Risk Management

🔑 Key takeaway: Risk management transforms threat information into actionable priorities. It helps you determine which threats matter most, where to allocate resources, and how to make security trade-offs that align with business goals.

Effective risk management builds upon threat modeling to assess, prioritize, and mitigate identified security risks. While threat modeling identifies what needs protection and potential attack vectors, risk management determines which threats warrant immediate attention and resources.

Risk Assessment Process

🔗 Related Framework: This process builds directly on outputs from Threat Modeling.

Key Components

1. Impact Analysis: Estimating the potential consequences of a security incident
2. Likelihood Determination: Assessing the probability of a threat exploiting a vulnerability
3. Risk Calculation: Combining impact and likelihood to determine risk levels
4. Risk Prioritization: Determining which risks to address first

Implementation Steps

1. For each threat scenario identified in threat modeling, assign impact ratings based on financial, operational, and reputational factors
2. Determine likelihood based on threat intelligence and historical data
3. Calculate risk scores (typically Risk = Impact × Likelihood)
4. Prioritize risks based on scores and organizational context

Prioritization Methodology

Not all risks require the same level of attention. Prioritize based on:

Trade-off Analysis

Security decisions often involve trade-offs between security, usability, cost, and other factors. Trade-off analysis helps make informed decisions.

Key Considerations

Decision-Making Framework

1. Define: Clearly articulate the security challenge and objectives
2. Identify: Enumerate all viable options
3. Analyze: Evaluate each option against established criteria
4. Select: Choose the option that best balances competing priorities
5. Implement: Execute the chosen option
6. Review: Assess the effectiveness of the decision and adjust as needed

Web3-Specific Considerations

In Web3 environments, risk management must address unique challenges:

Unique Risk Factors

Best Practices for Web3 Organizations

⬇️ Collapsable Example: Risk Assessment for Pinnipeds Inc.

Pinnipeds Inc. Risk Assessment

Building on the threat vectors identified during threat modeling, Pinnipeds Inc. conducted a risk assessment:

Risk Calculation Methodology

Rating	Impact	Likelihood
1	Minimal	Rare
2	Minor	Unlikely
3	Moderate	Possible
4	Major	Likely
5	Severe	Almost Certain

Formula: Risk Score = Impact × Likelihood

High Risk Threats (Score 15-25)

Threat Scenario	Likelihood	Impact	Risk Score	Reasoning
Treasury wallet compromise	4	5	20	High impact due to direct financial loss; relatively high likelihood given frequency of attacks on crypto companies
Source code theft	3	5	15	High impact due to IP loss and potential backdoor insertion; medium likelihood based on industry intelligence
Phishing of employees	5	3	15	Medium impact as most employees have limited access; very high likelihood based on attack trends

Medium Risk Threats (Score 8-14)

Threat Scenario	Likelihood	Impact	Risk Score	Reasoning
Client data breach	3	4	12	Major impact to reputation; moderate likelihood based on API exposure
DDoS on infrastructure	4	3	12	Moderate impact on operations; likely to occur given industry trends
AWS credentials leaked	2	5	10	Severe impact if exploited; unlikely due to current controls

Mitigation Decision Process

Factor	Approach
Resource allocation	60% of security budget allocated to high-risk threats
Implementation timeline	High-risk mitigations scheduled for completion within 30 days
Control selection criteria	Controls evaluated based on cost, operational impact, effectiveness, and implementation time

This risk-based approach allowed Pinnipeds Inc. to make informed decisions about which security controls to implement first, focusing resources where they would have the greatest risk-reduction impact.

Further Reading & Tools

• NIST Risk Management Framework
• ISO 31000:2018 Risk Management Guidelines
• FAIR (Factor Analysis of Information Risk) Framework
• OWASP Risk Rating Methodology
• Tools: Eramba (open source GRC)