Risk Management

• Compute and score risk with likelihood × impact
• Classify responses: mitigate, accept, transfer, avoid
• Run a basic risk register for a realistic system

• You can't fix every threat; risk scoring is how you decide which ones deserve budget.
• Auditors and boards communicate in risk language — an incident without a risk framing is hard to defend.
• Outsourcing/cloud transfers some risks forward to vendors — a business decision, not a technical one.
• Risk registers survive staff changes; tribal memory doesn't.

You don't insure every possession — you weigh how likely each loss is and how much it would hurt. The expensive-to-replace kings get insurance (transfer), the cheap-to-fix gets maintained (mitigate), and some small risks you live with (accept).

• Identify assets and threats (from threat modeling), then score likelihood (1-5) and impact (1-5).
• Risk score = likelihood × impact (commonly 1-25), or quantitative in dollars where data exists.
• Classify: above threshold → mitigate/transfer; below → accept with documentation; impossible → avoid.
• Assign an owner per risk and an expiry; re-review on a schedule and on major changes.
• Report the register to stakeholders in the impact/likelihood language they already use.

• A bank quantifies phishing loss at $2M/yr; MFA deployment reduces likelihood, moving the risk from red to yellow — budget justified.
• A company transfers liability to a cloud provider's SLAs for availability while retaining responsibility for their own IAM misconfig.
• A startup documents an accepted risk (cosmetic, low-likelihood vector) and re-reviews it quarterly.

• Score with defined criteria (what does 1 vs 5 likelihood mean?) so scores are consistent.
• Make every register entry actionable: owner, decision, review date, evidence.
• Liaison risk to business impact: a data leak = customer trust + regulatory, not just 'a CVSS score'.
• Re-audit on change: new features, new vendors, new compliance demands shift the matrix.
• Pair the register with threat-model findings so nothing lives in two places.

• Producing a register nobody reads — risk management is the decisions, not the doc.
• Accepting risks without an owner or date ('we'll revisit it') — 'accept' must be an active document.
• Confusing CVSS severity with business risk: a high-CVSS internal-only control may be lower risk.
• Ignoring third-party risk: your supply chain's likelihood is part of your register.

• When stakeholders argue about a risk, decompose it: which likelihood/impact disagreement is actually the dispute?
• When a risk 'keeps getting ignored', check whether the register has owners and dates; opinions without owners die.
• Re-risk on incidents: a realized risk's recorded score was probably understated — an actual breach recalibrates.

• Regulated industries turn 'acceptable risk' into auditable evidence — keep the register and decisions, not just scores.
• Risk is attacker-adaptive; as controls improve, attackers change tactics — the register must evolve with them.