Why Overthinking Risk Will Turn You into Stone – Source: securityboulevard.com

Risk is an enabler of Analysis Paralysis.

Organizations invest vast amounts of money, time, and human capital in identifying, analyzing, and reporting potential risks within their domain. While this exercise is often required for compliance and security mandates, this also leads to analysis and paralysis.

Risk exists no matter what an organization is involved in. From being in the cloud to moving to a third-world country to reduce, these decisions ultimately lead to either a profitable outcome or a complete disaster. Risk management helps find the balance between profitability and avoiding disaster.

The analysis behind that science could give you a total refresh. Recently, I was involved in a risk-based analysis project, and I can see the value in the various steps and data collection requirements. However, like anything in IT, it could be more straightforward and open to interpretation. That is a formula for paralysis.

I am huge fan of the NIST 800–53 Risk Management Framework, including its seven steps process:

• Prepare
• Categorize
• Select
• Implement
• Assess
• Authorize
• Monitor

The question here is, do we need all seven to have an effective Risk Management Framework? What steps could be consolidated or eliminated to help optimize the time, cost, and resources to develop a more agile and fluid risk framework? This framework would be ideal for a regulated industry, however for most unregulated industries, I would recommend:

• Preparation: The risk strategy should be incorporated already into the Security Operations and Incident response workflow.
• Select: If the organization already uses NIST-800–53, select the most appropriate adaptive controls to help protect the most critical resources.
• Implementation: Deploy all adaptive controls, including email security, MFA, Zero-trust, and XDR, to support the NIST-800–53 controls selected.
• Monitoring: Without monitoring, the organization will be at a higher level of risk.

These four categories can help any size organization. Prepare your strategy with the selected adaptive controls to protect the most critical assets with a solid implementation, security operations, and monitoring team, including an MSSP.

Most risk activities overlap existing IT and SecOps processes. Leveraging what already exists helps reduce the cost and complexity of managing risk.