Risk analysis per ISO 27005. Step by step, without the spreadsheet horror.
Let's dig into the foundation of all security. Risk analysis sounds intimidating; it comes down to three questions: what can happen, how badly would it hurt, and what do we do about it.
Classic situation: a company buys controls because “you should have them,” but nobody calculated the risk those controls are supposed to address. Wrong order. ISO 27005 is straightforward: understand the risk first, then select the response. Otherwise you are spending budget on locks on the windows while leaving the door open.
TL;DR
- ISO 27005 is the risk management methodology for information security (supports ISO 27001)
- Process: identification, analysis, evaluation, treatment, monitoring
- Risk = likelihood times impact, on information assets
- Four responses: reduce, transfer, avoid, accept. After controls, calculate residual risk
Step 1: identification
You start with information assets: data, systems, processes. For each one you document threats (what can happen) and vulnerabilities (how it can be exploited). Customer database leak through a vendor error, ransomware on a file server, unavailability of a key person. Specific, not generic.
Step 2: analysis
For each risk you estimate likelihood and impact. A 5x5 scale is enough for most organisations. The product gives you the inherent risk level; the level as if no safeguards existed at all. That is your starting point.
Step 3: evaluation
You compare the risk level against the risk appetite; the threshold management accepts. Everything above the threshold goes into treatment. This is the moment where risk stops being an abstraction and becomes a task list.
Step 4: treatment
Four options. Reduce (implement a control). Transfer (insurance, contractual clause). Avoid (discontinue the risky activity). Accept (consciously, with a rationale). After controls are applied you calculate residual risk; what is left.
Step 5: monitoring
Risk is not a photograph; it is a film. A new vendor, a new system, a new vulnerability changes the picture. KRI with thresholds watch for when risk is growing and alert you before it becomes a problem.
Where spreadsheets fail
A risk matrix in a workbook looks great on a slide and dies in practice. You implement a control, but the residual risk still shows the old score because nobody recalculated. Six months later nobody knows which risks are current.
In the Risk Engine risk calculates itself: assets, threats, vulnerabilities in catalogues, 5x5 scoring, and residual risk recalculates after controls from the ISMS are applied. Controls map to ISO 27001, and KRI thresholds fire as signals. Instead of a workbook that lies after a month, you have a picture that stays current. Sorted.
Written by someone on the RealSec team. Want to talk specifics ; get in touch.