Risk Treatment
|
|
The risk treatment summarized by Verizon (2017) surveys for the following cybersecurity risk is as appended below:
- The Human Element
- Conduit Devices
- Configuration Exploitation
- Malicious Software
|
|
Threats Resulting from Conduit Devices
Risk Treatment Strategy for Conduit Devices
|
S/No
|
Threat Scenario
|
Risk Treatment
|
Description of Risk Treatment/Control
|
|
Accept (A)
|
Mitigate/ Reduce (MR)
|
|
8
|
USB Infection
|
✓
|
-
|
- Incident Response and Management.
|
|
-
|
✓
|
- Create an inventory of authorised and unauthorised devices.
- Program secure configurations on hardware and software.
- Maintain, monitor and analyse audit logs.
- Monitor and control account usage.
|
|
9
|
Peripheral Tampering
|
-
|
✓
|
- Train and create awareness among the employees.
- Conduct penetration tests and “Red Team” exercises.
|
|
10
|
Rogue Connection
|
-
|
✓
|
- Create an inventory of authorised and unauthorised software.
- Program secure configurations for hardware and software.
- Set up defences against malware.
- Install boundary defences.
|
|
11
|
Logic Switch
|
-
|
✓
|
- Program secure configurations for hardware and software.
- Install boundary defences.
- Manage security levels of application software.
|
|
12
|
C2 Takeover
|
✓
|
-
|
- Incident Response and Management.
|
|
-
|
✓
|
- Program secure configurations for hardware and software.
- Program secure configurations for network devices.
- Install boundary defences.
- Monitor and control account usage.
|
|
13
|
Mobile Assault
|
-
|
✓
|
- Create an inventory of authorised and unauthorised devices.
- Program secure configurations for hardware and software.
- Install controls to protect data.
- Manage wireless access.
- Train and create awareness among employees.
|
|
14
|
IoT Calamity
|
-
|
✓
|
- Create an inventory of authorised and unauthorised devices.
- Program secure configurations for hardware and software.
- Limit and control network ports, protocols and services.
- Program secure configurations for network devices.
- Install boundary defences.
|
Risk Treatment Strategies for “Conduit Devices” Threats
CIR Risk Treatment Strategies
|
Risk Treatment Strategy
|
The Human Element
|
Conduit Devices |
Config-uration Exploitation |
Malicious Software
|
Back To: Overview of RAR and BIA
|
|
|
|
|
|
|
Do You Want to Continue BCM Training onsite or online?
Competency-based Course
|
Certification Course |
|
|
|
|
|
Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.
Reference: Chapter 6Risk Analysis and Review and Business Impact Analysis 6.9 Risk Treatment
Note: This version was the draft 2nd Edition being updated by 2023. The numeric in the square bracket [X.X] cross-refers to the actual chapter and section in the 1st Edition.