1

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly?

The problem that I am having is that we find so much in a day, things start to get lost in emails and we tend to forget the risks that was found because of multiple fires.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Sublime1914
  • 31
  • 1
  • 8
  • That's not a document problem, that's a process problem. Also, why would you want to populate the risk register with things found on the fly? Shouldn't they be assessed before being entered in the risk register? – schroeder Jun 08 '18 at 19:51
  • What would you recommend to document risks on the fly to come back and assess later? – Sublime1914 Jun 12 '18 at 18:51
  • 2
    In the past, I've used ticketing systems. They are logged, can be reviewed and assigned, and create an audit trail of follow-up items. – schroeder Jun 12 '18 at 18:57

3 Answers3

2

Something is wrong in your risk assessment process if you are finding new risks every day. It could also be that your risk identification was done at the wrong level of abstraction.

My guess is that you are doing this on a very low level and you should move up to understanding business impact. Risk is basically something of consequence that could go wrong. A technical vulnerability is not a risk. If you discover a new weakness in your webserver, that is a vulnerability and not a risk. The risk is, for example, that customer data could be stolen, or that your service could become unavailable.

If you view it like that, then discovering a new vulnerability would not create a new risk, it would affect the rating of an existing risk, and that is how it should be. So your server has more holes than you thought, that increases the potential frequency of loss, or whatever risk assessment method you are using (in FAIR, for example, it could reduce Resistance Strength).

Even if you uncover entirely new ways in which, say, personal data could be lost, the risk still is the loss of personal data. You just discovered a new attack path, not a new risk.

This doesn't directly answer your question, but it would solve your problem. I'm fairly certain that your existing Risk Register would serve you good enough if you thought of vulnerabilities as changing parameters in existing risks instead.

Tom
  • 10,124
  • 18
  • 51
  • 1
    Thank you for that. A year later I do have a better understanding of what risk is. Looking at risk in how a finding affects the business is definitely the right way to look at things. – Sublime1914 Sep 05 '19 at 17:22
  • My pleasure, especially glad that you came back after such a long time to give that feedback. I teach risk management regularily and people are always positive at the end, but rarely do they give feedback some time later when they could apply what they learnt. – Tom Sep 05 '19 at 20:31
2

The risk register is a document which helps you to understand the risks within your organisation and help you plan out methods to resolve them. Often, you find many documents on the internet which give you some results, but most of it, is understood by very few people. As a result, the core issue, that is to resolve the risks is lost and most of the effort is directed towards understanding the risk register itself.

The risk register can be created by yourself, and custom suited to your organisation. When you create a register independently, you end up learning a lot more about the risks, and residual risks that can arise.

This is much better and will help you in your career and will also help your organisation. Of course, you can use ready-made formats, but make sure you suit it to the needs of your organisation.

The annex A of ISO 27001 will help you classify the risks into various groups and attend them one after the other. Taking this as a reference, you need to understand the vulnerabilities in each group and find the controls that will patch them. This is what is risk assessment and risk treatment.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Vikas
  • 347
  • 1
  • 12
-1

On updating on the fly, if you are referring real time risk visibility and risk assignment on the go (proper assessment and mitigation actions to be followed with the risk management process), there are solutions available.

These solutions are categorized as GRC (Governance Risk Compliance) applications, the following diagram illustrates the functionality of such a platform:

enter image description here Source: http://processgene.com/solutions/grc-software/

The GRC Solutions offers mechanism to automate the workflow which helps to reduce the cost and time required to maintain risk management. This helps to overcome the challenges in maintaining multiple excels, manual computations, etc.

Sayan
  • 2,033
  • 1
  • 11
  • 21