                                                                                                                                1. Factor Analysis of Information Risk
                                                                                                                                                                  1. Quantitative Risk Analysis Approach
                                                                                                                                                                    1. Risk Factor Taxonomy
                                                                                                                                                                    2. Risk Factors
                                                                                                                                                                      1. Loss Event Frequency
                                                                                                                                                                        1. Threat Event Frequency
                                                                                                                                                                          1. Vulnerability
                                                                                                                                                                          2. Loss Magnitude
                                                                                                                                                                            1. Primary Loss
                                                                                                                                                                              1. Secondary Loss
                                                                                                                                                                            2. FAIR Process
                                                                                                                                                                              1. Scoping and Risk Scenario Development
                                                                                                                                                                                1. Data Collection and Calibration
                                                                                                                                                                                  1. Risk Calculation and Analysis
                                                                                                                                                                                    1. Results Communication
                                                                                                                                                                                    2. FAIR Implementation
                                                                                                                                                                                      1. Tool Selection
                                                                                                                                                                                        1. Training Requirements
                                                                                                                                                                                          1. Organizational Adoption
                                                                                                                                                                                        2. OCTAVE Methodology
                                                                                                                                                                                          1. OCTAVE Overview
                                                                                                                                                                                            1. Operationally Critical Threat, Asset, and Vulnerability Evaluation
                                                                                                                                                                                              1. Risk-Based Strategic Assessment
                                                                                                                                                                                                1. Organizational Perspective
                                                                                                                                                                                                2. OCTAVE Process
                                                                                                                                                                                                  1. Phase 1: Build Asset-Based Threat Profiles
                                                                                                                                                                                                    1. Identify Critical Assets
                                                                                                                                                                                                      1. Define Security Requirements
                                                                                                                                                                                                        1. Identify Threats
                                                                                                                                                                                                        2. Phase 2: Identify Infrastructure Vulnerabilities
                                                                                                                                                                                                          1. Evaluate Computing Infrastructure
                                                                                                                                                                                                            1. Identify Vulnerabilities
                                                                                                                                                                                                            2. Phase 3: Develop Security Strategy and Plans
                                                                                                                                                                                                              1. Conduct Risk Analysis
                                                                                                                                                                                                                1. Develop Protection Strategy
                                                                                                                                                                                                                  1. Create Mitigation Plans
                                                                                                                                                                                                                2. OCTAVE Variants
                                                                                                                                                                                                                  1. OCTAVE-S for Small Organizations
                                                                                                                                                                                                                    1. OCTAVE Allegro
                                                                                                                                                                                                                      1. OCTAVE FORTE
                                                                                                                                                                                                                    2. Other Notable Frameworks
                                                                                                                                                                                                                      1. COSO Enterprise Risk Management
                                                                                                                                                                                                                        1. ERM Framework Components
                                                                                                                                                                                                                          1. Risk Management Process
                                                                                                                                                                                                                            1. Integration with Internal Controls
                                                                                                                                                                                                                            2. Factor Analysis of Information Risk (FAIR)
                                                                                                                                                                                                                              1. Quantitative Risk Modeling
                                                                                                                                                                                                                                1. Risk Factor Decomposition
                                                                                                                                                                                                                                  1. Monte Carlo Analysis
                                                                                                                                                                                                                                  2. STRIDE Threat Modeling
                                                                                                                                                                                                                                    1. Threat Categories
                                                                                                                                                                                                                                      1. Application to System Design
                                                                                                                                                                                                                                        1. Mitigation Strategies
                                                                                                                                                                                                                                        2. PASTA Threat Modeling
                                                                                                                                                                                                                                          1. Process for Attack Simulation and Threat Analysis
                                                                                                                                                                                                                                            1. Seven-Stage Process
                                                                                                                                                                                                                                              1. Risk-Centric Approach

                                                                                                                                                                                                                                          Previous

                                                                                                                                                                                                                                          7. Governance and Integration

                                                                                                                                                                                                                                          Go to top

                                                                                                                                                                                                                                          Back to Start

                                                                                                                                                                                                                                          1. Foundations of Information Security Risk Management