Understanding our exposure due to security risks and how to treat them based on business objectives. For an introduction to the methodology behind this, please refer to /wiki/spaces/TISG/pages/29163730

Process Overview

Our process is based upon the following high level procedures:

Register: At the core of our risk management is the risk register. It presents our executive team with a total view of security risk and is also an input to the enterprise risk management framework. Regular reporting is sourced from this register so that management and our board are aware of the risks we are carrying and what (if any) mitigation controls are in place.
Mitigate: Controls, workarounds or tools that are designed to mitigate specific risks.
Assess: All risks are assessed using a consistent method of quantifying risk exposure based upon probability of occurence and the expected consequential loss. Risks are re-assessed on a regular basis, or when significant events occur. such as materialisation of risk, mitigation, or boundary events (where an unrelated event occurs that could have resulted in the risk being materialised in other circumstances).
Tolerance: A critical procedure that declares our tolerance of risk, expressed in financial terms. The principle that guides our treatment of risk is that the total risk exposure must not exceed the tolerance threshold, but equally we will not deploy controls where the assessed level of risk is below our tolerance.
Treat: A management decision on whether to (a) mitigate an identified risk, or (b) accept inherent or residual risk exposure. All decisions are recorded on the risk register.

High Level Process

Know what to do

The applied process is as follows:

Sources of information for determining whether a risk needs to be examined include /wiki/spaces/TISG/pages/30048317, security testing (including penetration testing), automated security monitoring, or manual risk reviews by any person. All security risks are part of the security problem ticket queue in JIRA. This allows us to refer to a single place where we record security risk, treatment decisions, and initiatives to mitigate risk.

All risks recorded in the JIRA queue will be assessed against the /wiki/spaces/TISG/pages/29163726. The model is a Bayesian statistical analysis tool that takes basic information about the risk and uses the Monte Carlo method to calculate our risk exposure. This method presents an opportunity to refine risk information over time, which will improve our decision making capability around risk treatment.

Tolerance is expressed as our willingness to lose a financial value due to security risk within a given 12 month period. This tolerance will vary over time as we change strategies. This forms the reference point to our treatment of total risk exposure.

How we treat the risk exposure will depend upon both the individual assessment of risk and the overall risk tolerance agreed by the Exec team. The choices available are:

Accept - the risk exposure is deemed to be acceptable to TSG (if the risk were to be materialised at the expected loss amount). This decision is recorded on the risk register as it increases the value at risk overall, and will affect future risk acceptance decisions, if cumulatively, risk exposure exceeds tolerance.
Mitigate - there is agreement that the risk exposure is too high and some mitigation must be applied. More often than not, mitigation means reducing the likelihood of a risk occurring, but it can also be the means of reducing the impact of any loss. Mitigation results in a reassessment of risk and an update of the risk register.

Related articles

Page:

Xplor Security Policy
Page:

Xplor Security Policy Controls
Page:

Xplor Multifactor Authentication (MFA) Policy
Page:

Xplor Security-Public
Page:

Xplor Information Security Architecture

Browser not supported