Risk Treatment Strategies: Avoid, Mitigate, Transfer, Accept

#The Four Paths Every Risk Takes#link

After you’ve identified and evaluated risks, the next logical step is deciding what to do about them. Organisations have four classic treatment options: avoid, mitigate, transfer, and accept. Choosing the wrong one can be as damaging as ignoring the risk entirely—think of a hospital that ‘accepts’ ransomware risk without backups.

Risk Avoidance: Stop the Activity

Avoidance means abandoning the activity that generates the risk. For example, if processing credit card data in‑house creates PCI‑DSS compliance headaches, you might outsource payments entirely. It’s the only strategy that reduces risk to zero, but it often comes at a business cost—you lose the associated revenue or capability.

Mitigation: Reduce Likelihood or Impact

Mitigation (or reduction) is the most common strategy. You implement controls—like firewalls, MFA, or encryption—to lower the probability of a threat exploiting a vulnerability, or to limit the damage if it does. Mitigation never removes risk entirely, but it brings it within the organisation’s risk appetite.

# Example: Mitigating brute-force risk with fail2ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo tee -a /etc/fail2ban/jail.local << EOF
[sshd]
enabled = true
maxretry = 3
bantime = 3600
EOF

The fail2ban rule above reduces the likelihood of a successful SSH brute‑force from ‘almost certain’ to ‘very low’—a classic mitigation. However, it doesn’t eliminate the risk of zero‑day vulnerabilities in SSH itself.

Transfer: Share the Financial Burden

Risk transfer shifts the financial impact to a third party, usually via cyber insurance or contractual liability clauses. It doesn’t reduce the probability of an incident, but it caps your monetary loss. Be careful: insurers now demand basic security hygiene—without it, claims can be denied.

Acceptance: Conscious Risk‑Taking

When the cost of treatment outweighs the asset’s value or the risk falls within appetite, you accept it. Acceptance must be documented and reviewed regularly. A typical example: a small blog accepting the risk of being defaced because the cost of a WAF exceeds the site’s value.