What are the differences between "identifying threats and vulnerabilities" and "risk management"?

Question

I am struggling to appreciate the differences between the 7 steps of the NIST Framework for Improving Critical Infrastructure, which should help an organisation implement it.

Step 1: Prioritize and Scope. The organization identifies its business/mission objectives and high-level organizational priorities. With this information, the organization makes strategic decisions regarding cybersecurity implementations and determines the scope of systems and assets that support the selected business line or process. The Framework can be adapted to support the different business lines or processes within an organization, which may have different business needs and associated risk tolerance. Risk tolerances may be reflected in a target Implementation Tier.

Step 2: Orient. Once the scope of the cybersecurity program has been determined for the business line or process, the organization identifies related systems and assets, regulatory requirements, and overall risk approach. The organization then consults sources to identify threats and vulnerabilities applicable to those systems and assets.

Step 4: Conduct a Risk Assessment. This assessment could be guided by the organization’s overall risk management process or previous risk assessment activities. The organization analyzes the operational environment in order to discern the likelihood of a cybersecurity event and the impact that the event could have on the organization. It is important that organizations identify emerging risks and use cyber threat information from internal and external sources to gain a better understanding of the likelihood and impact of cybersecurity events

In particular, I am having a tough time distinguishing between steps 2 and 4. Step 2 includes the statement 'The organization then consults sources to identify threats and vulnerabilities applicable to those systems and assets', however, this feels like it should be part of step 4 ' Conduct a risk assessment'

Answer 1

You've made a common mistake in risk management: threats and vulnerabilities are not risks.

The common (and debated) risk calculations are expressed as some form of:

Risk = likelihood x impact
Risk = (threat / vulnerability) x possibility of occurrence x impact
Risk = Threat capability x Vulnerability x consequence

Risk includes a consequence and a likelihood for that consequence to materialise.

So, the steps are in the correct order: identify threats and vulnerabilities (Orient), then determine the likelihood and impact of those threats acting against those vulnerabilities (Risk Assessment).

---

There's a hidden meaning in the wording in that list. "Orient" is a subtle reference to the OODA Loop. The OODA Loop is not often overtly referenced in risk management because, I think, it would be too difficult to explain while also trying to explain risk.

However, anyone dealing with risk is well-served to get to know OODA on a deep level. Once you understand OODA, then the NIST steps make so much more sense.

Answer 2

Part of the problem is a grammatical problem in the sections you quote - step 1 describes an activity, Step 4 doesn't. That makes it difficult to distinguish.

The organization identifies its business/mission objectives and high-level organizational priorities.

What are you protecting? If you protect everything, you protect nothing. Identify the critical information and services (where interruption would imperil the organization) and those which are less critical. For example, most organizations could accept a 1 week disruption of HR processes, but a serious compromise of customer data could imperil the organization within 24 hours. Losing the archive of past safety inspections would require the organization to re-enter or recreate the data, but if the critical intellectual property were disclosed, there is no recovery.

I don't think the quotes you provide really helps to understand the process.

Let's rephrase and simplify.

1. What am I protecting? What can I not afford to lose? To use a coarse analogy, if I lose a finger or toe, my life is still viable, but if I lose my heart or brain, I have no options. What are your organization's heart and brain? What are your toes & fingers? What about things like skin or liver that can regenerate. Another way to look at this is what do I really need?

2. What threatens it? What are the realistic threats. If you skip over this step, you find yourself devising strategies to prevent Godzilla attacks and Hurricanes in Switzerland/Sahara. This is a mirror image of #1 - Who are the competitors who want/need things that you want/need? Where are you involved in a zero or negative sum game? While this can include natural threats (hurricane, electrical outage, pandemic) I find that those tend to distract. Simplistically you can just identify points of conflict -but if you want to do this right, you need to understand your adversary's motivations, capabilities and opportunity.

3. What are you going to do about it. You've got to break this down a bit

3a) Where is my adversary most likely to take action against me? Where am I most likely to encounter the potential for harm. For most natural hazards this isn't really relevant; you can't take meaningful action to avoid a pandemic or an earthquake. Natural disasters will happen. But for adversarial actions, you can predict. If my adversary and I are competing for customers, you can figure out how your adversary is likely to leverage their advantages and your disadvantages. If you are working in IT, you can look at the technologies you use. If you're using 10+ year old technology, the adversary is more likely to attack that than new, up to date technology. Take a look at your technical debt. Take a look at your external attack surface. Take a look at your adversary and think about how you would struggle against them. Assume they're doing this to you. (this is likelihood/probability side of the risk equation)

3b) What kind of damage can my adversary inflict? Take the critical assets you identified in step 1 and assume for the purpose of argument that your adversary has already succeeded in damaging these.

• What if they disclosed your intellectual secrets (confidentiality failure)? Alternatively consider the services you provide your customers... what if your adversary could use your infrastructure to provide their customers the service. Fantastic cost savings for them, and higher cost for you?
• What if they degraded your information (integrity failure)? What if you knew your databases had a 50% error rate? If there is > 10% error, everyone will mistrust your data, including your customers and your own staff. If your adversary knows which data is in error and you don't, that is a huge competitive advantage.
• What if they denied service? (Degredation of availability) What if your adversary can take you off line or even more powerful, control when you are online and offline?

You'll need to devise strategies & mitigation plans for every intersection of asset and threat.

The critical answer to your question is that you can't do #3 unless you've identified your assets (#1) and your adversaries (#2). (I guess you can do it, but the results will be muddy, imprecise, unfocused and less useful.) If you don't know what your assets are, you need to protect everything equally; given that you probably don't have the budget to control risk on your critical assets, if you try to protect non-critical assets, you'll go broke. If you don't understand your adversaries, you're going to be in the same situation.