Network Security Risk Management คืออะไร?
กระบวนการ ระบุ (Identify), ประเมิน (Assess), จัดการ (Treat), และติดตาม (Monitor) ความเสี่ยงด้านความปลอดภัยเครือข่าย เพื่อลดผลกระทบต่อธุรกิจให้อยู่ในระดับที่ยอมรับได้ (Risk Appetite)
Framework มาตรฐาน: NIST RMF (Risk Management Framework) / ISO 27005
- Frame (ระบุบริบท): Scope, Asset Inventory, Risk Appetite, Regulatory Requirements
- Assess (ประเมิน): Threat Modeling, Vulnerability Scanning, Likelihood × Impact = Risk Score
- Respond (ตอบสนอง): Mitigate, Transfer, Accept, Avoid — เลือก Controls
- Monitor (ติดตาม): Continuous Monitoring, KRI/KPI, Threat Intel, Re-assess
ขั้นตอนปฏิบัติจริง (Practical Steps)
1. Asset Inventory & Classification (รู้ว่ามีอะไรบ้าง)
- Network Devices (Firewall, Switch, Router, AP, Load Balancer, Proxy)
- Servers (On-prem, Cloud, VM, Container)
- Endpoints (Laptop, Mobile, IoT, OT/ICS)
- Data Flows (Crown Jewels: PII, Financial, IP, Source Code)
- Tools: Nmap, Masscan, RunZero, Asset Panda, CMDB (ServiceNow, Jira Assets)
2. Threat Modeling (ใครจะโจมตี? ทำอย่างไร?)
- STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege
- MITRE ATT&CK: Map Techniques → Network (T1046, T1018, T1021, T1570, T1048)
- Attack Surface Analysis: Internet-facing, VPN, RDP, SMB, DNS, Email, Supply Chain
3. Vulnerability Assessment (หาช่องโหว่)
- Network Vulnerability Scan: Tenable.io, Qualys VMDR, Rapid7 InsightVM, OpenVAS/Greenbone — Internal + External
- Config Audit: CIS Benchmarks (Firewall, Switch, Router, OS, K8s, Cloud)
- Penetration Testing: Annual + After Major Changes (Internal, External, Wireless, Cloud)
- Breach & Attack Simulation (BAS): Cymulate, AttackIQ, SafeBreach — Continuous
4. Risk Scoring & Prioritization (ตัดสินใจลำดับความสำคัญ)
- CVSS Base Score + Exploitability (EPSS) + Asset Criticality + Threat Intel (KEV, CISA) = Risk Score
- Framework: FAIR (Factor Analysis of Information Risk) — Quantify в $ (Loss Event Frequency × Loss Magnitude)
- Output: Risk Register (Risk ID, Description, Score, Owner, Treatment Plan, Target Date, Status)
5. Risk Treatment (4 ตัวเลือก)
| Strategy | คำอธิบาย | ตัวอย่าง Network Security |
|---|---|---|
| Mitigate (ลด) | ลด Likelihood หรือ Impact | Patch, Hardening, Segmentation, MFA, IPS, WAF, DLP, Encryption |
| Transfer (โอน) | โอน Risk ให้ฝ่ายอื่น | Cyber Insurance, Managed Security Services (MSSP), Cloud Shared Responsibility |
| Accept (ยอมรับ) | Risk ต่ำ / Cost Mitigate > Impact | Legacy System ที่จะ Decommission, Low-value IoT |
| Avoid (หลีกเลี่ยง) | หยุดกิจกรรมที่ก่อให้เกิด Risk | ปิด Service เก่า, Block High-risk Countries, ไม่ใช้ Tech ที่ End-of-Life |
6. Controls Implementation (Technical + Administrative)
- Preventive: Firewall Rules, NAC, MFA, Hardening, Code Signing
- Detective: SIEM Correlation, NDR, EDR, FIM, Honeytokens
- Corrective: IR Playbooks, Automated Containment (SOAR), Patch Deployment
- Administrative: Policies, Training, Background Checks, Vendor Contracts, Insurance
7. Continuous Monitoring & Reporting
- KRI (Key Risk Indicators): Unpatched Critical Vulns > 30 days, Open Ports Internet-facing, Failed MFA Attempts, DLP Alerts
- KPI (Key Performance Indicators): MTTD, MTTR, Patch Compliance %, Phishing Click Rate, Asset Coverage %
- Dashboard: Executive (Risk Posture), Operational (Vuln Backlog, Alert Volume), Technical (CVE Trending)
- Board Reporting: Quarterly — Top Risks, Incidents, Investments, Maturity (NIST CSF / CMMI)
Network Security Risk Scenarios & Treatments
| Risk Scenario | Likelihood | Impact | Treatment |
|---|---|---|---|
| Ransomware via Phishing → Lateral Movement → Encrypt File Shares | High | Critical | MFA, Network Segmentation, EDR, Immutable Backups, IR Playbook, Training |
| Internet-facing VPN Vulnerability (CVE) → Initial Access | Medium | High | Patch SLA 48h, MFA, ZTNA Replace VPN, WAF/IPS Virtual Patching |
| Insider Data Exfiltration (Cloud Storage, USB, Email) | Low | Critical | DLP, UEBA, Egress Filtering, Data Classification, Privileged Access Monitoring |
| DDoS Attack → Service Unavailable | Medium | High | Cloud DDoS Protection (Always-on), Rate Limiting, Anycast, CDN |
| Supply Chain Compromise (Software Update, Vendor Access) | Low | Critical | Zero Trust Vendor Access, SBOM, SCA, Code Signing Verification, Network Egress Control |
Tools สำหรับ Network Security Risk Management
- GRC Platforms: ServiceNow GRC, RSA Archer, MetricStream, LogicGate, StandardFusion
- Vuln Mgmt: Tenable, Qualys, Rapid7, Kenna (Risk-based), Nucleus
- Attack Surface Management: Randori, CyCognito, Hadrian, Assetnote
- BAS: Cymulate, AttackIQ, SafeBreach, XM Cyber
- Threat Intel: MISP, Anomali, Recorded Future, Mandiant, Palo Alto AutoFocus
- FAIR Quantification: RiskLens, FAIR-U (Open Source)
สรุป
Network Security Risk Management ไม่ใช่ "Scan แล้ว Patch" — เป็น Continuous Lifecycle ที่ผูกมัดกับ Business Objectives:
- Identify Crown Jewels & Attack Surface
- Quantify Risk (FAIR / CVSS+EPSS+Context)
- Prioritize Treatment (Mitigate/Transfer/Accept/Avoid)
- Implement Layered Controls (Network + Endpoint + App + Identity + Data)
- Measure, Report, Improve — ทุกวัน ทุกสัปดาห์ ทุกไตรมาส
Risk ที่ไม่ได้วัด = Risk ที่ไม่ได้จัดการ — เริ่มจาก Asset Inventory และ Risk Appetite Statement วันนี้
