Case Study: ISMS Risk Engine — ISO/IEC 27001 & 27005 Risk Automation

1. The Problem & GRC Context

Most automated security tools (Nmap, Nikto, basic scanners) output a long list of technical CVEs without business context. However, in enterprise Governance, Risk, and Compliance (GRC), a vulnerability is only as severe as the asset it threatens:

An exposed test server vulnerability has very low business impact.
The exact same vulnerability on an enterprise Customer Database (Criticality 5) threatens organizational survival and regulatory non-compliance.

This tool was developed to operationalize the ISO/IEC 27005 risk management framework into an automated Python engine, moving risk registers from static Excel sheets into structured, repeatable software pipelines.

2. Modular System Architecture

The platform is structured into clean, decoupled modules where technical discovery feeds into normalization and compliance mapping:

Figure 2.1: ISMS Risk Engine Modular Data Pipeline

3. Key Engineering Decisions

Decision 1: Quantitative ISO 27005 Risk Scoring Implementation

Problem Qualitative ratings (High/Medium/Low) are subjective and difficult to prioritize programmatically across hundreds of organizational assets.

Decision Implemented discrete 3-factor quantitative multiplication for Inherent Risk:
Inherent = Asset_Criticality (1-5) * Likelihood (1-5) * Severity (1-5), with Mitigation calculation: Residual = Inherent * (1 - Control_Effectiveness).

Trade-off Requires upfront definition of asset criticality in JSON, but produces consistent, mathematically verifiable risk rankings.

Decision 2: Automated Annex A Remediation Mapping

Problem Auditors need to know which ISO 27001 administrative controls fail when a technical finding is uncovered.

Decision Built a static JSON knowledge base mapping technical signatures (e.g. Missing HSTS, Open Port 21) to exact ISO 27001 Annex A clauses (e.g. A.14.1.2 Secure Engineering, A.13.1 Network Controls).

Trade-off Knowledge base requires periodic manual synchronization when ISO standards update, but delivers immediate audit-ready outputs.

4. Core Mathematical Scorer Implementation

ai_risk_engine/scorer.py

class ISMRiskScorer:
    """Calculates Inherent & Residual Risk scores aligned with ISO 27005."""
    
    @staticmethod
    def calculate_inherent_risk(asset_criticality: int, likelihood: int, severity: int) -> float:
        # Inherent Risk = Asset (1-5) * Likelihood (1-5) * Severity (1-5) [Range: 1 - 125]
        return float(asset_criticality * likelihood * severity)

    @staticmethod
    def calculate_residual_risk(inherent_score: float, control_effectiveness: float) -> float:
        # Residual Risk = Inherent Score * (1 - Control Effectiveness [0.0 - 1.0])
        mitigation_factor = max(0.0, min(1.0, 1.0 - control_effectiveness))
        return inherent_score * mitigation_factor

    @staticmethod
    def determine_treatment_strategy(residual_score: float) -> str:
        if residual_score <= 20:
            return "Accept (Tolerable under current ISO 27001 baseline)"
        elif residual_score <= 40:
            return "Mitigate (Implement secondary Annex A administrative controls)"
        else:
            return "Escalate / Avoid (Immediate executive intervention required)"

5. Verification & Defense Utility

The system was validated against a standardized test lab containing multiple simulated assets (Corporate Portal, Core Database, Staging API) and verified through automated test suites in verify_deployment.py.

Generated reports include complete audit metadata: scan timestamps, identified asset owners, raw network banner details, quantified scores, and recommended ISO 27001 Annex A treatment strategies.

What I Would Improve Next (Engineering Reflection)

Future iterations would benefit from supporting dynamic CVE feeds from the National Vulnerability Database (NVD API) with automatic CVSS 3.1 vector parsing, reducing reliance on the local JSON knowledge base.

Additionally, adding integration with Jira/ServiceNow webhooks would automatically convert identified high-residual risks into actionable remediation tickets for infrastructure teams.