Cyclical risk analysis
- Imagine you've experienced a 'typical' incident affecting whatever [information] asset/s you are risk-assessing - such as a physical incident affecting the office. Consider various types of incident, of various scales and importance e.g. an office break-in, vandalism, professional hit, insider theft, fire, flood ... or whatever. For now, pick out whatever type/s of incident seems most likely and/or damaging for further consideration - not least, real incidents that have occurred (this analysis might follow an actual incident for maximum reality!). Start exploring the associated threats, vulnerabilities and impacts, using information about actual incidents (under similar circumstances) to inform your analysis - or wing-it using common sense. This step initiates the risk analysis, clarifying the asset/s and risks of most concern. Press ahead ...
- Following this imaginary incident, how would you know what had occurred? What indications would there be of the incident? How soon would it be discovered? When, by whom and how? Consider the possibility of gradual/non-obvious incidents (e.g. overloaded smouldering power cables, or where everybody is busy and assumes someone else is responsible), deliberately concealed incidents (e.g. insider thefts) and incidents with little if any indication (e.g. intellectual property theft - spying). This prompts you to think about detective controls e.g. alarms, warnings, indicators ...
- What would your immediate reactions be? What would you do first? Who would need to be involved? What would you need to make that work well? Use the incident scenario to explore/improve your incident response plans and preparations. Consider a desktop walk-though or an exercise to check them out more realistically.
- How would you investigate and resolve the incident? Again, consider who, what, when, how, why ... What information and skills would be essential or most valuable for the investigation (e.g. records, logs, CCTV footage, forensics, fire investigators)? Also, what could/would you do to minimise the damage ang get things back to normal ASAP? What would be the priorities for the business? This step extends/deepens your exploration of the incident response, including the corrective controls and a little Business Impact Analysis for good measure.
- Thinking back to step 1, is the incident worrying enough to improve the preventive controls? What else can/should be done to prevent the incident - and others affecting the same asset/s? Consider reducing the threats, vulnerabilities and/or impacts. Estimate how much disruption and cost this imaginary incident would have caused, roughly. Are we talking minor expense and inconvenience, big trouble, expensive repairs, compliance penalties, business failure, death and destruction, cataclysm ...? Apart from workers and the organisation/business itself, who else would/might have been materially affected (e.g. other residents of the same burnt-out building; customers; authorities; passers-by)? How many days/weeks/months/years later would these problems persist? Given even an approximate frequency of occurrence of this particular incident or of similar incidents (e.g. once a day, once a week, once a year, once a decade ...), this assessment may be enough to justify investing in implementing or improving cost-effective preventive controls, or at least consider the possibilities, pose other questions and gather more info to firm-up the details, particularly for large/unusual investments or where the benefits are marginal or dubious.
[Hinson tip: management may be willing to invest on gut feel without a fully developed business case, may already have strategic plans in this area, or may simply have some spare cash at the moment, saving analytical resources for other stuff - so approach management for advice early-on before getting totally bogged-down. Better still, engage/involve management actively in the entire exercise!] - Lather, rinse, repeat. Pick other incidents, other scenarios, other assets, other controls, other possibilities on each run through the cycle. Risk management is a never-ending quest for perfection, particularly as things keep changing and risks can never be totally eliminated. Keep on knocking down the biggest risks.
