Breaking the Risk Chain

Finding the solution to break the Risk chain

For Risk Mitigation the “Risk chain” needs to be broken in a cost-effective way. Risk chain components are required to be mapped with different Security layers i.e., Infrastructure, Equipment, Application, Processes, and Manpower to determine the optimal Security solution. Once a company starts mapping Security layers against Risk chain components, it will likely be possible to identify several measures that can be enhanced. It is important to involve Security as early in the planning process as possible. The best time to involve Security is in design phase where the 'Infrastructure', link (+) of 'asset', 'vulnerability' and 'weakness' can be broken or at least weaken.

Examples include :

While designing factory layout, keep separation between core operational area(s) and areas where external vehicles/personnel are required to come.

While designing the building Security, keep the visitor lobby outside core areas.

While laying hydrocarbon pipelines along the road, construct drains between roads and pipelines and/or keep low risk pipelines near the road.

Ensure adequate Standoff distance.

Implement a “Green belt” (an area void of other building and people) away from perimeter as a security buffer.

Plan Gates to include a screening point, a denial/rejection lane, adequate illumination.

There may be other additional examples and all are best implemented during the initial designing stage using the concept known as Crime Prevention Through Environmental Design (CPTED). In addition to minimizing risk(s) using intelligent CPTED design may also help reduce manpower for Security enforcement. The majority the Security measures are implemented in breaking the link (+) between Adversary and Weakness i.e. Access Control wherein Adversary is kept away from the vulnerable assets, whereas this is not the most cost-effective way of not designed properly. As shown below a simple matrix can help identify the most cost-effective way to properly design physical and technical security interfaces.

 

Implementation of Security measures' (layers) dependents upon balancing three parameters –

1. How much risk to mitigate? Or what is Organization’s Risk appetite? Please remember 100% Risk mitigation is not cost-effectively practical.
2. How much cost can be allocated to Security? Implementing cost-effective Security helps meets Management expectations to spend as little as necessary to achieve an acceptable residual level of Risk.
3. How much inconvenience to the user or customer is acceptable? How much will additional Security increase inconvenience?

Ideal Security provides an acceptable level of residual risk at lowest possible cost and minimum inconvenience to the users. The struggle for Security Manager is to find the optimum balance.

 

In next blog, each Security layer will be further examined and discussed in detail with implementation in isolation or in combination of multiple layers providing defense in depth.