Pro Tip: Core Workflow Triage Process

Introduction

This DecipherRisk™️ Pro Tip article provides expert guidance, with examples, on how to prioritize (Triage) risk issues in the system.  

DecipherRisk™️ Core Workflow

Triage Process Guidelines

The primary purpose of the Triage process, is to conduct a cursory analysis of the Issue in order to assign Severity and Priority, and identify who the parties are that are responsible for taking further actions on the Issue (ACT process).

The fields edited during the TRIAGE process include

1. Description
2. Assumptions
3. Priority
4. Severity
5. Requires Risk Analysis
6. Requires Action Plan
7. Notes

Impact Analysis Questions

The following questions can be used to help determine the Issue Severity.

1. What is the business impact of addressing/not addressing the Issue?
2. Who is impacted/affected by it?
3. Why is it important to the organization?

Roles and Responsibilities 

Create a RASCI table with Roles (Responsible, Accountable, Support, Informed, Consulted) and Stakeholders.

Example: Issue record at TRIAGE process.

Title: Firewall Critical Vulnerabilities 

Status: IN-TRIAGE

Reported by: HealthGuard

Reported on: 5/6/22

Source: 2022 HIPAA Risk Assessment

Description: 

Internet firewalls have multiple remotely exploitable vulnerabilities.

Business Impact

The business impact of Internet Security breaches: Remotely exploitable vulnerabilities in firewalls can be exploited by attackers to gain unauthorized access to the organization's network and systems. This can lead to data theft, data manipulation, and other forms of cyber attacks. The impact of a security breach can be devastating, leading to financial losses, reputational damage, and legal liabilities.

Downtime: If a firewall is compromised, it may need to be taken offline for investigation and remediation. This can lead to downtime for the organization's network and systems, which can impact productivity and revenue.

Compliance violations: Organizations that are subject to regulatory compliance, such as HIPAA, may face penalties and fines if they fail to protect their networks adequately. Remotely exploitable vulnerabilities in firewalls can be seen as a violation of compliance requirements and may trigger an audit or investigation.

Increased costs: Organizations may need to invest in additional security measures or upgrade their existing firewalls to address the vulnerabilities. This can result in increased costs for the organization, which may impact its profitability.

Damage to brand reputation: A security breach or other cybersecurity incident can damage an organization's brand reputation. This can lead to loss of trust among customers, partners, and investors, which can have long-term impacts on the organization's business.

Roles and Responsibilities

Owner: Tom Thumb

Priority: High

Severity: Critical

Risk Analysis is required: no

Action Plan is required: yes

Review Date: 

Notes: 

Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders

Informative References

CIS CSC 4 

COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02 

ISA 62443-2-1:2009 4.3.4.2 

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2 

NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9

Assumptions:

The rationale for the assigned Severity level:

• Impact: Is there reason to believe this issue could lead to significant human harm or financial loss? Yes
• Impact: Is there reason to believe this issue could significantly impact operations or affect our ability to execute our mission or achieve business objectives? Yes
• Impact: Is there reason to believe this issue can impact our accreditation or compliance with federal/state laws? Yes
• Urgency: Is there reason to believe this issue could result in significant loss/harm in the next 12 - 24 months? Yes

It's determined that this Issue is CRITICAL and requires immediate attention.