---
title: CIR RAR-BIA Risk Treatment for Malicious Software
description: "Risk Analysis and Review and Business Impact Analysis: Risk Treatment for Malicious Software"
---

[Cyber Security](https://blog.bcm-institute.org/cyber-security)

# [CIR RAR-BIA Risk Treatment for Malicious Software](https://blog.bcm-institute.org/cyber-security/cir-rar-bia-risk-treatment-for-malicious-software)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/cyber-security/author/moh-heng-goh) | Nov 9, 2022 3:41:36 PM

Risk Treatment

|  | The risk treatment summarized by Verizon (2017) surveys for the following cybersecurity risk is as appended below: - The Human Element - Conduit Devices - Configuration Exploitation - Malicious Software |  |
| --- | --- | --- |

##### Threats Resulting from Malicious Software

#### Risk Treatment Strategy for Malicious Software

 

| S/No | Threat Scenario | Risk Treatment | Description of Risk Treatment/ Control |  |
| --- | --- | --- | --- | --- |
| Accept (A) | Mitigate /Reduce (MR) |  |  |  |
| 23 | Data Ransomware/Crypto Malware | - | ✓ | - Control usage of administrative privileges. - Maintain, monitor and analyse logs. - Install protections for email and web browsers. - Develop measures to ensure the organisation is capable of recovering its data. - Install controls to protect data. - Set up defences against malware. |
| 24 | Sophisticated Malware | - | ✓ | - Maintain, monitor and analyse logs. - Set up defences against malware. - Install boundary defences. - Install controls to protect data. - Develop measures to ensure the organisation is capable of recovering its data. - Monitor and control account usage. - Limit and control network ports, protocols and services. |
| 25 | RAM Scraping | ✓ | - | Incident Response and Management |
| - | ✓ | - Create an inventory of authorised and unauthorised software. - Install protections for email and web browsers. - Set up defences against malware. - Install controls to protect data. - Limit access control based on access requirements. |  |  |
| 26 | Credential Theft | - | ✓ | - Set up defences against malware. - Monitor and control account usage. |
| 27 | Unknown Unknowns | - | ✓ | - Maintain, monitor and analyse logs. - Set up defences against malware. - Install boundary defences. - Install controls to protect data. - Monitor and control account usage. |

Figure 6-12: Risk Treatment Strategies for “Malicious Software” Threats

##### CIR Risk Treatment Strategies

| Risk Treatment Strategy | The Human Element  | Conduit Devices | Config-uration Exploitation | Malicious Software | Back To: Overview of RAR and BIA |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |

 

 

#### Do You Want to Continue BCM Training onsite or online?

| **Competency-based Course** | **Certification Course** |  |  |
| --- | --- | --- | --- |
|  |  |  |  |

Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.

Reference: Chapter 6Risk Analysis and Review and Business Impact Analysis 6.9 Risk Treatment

Note: This version was the draft 2nd Edition being updated by 2023. The numeric in the square bracket \[X.X\] cross-refers to the actual chapter and section in the 1st Edition.

 

[View full post](https://blog.bcm-institute.org/cyber-security/cir-rar-bia-risk-treatment-for-malicious-software)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2022-11-25T07:54:36.103Z",
  "datePublished" : "2022-11-09T15:41:36Z",
  "headline" : "CIR RAR-BIA Risk Treatment for Malicious Software",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/Manager%20Guide%20to%20BCM%20for%20Cyber%20Security%20Incidents/C6%20Risk%20Analysis%20and%20Review%20and%20Business%20Impact%20Analysis/C6%20Morepost/IC_CIR_Risk%20Treatment_Malicious%20Software.png",
    "width" : 400
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/cyber-security/cir-rar-bia-risk-treatment-for-malicious-software",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Cyber Security"
  }
}
```