---
title: CIR RAR-BIA Risk Treatment for Conduit Devices
description: "Risk Analysis and Review and Business Impact Analysis: Risk Treatment for Conduit Devices"
image: https://blog.bcm-institute.org/hubfs/Manager%20Guide%20to%20BCM%20for%20Cyber%20Security%20Incidents/C6%20Risk%20Analysis%20and%20Review%20and%20Business%20Impact%20Analysis/C6%20Morepost/IC_CIR_Risk%20Treatment_Conduit%20Devices.png
---
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Cybersecurity Series
# CIR RAR-BIA Risk Treatment for Conduit Devices
This blog on the type of risk treatment strategy discussed as a business continuity management (BCM) issue in connection with cyber security incident response (CIR). It discusses the importance of knowing what information assets require protection against specific cyber security threats.
It is conducted as part of the Risk Analysis and Review (RAR) phase during the BCM planning process. This includes understanding the types of cybersecurity threats and the affected assets.
This risk treatment strategy is extracted from a Verizon survey. It provides an overview of the risk treatment and controls for the specific threat, Conduit Devices.
It also provides an understanding of the cyber criminals' techniques utilized to exploit vulnerabilities within the organization that sabotaged the assets, affecting the smooth continuity of business functions.
Reference: Chapter 6 Risk Analysis and Review and Business Impact Analysis 6.9 Risk Treatment
[Moh Heng Goh](https://blog.bcm-institute.org/cyber-security/author/moh-heng-goh) Nov 9, 2022
Risk Treatment
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e64ba977-547d-499f-b858-4a8c8c920e71) | The risk treatment summarized by Verizon (2017) surveys for the following cybersecurity risk is as appended below: - The Human Element - Conduit Devices - Configuration Exploitation - Malicious Software | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/cd71d15d-de06-4ce1-af33-c05dc4501be2) |
| --- | --- | --- |
##### Threats Resulting from Conduit Devices
#### Risk Treatment Strategy for Conduit Devices
| **S/No** | **Threat Scenario** | **Risk Treatment** | Description of Risk Treatment/Control | |
| --- | --- | --- | --- | --- |
| **Accept (A)** | **Mitigate/ Reduce (MR)** | | | |
| **8** | **USB Infection** | ✓ | - | - Incident Response and Management. |
| - | ✓ | - Create an inventory of authorised and unauthorised devices. - Program secure configurations on hardware and software. - Maintain, monitor and analyse audit logs. - Monitor and control account usage. | | |
| **9** | **Peripheral Tampering** | - | ✓ | - Train and create awareness among the employees. - Conduct penetration tests and “Red Team” exercises. |
| **10** | **Rogue Connection** | - | ✓ | - Create an inventory of authorised and unauthorised software. - Program secure configurations for hardware and software. - Set up defences against malware. - Install boundary defences. |
| **11** | **Logic Switch** | - | ✓ | - Program secure configurations for hardware and software. - Install boundary defences. - Manage security levels of application software. |
| **12** | **C2 Takeover** | ✓ | - | - Incident Response and Management. |
| - | ✓ | - Program secure configurations for hardware and software. - Program secure configurations for network devices. - Install boundary defences. - Monitor and control account usage. | | |
| **13** | **Mobile Assault** | - | ✓ | - Create an inventory of authorised and unauthorised devices. - Program secure configurations for hardware and software. - Install controls to protect data. - Manage wireless access. - Train and create awareness among employees. |
| **14** | **IoT Calamity** | - | ✓ | - Create an inventory of authorised and unauthorised devices. - Program secure configurations for hardware and software. - Limit and control network ports, protocols and services. - Program secure configurations for network devices. - Install boundary defences. |
Risk Treatment Strategies for “Conduit Devices” Threats
##### CIR Risk Treatment Strategies
| Risk Treatment Strategy | The Human Element | Conduit Devices | Config-uration Exploitation | Malicious Software | Back To: Overview of RAR and BIA |
| --- | --- | --- | --- | --- | --- |
| ##### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e64ba977-547d-499f-b858-4a8c8c920e71) | ##### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c5878f05-0fb8-4493-97e4-cdb2a774052e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/540ef349-c2fa-4b52-8d3a-f5020126ec2c) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/bff792df-3a51-403e-b9b7-5f4851010c74) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/483ccb41-56a2-4a1e-bd10-4814c83cd5a6) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0ecb3f31-6e8c-41c8-920d-0d996a68eeec) |
---
#### 
#### Do You Want to Continue BCM Training onsite or online?
| **Competency-based Course** | **Certification Course** | | |
| --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/685c93a7-08d2-4175-bee7-71781494334e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/95fc21bd-88bf-43d8-9464-5b00190d76e0) | [![\[BL-3-Catalog\] What Specialist Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/4b22a53c-6e3e-4b9e-8c2a-888423f1d26c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b22a53c-6e3e-4b9e-8c2a-888423f1d26c) | [![\[BL-5-Catalog\] What Expert Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/fe175db3-7f57-4636-bf09-e9a836aa5478.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fe175db3-7f57-4636-bf09-e9a836aa5478) |
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/2a55f179-a251-4490-bd1c-856467aea198)
Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.
Reference: Chapter 6Risk Analysis and Review and Business Impact Analysis 6.9 Risk Treatment
Note: This version was the draft 2nd Edition being updated by 2023. The numeric in the square bracket \[X.X\] cross-refers to the actual chapter and section in the 1st Edition.
#### **Comments:**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/04334171-099a-49e5-becc-c8c082c7947f)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/cyber-security/author/moh-heng-goh"
},
"dateModified" : "2022-11-25T07:54:00.621Z",
"datePublished" : "2022-11-09T15:44:47.000Z",
"headline" : "CIR RAR-BIA Risk Treatment for Conduit Devices",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/cyber-security/cir-rar-bia-risk-treatment-for-conduit-devices",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```