Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > Anticipated Risk Response Needs

Anticipated Risk Response Needs

There is a great variation in the nature of potential threats facing organizations, ranging from
hackers attempting to merely deface organizational Web sites (e.g., cyber vandalism), to insider
30 Investment strategies can include organizational approaches to: (i) replacing legacy information systems (e.g.,
phasing items in gradually, replacing entirely); (ii) outsourcing and using external providers of information systems and
services; and (iii) internal development vs. acquisition of commercially available information technology products.
threats, to sophisticated terrorist groups/organized criminal enterprises seeking to exfiltrate
sensitive information, to a nation state's military attempting to destroy or disrupt critical missions
by attacking organizational information systems.31 The strategic investments required to address
the risk from more traditional adversaries (e.g., hackers conducting small-group activities with
limited capabilities) are considerably different than the investments required to address the risk
associated with advanced persistent threats consistent with more advanced adversaries (e.g.,
nation states or terrorist groups with highly sophisticated levels of expertise and resources that
seek to establish permanent footholds in organizations for purposes of impeding aspects of the
organizational missions). To address less sophisticated threats, organizations can focus their
efforts at Tier 3-investing to ensure that needed safeguards and countermeasures (e.g., security
controls, security services, and technologies) are obtained, implemented correctly, operating as
intended, and producing the desired effect with regard to meeting information security policies
and addressing known vulnerabilities. In addition to these basic investments, organizations can
also invest in continuous monitoring processes to ensure that the acquired security controls,
services, and technologies are operating effectively throughout the system development life cycle.
When organizations need to address advanced persistent threats, it is likely that adequately
addressing related risks at Tier 3 is not feasible because necessary security solutions are not
currently available in the commercial marketplace. In those instances, organizations must
purposefully invest beyond Tier 3 for significant response capabilities at Tier 2, and to some
extent at Tier 1. At Tier 3, the nature of investment is likely to change from implementation of
existing solutions to an added strategic focus on investing in leading-edge information security
technologies (essentially experimenting with innovative security solutions/technologies and being
an early adopter) or investing in information security research and development efforts to address
specific technology gaps.32 Information security investments to address advanced persistent
threats may require expenditures over the course of several years, as new security solutions and
technologies transition from research to development to full deployment. The long-term view of
strategic investing in the risk response needs for organizations can help to reduce the continuing
focus on near-term vulnerabilities discovered in information systems-vulnerabilities that exist
due to the complexity of the information technology products and systems and the inherent
weaknesses in those products and systems.