Cybersecurity Risk Management

Context: Information Security and Cryptography · the organising philosophy of the whole security half — since perfect security is impossible, manage risk · the profession behind it

Quick Revision

• 🎯 Objective: perfect cybersecurity is not achievable ➔ instead manage risk by putting the right security controls in place across many domains.
• ⚡ Key Constraint: there is a wide range of control families — no single control suffices; frameworks (NIST RMF) exist precisely because coverage must be systematic, not ad hoc.

📝 Managing risk

• Core premise ➔ you cannot eliminate risk, only reduce it to an acceptable level with appropriate controls (accept the residual risk).
• Control families (NIST RMF) ➔ 16 families in three groups:
  • Technical ➔ Access Control · Identification & Authentication · System & Communications Protection · System & Information Integrity · Accountability & Audit.
  • Operational / people ➔ Awareness & Training · Personnel Security · Physical & Environmental Protection · Media Protection · Configuration Management · Contingency Planning · Incident Response.
  • Management ➔ Risk Assessment · Security Planning · Certification/Accreditation & Security Assessments · System & Services Acquisition.
• Framework ➔ the NIST Risk Management Framework (RMF) structures how controls are selected, implemented, assessed, and monitored.

👥 Roles in cybersecurity

• Many job types ➔ the breadth of controls implies many professional roles.
• NICE framework ➔ the U.S. NIST National Initiative for Cybersecurity Education identifies 52 distinct roles — from analyst to architect to incident responder.

⚠️ Common Mistakes

• 💡 “Secure” is never binary ➔ the goal is acceptable residual risk, not perfection; claiming a system is “100% secure” misunderstands the discipline.
• 💡 Controls are cross-cutting ➔ technical controls (Access Control, firewalls, crypto) sit alongside people/process controls (training, personnel security, incident response) — security is not only technology.

🧠 Active Recall

If perfect security is unachievable, what is the actual goal of a security programme?

Answer

• Short answer: to manage risk — select and operate the right mix of controls so that remaining (residual) risk is reduced to a level the organisation can accept, across technical, physical, and human domains.
• Why: Systematic coverage ➔ frameworks like the NIST RMF ensure controls (from access control to incident response to training) are chosen and monitored deliberately, rather than leaving gaps an attacker exploits.