Risk Treatment
 |
The risk treatment summarized by Verizon (2017) surveys for the following cybersecurity risk is as appended below:
- The Human Element
- Conduit Devices
- Configuration Exploitation
- Malicious Software
|
 |
Threats Resulting from Malicious Software
Risk Treatment Strategy for Malicious Software
|
S/No
|
Threat Scenario
|
Risk Treatment
|
Description of Risk Treatment/ Control
|
|
Accept (A)
|
Mitigate /Reduce (MR)
|
|
23
|
Data Ransomware/Crypto Malware
|
-
|
✓
|
- Control usage of administrative privileges.
- Maintain, monitor and analyse logs.
- Install protections for email and web browsers.
- Develop measures to ensure the organisation is capable of recovering its data.
- Install controls to protect data.
- Set up defences against malware.
|
|
24
|
Sophisticated Malware
|
-
|
✓
|
- Maintain, monitor and analyse logs.
- Set up defences against malware.
- Install boundary defences.
- Install controls to protect data.
- Develop measures to ensure the organisation is capable of recovering its data.
- Monitor and control account usage.
- Limit and control network ports, protocols and services.
|
|
25
|
RAM Scraping
|
✓
|
-
|
Incident Response and Management
|
|
-
|
✓
|
- Create an inventory of authorised and unauthorised software.
- Install protections for email and web browsers.
- Set up defences against malware.
- Install controls to protect data.
- Limit access control based on access requirements.
|
|
26
|
Credential Theft
|
-
|
✓
|
- Set up defences against malware.
- Monitor and control account usage.
|
|
27
|
Unknown Unknowns
|
-
|
✓
|
- Maintain, monitor and analyse logs.
- Set up defences against malware.
- Install boundary defences.
- Install controls to protect data.
- Monitor and control account usage.
|
Figure 6-12: Risk Treatment Strategies for “Malicious Software” Threats
CIR Risk Treatment Strategies
|
Risk Treatment Strategy
|
The Human Element
|
Conduit Devices |
Config-uration Exploitation |
Malicious Software
|
Back To: Overview of RAR and BIA
|
|
|
 |
 |
 |
 |
Do You Want to Continue BCM Training onsite or online?
Competency-based Course
|
Certification Course |
 |
 |
![[BL-3-Catalog] What Specialist Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/4b22a53c-6e3e-4b9e-8c2a-888423f1d26c.png) |
![[BL-5-Catalog] What Expert Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/fe175db3-7f57-4636-bf09-e9a836aa5478.png) |
Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.
Reference: Chapter 6Risk Analysis and Review and Business Impact Analysis 6.9 Risk Treatment
Note: This version was the draft 2nd Edition being updated by 2023. The numeric in the square bracket [X.X] cross-refers to the actual chapter and section in the 1st Edition.
