Security risk management

The vocabulary

• Asset: something of value (data, a system, a service, reputation).
• Threat: something that can cause harm (an attacker, an error, a failure).
• Vulnerability: a weakness a threat can use.
• Risk: the chance and impact of a threat using a vulnerability against an asset. Often rated as likelihood times impact.
• Control: something that reduces likelihood or impact.
• Inherent risk is before controls, residual risk is what remains after them.

The cycle

• Establish context: what the business is trying to achieve and what it can tolerate (risk appetite).
• Identify risks: from threat modeling, assessments, incidents, audits, vendors and changes.
• Analyze and evaluate: rate likelihood and impact on a consistent scale, and rank.
• Treat: reduce (add controls), accept (with an owner and a date), transfer (insurance, contract) or avoid (stop the activity).
• Monitor and review: risks change; revisit them on a schedule and after major events.

A risk register entry

- id: R-014
  title: Customer data exposed through an API authorization flaw
  asset: customer-api
  threat: external attacker with a free account
  likelihood: 4          # 1 rare .. 5 almost certain
  impact: 5              # 1 minor .. 5 severe (regulatory, financial, trust)
  inherent_score: 20
  controls: [authorization tests in CI, WAF anomaly rules]
  residual_score: 10
  treatment: reduce
  actions:
    - { what: "central authorization layer", owner: platform-lead, due: 2027-01-31 }
  risk_owner: vp-engineering
  review_date: 2026-12-15

Doing it well

• Use one scale across the company so scores can be compared; explain what each level means in money, users or downtime.
• Quantify where you can: ranges of loss are more useful than a color, even if rough.
• Make acceptance explicit: a risk accepted by a named executive for a defined period is a decision; one nobody mentions is neglect.
• Keep the register short enough to act on, and tied to the work: each risk links to actions with owners.
• Connect it to reality: incidents, audit findings and threat intelligence should change scores.