Please enable JavaScript.

Coggle requires JavaScript to display documents.

CASP+ Risk management - Coggle Diagram

- - - - software bugs
      - misconfigured software
      - improperly protected
        network devices
      - lacking physical security
  - - - avoid legal troubles
      - establish trust & mitigate liability
- - - - establish strategic risk
        for stakeholders
    - - goal: mitigate risk assessed
      - category
        
        people
        
        process
        
        technology
        
        protect
        
        detect
        
        response
        
        restore/recover
    - - evaluate effectiveness risk response
        & identify change affect risk be managed
      - risk determination
        
        qualitative
        
        proposed impact severity
        
        .i.e low, medium, high
        
        loss potential
        
        likelihood of occurence
        
        quantitative
        
        numeric value &
        monetary value
        
        equations: total & residual risk -> cost
        
        hybrid approach
- - - - amount risk
        willing to accept
        pursuit objective
- - - - Risk identified
      - Description
      - Level
      - Likelihood
      - Owner
        
        people responsible
        manage threads & vulnerabilities
        might exploit risk
      - Migitation
      - Residual level
    - - KPI
        (key performance indicators)
        (metric & number)
        
        Scalability
        
        Reliability
        (certain performance standard)
        
        Availability
      - KRI
        (key risk indicator)
- - - - motivation
        
        acqusition | theft
        
        business advantage
        
        damage
        
        embarrassment
        
        technical advantage
      - source
        
        inernal
        
        external
      - annualized rate
        of occurrence
        
        magnitude of impact
        
        single loss expectancy (SLE)
        
        annual loss expectancy (ALE)
        
        annualized rate of occurrence (ARO)
        
        ALE = SLE x ARO
        
        return on investment (ROI)
        
        ratio how long
        make up expense or investment
        by preventing the risk occur
        
        determine
        expected fiscal gain for improvement and
        balance vs cost implement change
        
        type of loss
        
        loss of productivity
        
        due to downtime, repair time
        
        loss of revenue
        
        data loss
        
        data compromise
        
        cost of repairs
        
        cost pay
        procure and replace
        hardware and software
        
        loss of reputation
        
        measure
        
        payback
        
        expected saving
        from implementing given control
        
        net present value
        (NPV)
        
        const spent vs
        cost saving
        tomorrow
        
        discount rate
        
        total cost ownership
        (TCO)
        
        estimate overall direct &
        indirect cost
        
        basics
        
        industry benchmark not always representative of
        the org
        
        minor risk should cover within
        org not through insurance
        
        ultilize risk management
        software to help
        decision making
        
        consider risk management
        when budgeting
        (not just about saving money)
        
        TCO analysis
        not instant save money
        but overtime
        
        org cannot solve
        all problem
        so through external or insurance
      - trend analysis
        
        math-based
        provide baseline and future
        projection of risk
      - gap analysis
        
        performance experiencing
        vs performance expected