1. Randy Marchany VA Tech Computing Center
NIPC: Risk Management
Randy Marchany
VA Tech Computing Center
Copyright 2003, Marchany

2. Introduction
Risk avoidance focuses on preventing loss or damage without reference to the degree of risk.
Risk Management is a systematic and analytical process by which an organization identifies, reduces and controls its potential risks and losses.
Copyright 2003, Marchany

3. Introduction
Risk is a function of assets, threats and vulnerabilities.
Risk is the potential for some unwanted event to occur.
Threat is the capability and intention of an adversary to undertake actions that are detrimental to an org’s interests.
Copyright 2003, Marchany

4. Introduction
Vulnerability is any weakness in an asset or countermeasures that can be exploited by an adversary to cause damage to an org’s interests.
Asset is anything of value
People, info, HW, SW, facilities, reputation, activities.
Copyright 2003, Marchany

5. 5 step Risk Assessment Model
Asset assessment
Threat assessment
Vulnerability assessment
Risk assessment
Countermeasure identification
Risk = consequence X threat X vulnerability
Copyright 2003, Marchany

6. Assessment, Threat Examples
Key personnel
File Servers
Customer data
Production facility
pipeline
Injury, death
DOS attack
Disclosure
Natural disaster
Sabotage
Copyright 2003, Marchany

7. Assessment, Vulnerability Examples
Key personnel
File Servers
Customer data
Production facility
pipeline
No access controls
Patch mgt
Unchecked 3rd party
Physical access
No roving guard force
Copyright 2003, Marchany

8. Reference
“Risk Management: An Essential Guide to Protecting Critical Assets”, NIPC, 11/2002
Copyright 2003, Marchany