Risk Management

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the fundamentals of risk management.
Differentiate between assets, threats, vulnerabilities and risks.
Understand the risk management lifecycle.
Perform a basic cloud risk assessment.
Understand risk treatment strategies.
Apply risk management principles to AWS environments.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Beginner

Prerequisites: Encryption Fundamentals

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Every business accepts some level of risk.

The goal of a Cloud Security Engineer is not to eliminate every risk—that would make systems unusable and extremely expensive.

Instead, the goal is to:

Identify risks.
Understand business impact.
Prioritise risks.
Implement appropriate security controls.
Reduce risk to an acceptable level.

Security is about making informed business decisions.

🌍 What is Risk Management?

Risk Management is the process of identifying, assessing, prioritising and reducing risks that could affect an organisation.

It helps organisations answer questions such as:

What could go wrong?
How likely is it?
What would the impact be?
How can we reduce the risk?
Is the remaining risk acceptable?

Every cloud project should include a risk assessment before deployment.

🔑 Key Terminology

Understanding risk management starts with a few important concepts.

Asset

An asset is anything valuable to the organisation.

Examples:

Customer data
AWS Account
EC2 Instances
Amazon S3 Buckets
Databases
IAM Users
Source Code
APIs
Encryption Keys

If losing it would harm the business, it is an asset.

Threat

A threat is anything that could exploit a weakness.

Examples:

Hacker
Insider
Malware
Ransomware
DDoS Attack
Phishing
Natural Disaster
Hardware Failure

Threats create the possibility of harm.

Vulnerability

A vulnerability is a weakness that could be exploited.

Examples:

Weak Password
Public S3 Bucket
Missing MFA
Unpatched Server
Open Security Group
Hardcoded API Keys
Misconfigured IAM Policy

Vulnerabilities increase the likelihood of a successful attack.

Risk

Risk is the possibility that a threat will exploit a vulnerability and impact an asset.

Simple formula:

Risk = Threat + Vulnerability + Asset

Example:

Asset:
Customer Database

Threat:
Cyber Criminal

Vulnerability:
Weak Password

Risk:
Customer data may be stolen.

📊 Risk Assessment Process

A typical risk assessment follows these steps:

Identify Assets
        │
        ▼
Identify Threats
        │
        ▼
Identify Vulnerabilities
        │
        ▼
Assess Likelihood
        │
        ▼
Assess Business Impact
        │
        ▼
Calculate Risk
        │
        ▼
Treat Risk
        │
        ▼
Monitor Risk

Risk management is a continuous process.

📈 Risk Matrix

Risk is commonly prioritised using Likelihood and Impact.

Likelihood	Impact	Risk Level
Low	Low	Low
Low	High	Medium
Medium	Medium	Medium
High	Medium	High
High	High	Critical

Critical risks should be addressed first.

🎯 Risk Treatment Strategies

After identifying a risk, organisations choose how to manage it.

1. Avoid

Eliminate the activity creating the risk.

Example:

Disable public access to an S3 bucket instead of exposing sensitive data.

2. Mitigate

Reduce the likelihood or impact.

Examples:

Enable MFA
Encrypt data
Configure Security Groups
Enable CloudTrail
Patch systems

Most cloud security work involves risk mitigation.

3. Transfer

Shift the financial impact to another party.

Examples:

Cyber Insurance
Managed Security Services
Cloud Service Agreements

Responsibility may be shared, but accountability remains with the organisation.

4. Accept

Accept the risk because it falls within the organisation’s risk appetite.

Example:

A low-impact development environment with limited business value.

Accepted risks should still be documented and reviewed regularly.

⚖️ Risk Appetite vs Risk Tolerance

Risk Appetite

The overall level of risk an organisation is willing to accept to achieve its objectives.

Example:

A startup may accept higher risks to release products quickly.

Risk Tolerance

The acceptable variation around a specific risk.

Example:

A business may tolerate a maximum of one hour of service disruption each month.

Cloud Security Engineers must understand both when recommending controls.

☁️ Cloud Risk Examples

Risk	Threat	Vulnerability	Business Impact
Public S3 Bucket	Internet Users	Misconfiguration	Data Breach
Weak IAM Policy	Insider	Excessive Permissions	Privilege Escalation
Missing MFA	Credential Theft	Weak Authentication	Account Compromise
Unpatched EC2	Malware	Outdated Software	System Compromise
Disabled CloudTrail	Insider	No Logging	Undetected Attack

🛡️ Risk Management in AWS

AWS provides services that help reduce cloud risk.

Examples:

AWS Service	Purpose
IAM	Identity Protection
AWS Config	Configuration Monitoring
CloudTrail	Audit Logging
GuardDuty	Threat Detection
Security Hub	Centralised Security Findings
Inspector	Vulnerability Assessment
AWS Backup	Data Recovery
KMS	Encryption
Shield	DDoS Protection
WAF	Web Application Protection

These services help reduce likelihood, impact, or both.

🏢 Enterprise Scenario

CloudNova Technologies

CloudNova Technologies plans to launch a new customer portal on AWS.

During a security review, the following issues are identified:

Root account does not use MFA.
Security Groups allow unrestricted SSH access.
Customer data is not encrypted.
CloudTrail logging is disabled.
EC2 instances are missing security patches.
Backups have never been tested.
API keys are stored in application source code.

As the Cloud Security Engineer:

Identify the assets.
Identify the threats.
Identify the vulnerabilities.
Assess the business impact.
Prioritise the risks.
Recommend appropriate mitigation strategies.

🧪 Hands-on Exercise 1 — Identify Assets

Objective:

Create an inventory of assets within a cloud environment.

Example assets:

AWS Account
IAM Users
EC2
S3
RDS
Lambda
Secrets
Logs

Questions:

Which assets are most valuable?
Which assets require the strongest protection?

🧪 Hands-on Exercise 2 — Perform a Risk Assessment

Complete the following table.

Asset	Threat	Vulnerability	Risk
S3 Bucket	Internet Users	Public Access	Data Exposure
EC2 Instance	Malware	Missing Patches	Server Compromise
IAM User	Phishing	No MFA	Account Takeover

Discuss:

Which risks should be prioritised?
Why?

🧪 Hands-on Exercise 3 — AWS Trusted Advisor

Navigate to:

AWS Console
↓
Trusted Advisor

Review categories:

Security
Cost Optimisation
Performance
Fault Tolerance
Service Limits

Questions:

Which recommendations relate to security?
Which findings reduce organisational risk?

Note: Some Trusted Advisor checks require a Business or Enterprise Support plan. If unavailable, review the service documentation and understand the types of recommendations it provides.

🧪 Hands-on Exercise 4 — Review AWS Config

Navigate to:

AWS Console
↓
AWS Config

Explore:

Configuration History
Compliance Rules
Resource Inventory

Questions:

Why is configuration monitoring important?
How could AWS Config reduce risk?

🧪 Hands-on Exercise 5 — Risk Prioritisation Workshop

Rank the following risks from highest to lowest priority.

Scenario	Priority
Root account without MFA
Public customer database
Disabled CloudTrail
Development server without patches
Public marketing website

Explain your reasoning.

📊 Knowledge Check

Answer the following questions:

What is risk management?
What is an asset?
What is a threat?
What is a vulnerability?
What is a risk?
What is the difference between likelihood and impact?
What are the four risk treatment strategies?
What is risk appetite?
What is risk tolerance?
Name five AWS services that help reduce cloud risk.

📝 Assignment

Prepare a Cloud Risk Assessment Report for CloudNova Technologies.

Include:

Asset Inventory.
Threat Analysis.
Vulnerability Assessment.
Risk Matrix.
Business Impact Analysis.
Risk Treatment Plan.
AWS services recommended for risk reduction.
Executive Summary for senior management.

Length: 3–4 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

Risk is the combination of assets, threats and vulnerabilities.
Risk management is an ongoing business process.
Security controls reduce risk rather than eliminate it.
Cloud Security Engineers prioritise risks based on likelihood and business impact.
AWS provides many services that help organisations identify, monitor and mitigate cloud risks.
Effective risk management supports business objectives while protecting critical assets.

📚 Further Reading

AWS Security Best Practices
AWS Well-Architected Framework – Security Pillar
AWS Risk and Compliance Documentation
NIST Risk Management Framework (RMF)
NIST SP 800-30 – Guide for Conducting Risk Assessments
ISO 31000 – Risk Management Guidelines

🚀 Next Lesson

➡️ Security Operations Overview