How to Install a Certificate in Microsoft IIS 8

 

SSL Installation Instructions (single name certificate)

The following instructions will guide you through the SSL installation process on Microsoft IIS 8 using a SSL certificate that only secures one domain name. If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our CSR Generation Instructions and disregard the steps below.

1. Make sure you have all the following files saved before proceeding:
   • Your Server Certificate - This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order.
   • Intermediate Certificates - These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate.
   • Your Private Key - This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it.
2. Click Start, Control Panel, System and Security, Administrative Tools, and then select Internet Information Services (IIS) Manager.
3. In the left Connections menu, select the server name (host) where you want to install the SSL certificate.
   
   
   

4. In the center menu, click the Server Certificates icon under the Security section near the bottom.
   
   
   

5. In the right Actions menu, click Complete Certificate Request...

6. 

7. In the Complete Certificate Request wizard, click " ..." to browse and select Your Server Certificate file that was previously saved on your server's desktop.
8. Enter a Friendly Name, which is an internal reference name to distinguish the file later. We recommend including the CAs name and expiration date.
9. Select Personal as your certificate store for the new certificate.

   

10. Click OK and the newly installed certificate should appear in the refreshed Server Certificate List.
11. Now, proceed with the remaining steps which will help you assign or bind the SSL certificate to the appropriate website.
12. From the left Connections menu, expand your server's name, expand the Sites folder, and then select the site (e.g. Default Web Site) that you want to secure.
13. In the right Actions menu, click Bindings...
    

14. In Site Bindings..., click Add.
    

    Note: If you already have the appropriate site binding created, click "Edit" and change the SSL certificate accordingly.

15. In Add Site Binding, enter the following information:
    • Type - Select "https."
    • IP Address - Select "All unassigned." Now, if you have multiple IP address, select the correct one that applies.
    • Port - Enter "443" unless you are listening to SSL traffic on another port (e.g. 992).
    • SSL Certificates - Select the "friendly name" of the SSL certificate you just installed. You can always click "View" to confirm the certificates validity details.

16. 

17. Click Ok to finish binding the SSL certificate to your live website.

Congratulations! You've successfully installed your SSL certificate! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.

To check your server's configurations more thoroughly, use our SSL Checker Tool or contact our Customer Experience Department for additional assistance.

SSL Installation Instructions (multiple certificates using SNI)

The following instructions will guide you through the SSL installation process on Microsoft IIS 8 with multiple SSL certificate securing one or more domain names using Server Name Indication (SNI). If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our CSR Generation Instructions and disregard the steps below.

1. Make sure you have all the following files saved before proceeding:
   • Your Server Certificate -  This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order.
   • Intermediate Certificates - These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate.
   • Your Private Key - This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it.
2. Click Start, Control Panel, System and Security, Administrative Tools, and then select Internet Information Services (IIS) Manager.
3. In the left Connections menu, select the server name (host) where you want to install the SSL certificate.

4. 

5. In the center menu, click the Server Certificates icon under the Security section near the bottom.
   

6. In the right Actions menu, click Complete Certificate Request...
   

7. In the Complete Certificate Request wizard, click " ..." to browse and select Your Server Certificate file that was previously saved on your server's desktop.
8. Enter a Friendly Name, which is an internal reference name to distinguish the file later. We recommend including the CAs name and expiration date.
9. Select Web Hosting as your certificate store for the new certificate.

   

10. Click Ok and the newly installed certificate should appear in the refreshed Server Certificate List.

    Note: If you receive an error during this step, please reference the "Known Error Message in IIS 8" section below.

11. Now, proceed with the remaining steps which will help you assign or bind the SSL certificate to the appropriate website.
12. From the left Connections menu, expand your server's name, expand the Sites folder, and then select the site (e.g. Default Web Site) that you want to secure.
13. In the right Actions menu, click Bindings...
    

14. In Site Bindings..., click Add.

15. 

    Note: If you already have the appropriate site binding created, click "Edit" and change the SSL certificate accordingly.

16. In Add Site Binding, enter the following information:
    • Type - Select "https."
    • IP Address - Select "All unassigned." Now, if you have multiple IP address, select the correct one that applies.
    • Port - Enter "443" unless you are listening to SSL traffic on another port (e.g. 992).
    • SSL Certificates - Select the "friendly name" of the SSL certificate you just installed. You can always click "View" to confirm the certificates validity details.

      

17. Click OK to finish binding the first SSL certificate to your live website.
18. Now, repeat the process to make another Certificate Signing Request in Microsoft IIS 8 for the 2nd website.
19. Install the new SSL certificate referencing the above instructions, up through step 13.
20. In Add Site Bindings, enter the following information:
    • Type - Select "https."
    • IP Address - Select "All unassigned." Now, if you have multiple IP addresses, select the correct one that applies.
    • Port - Enter "443" unless you are listening to SSL traffic on another port (e.g. 992).
    • Host Name - Enter the "host name" or 'domain name' that you are securing and check the box for Require Server Name Indication. This box will be required for all additional sites that you secure on this server (other than the primary host name specified in step 14).

21. 

22. Click OK to finish binding the 2nd SSL certificate to your live website.
23. Repeat steps 16 through 19 to secure any additional host names using SNI.

Congratulations! You've successfully installed your SSL certificate(s)! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.

To check your server's configurations more thoroughly, use our SSL Checker Tool or contact our Customer Experience Department for additional assistance.

Known Error Messages in IIS 8

Microsoft IIS 8 is known to generate error message: "Failed to remove the certificate."

Here's our solution:

If you are certain this is the same server where you generated the CSR, then the error may be meaningless and the certificate may have correctly installed. To test this, close the dialog and click "F5" to refresh the list of server certificates. The new certificate should now be in the list, and you can continue with your next step.

However, if the newly installed certificate does not appear in the server certificate list, we recommend you re-issue the certificate with a new CSR and attempt the installation process again. Here are some instructions to guide you through the reissuance process:

1. Generate a new Certificate Signing Request (CSR) in Microsoft IIS 8.
2. Log in to your Account Control Panel.
3. Select your Active Certificate.
4. Click the Re-Issue Certificate button.
5. Paste in your new CSR.
6. Submit and complete domain validation again (if required).
7. Save the newly issued SSL certificate on your server's desktop.
8. Repeat the SSL installation process referencing the above instructions.

How to Generate a CSR in Microsoft IIS 8

 

CSR Generation Instructions

The following instructions will guide you through the CSR generation process on Microsoft IIS 8. To learn more about CSRs and the importance of your private key, reference our Overview of Certificate Signing Request article. If you already generated the CSR and received your trusted SSL certificate, reference our SSL Installation Instructions and disregard the steps below.

1. Click Start, Control Panel, System and Security, Administrative Tools, and then select Internet Information Services (IIS) Manager.
2. In the left Connections menu, select the server name (host) where you want to generate the request.

   
   

3. In the center menu, click the Server Certificates icon under the Security section near the bottom.

   
   

   

4. In the right Actions menu, click Create Certificate Request.

   

5. In the Distinguished Name Properties window, enter in the required CSR details and then click Next.

   
   

   
   Note: To avoid common mistakes when filling out your CSR details, reference our Overview of Certificate Signing Request article.

6. In the Cryptographic Service Provider Properties window, select Microsoft RSA SChannel Cryptographic Provider and Bit Length of 2048, then click Next.
   

   Note: Bit Length: 2048 is the current industry standard. You may choose a larger key size, but only if you have a requirement to do so, as longer key lengths increase latency and may reduce compatibility.

7. Click Browse to specify the location where you want to save the CSR as a ".txt" file and click Finish.
   
   
8. Locate and open the newly created CSR from the specified location you choose in a text editor such as Notepad and copy all the text including:

   -----BEGIN CERTIFICATE REQUEST-----
   And
   -----END CERTIFICATE REQUEST-----

   

9. Return to the Generation Form on our website and paste the entire CSR into the blank text box and continue with completing the generation process.

Outlook blocks opening FQDN and IP address hyperlinks after installing protections for Microsoft Outlook Security Feature Bypass Vulnerability released July 11, 2023

 ISSUE

When you click on links in emails in Outlook Desktop where the path is to a fully qualified domain name (FQDN) or IP address you may see the following:

• An Outlook warning dialog with the error “Something unexpected went wrong with this URL”

  

• Silent failure for the untrusted file.

When you open links in emails in Outlook Desktop where the path is to either FQDN or IP address or hostname path you will see this dialog. This is also expected. 

If you need to disable this dialog, follow the instructions in the article Enable or disable hyperlink warning messages in Office programs.

HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security
DWORD: DisableHyperlinkWarning
Value: 1

This issue happens after installing the Outlook Desktop July 11th security updates. For additional information see the respective CVEs below.

MSRC CVE-2023-33151: Microsoft Outlook Spoofing Vulnerability

MSRC CVE-2023-35311: Microsoft Outlook Security Feature Bypass Vulnerability 

KB 5002427: Description of the security update for Outlook 2016: July 11, 2023 (KB5002427)

KB 5002432: Description of the security update for Outlook 2013: July 11, 2023 (KB5002432) 

STATUS: RESOLUTION

Warning: This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. Make sure the FQDN or IP address you add to Trusted Sites is a valid URL path for your company or network.

In order to ensure continued access to files on FQDN or IP address paths add those URLs to the Trusted Sites zone in accordance with Windows guidance, Intranet site is identified as an Internet site when you use an FQDN or an IP address.

1. Go to Windows Settings.

2. Search for and open Internet Options.

3. Click the Security tab, then select Trusted Sites.

4. Add the URL, UNC, FQDN path that you want to allow to "Add this website to the zone".
   For example, add file://server.usa.corp.com
   
   

   Note: If the entry you wish to add does not explicitly start with ‘https:’, you must first uncheck the ‘Require server verification (https) for all sites in this zone’ checkbox before it can be saved.

5. This workaround can also be deployed via group policy.

GPO: User Configuration 

Policy: \\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Site to Zone Assignment List

Tips: 

• To avoid policy or zone processing failures as a result of incorrect syntax, it is highly advisable to first test the desired policy entry in the Internet Options UI:
  
  

• The Group Policy zone management interface does not provide input validation of entered values. By leveraging the tip above, administrators can ensure their policy values will be considered valid before deploying them broadly.

Note: The syntax for adding a URL for files on FQDN or IP address paths to a GPO is different than manually adding a file URL to Internet Options | Security | Trusted Sites. You need to add three forward slashes /// in front of the \\<ipaddress>.

For example:

• Manually adding \\10.123.452.37 enters file://10.123.452.37 in Trusted Sites list, this allows the file link to not be blocked.

• But for GPO you need to use the following syntax:  file:///\\10.123.452.37.
  This also enters file://10.123.452.37 in Trusted Sites list and allows the file link to not be blocked.

When you deploy by GPO if you have URLs that do not start with https, you may need to configure the setting to uncheck the box for Require server verification (https) for all sites in this zone.

Note: If the entry you wish to add does not explicitly start with ‘https:’, you must first uncheck the Require server verification (https) for all sites in this zone checkbox before it can be saved.

In order to configure GPO and not have to go through all clients one by one to uncheck the check box, these keys can be used:
HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags: 0x00000143(323)

Check box checked:
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"Flags"=dword:00000047

Check box unchecked:
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"Flags"=dword:00000043

In order to add the file shares in registry by GPO, consider the following:

If it’s a Domain

For the Contoso example above, it is set in the registry here:
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contoso.com

If it is an IP address, it is set in the registry here:
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1

And for each IP address share it is required to create a new Range key under Ranges.

'Saving changes is not permitted' error when you try to save a table in SQL Server

 

Error:

Saving changes is not permitted. The changes that you have made 

require the following tables to be dropped and re-created. 

You have either made changes to a table that can't be re-created 

or enabled the option Prevent saving changes that require the table to be re-created.

Resolution:

1. Open SQL Management Studio as an administrator

2. Go to Tools, then Options then "Designer"

3. Uncheck the Prevent saving changes that require table re-creation

4. Expand the database tables on the left object explorer of SQL Server 

and make the changes you plan to make. 

5. You may want to re-check the Prevent saving changes that require table re-creation

 in order to for the security feature to warn again.

Advanced Persistent Threat (APT)

 An advanced persistent threat (APT) is a prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period of time.

APT attacks are initiated to steal data rather than cause damage to the target organization's network.

The goal of most APT attacks is to achieve and maintain ongoing access to the targeted network rather than to get in and out as quickly as possible. Because a great deal of effort and resources can go into carrying out APT attacks, hackers typically select high-value targets, such as nation-states and large corporations, with the goal of stealing information over a long period of time.

To gain access, APT groups often use advanced attack methods, including advanced exploits of zero-day vulnerabilities, as well as highly-targeted spear phishing and other social engineering techniques. To maintain access to the targeted network without being discovered, threat actors will continuously rewrite malicious code to avoid detection and other sophisticated evasion techniques. Some APTs are so complex that they require full-time administrators to maintain the compromised systems and software in the targeted network.

The motives of advanced persistent threat actors are varied. For example, attackers sponsored by nation-states may target intellectual property to gain a competitive advantage in certain industries. Other targets may include power distribution and telecommunications utilities and other infrastructure systems, social media, media organizations, and electoral and other political targets. Organized crime groups may sponsor advanced persistent threats to gain information they can use to carry out criminal acts for financial gain.

Although APT attacks can be difficult to identify, data theft is never completely undetectable. However, the act of exfiltrating data from an organization may be the only clue defenders have that their networks are under attack. Cybersecurity professionals often focus on detecting anomalies in outbound data to see if the network has been the target of an APT attack.

How an APT attack works

Attackers executing APTs typically take the following sequential approach to gain and maintain ongoing access to a target:

• Gain access. APT groups gain access to a target by targeting systems through the internet. Normally, through spear phishing emails or via an application vulnerability with the intention of leveraging any access by inserting malicious software into the target.
• Establish a foothold. After gaining access to the target, threat actors use their access to do further reconnaissance. They use the malware they've installed to create networks of backdoors and tunnels to move around unnoticed. APTs may use advanced malware techniques such as code rewriting to cover their tracks.
• Gain even greater access. Once inside the targeted network, APT actors may use methods such as password cracking to gain administrative rights. This gives them more control of the system and get even deeper levels of access.
• Move laterally. Once threat actors have breached their target systems, including gaining administrator rights, they can then move around the enterprise network at will. They can also attempt to access other servers, as well as other secure areas of the network.
• Stage the attack. At this point, the hackers centralize, encrypt and compress the data so they can exfiltrate it.
• Take the data. The attackers harvest the data and transfer it to their own system.
• Remain until they're detected. Cybercriminals can repeat this process for long periods of time until they're detected, or they can create a backdoor so they can access the system again later.

Examples of advanced persistent threats

APTs are usually assigned names by their discoverers, though many advanced persistent threat attacks have been discovered by more than one researcher, so some are known by more than one name.

Advanced persistent threats have been detected since the early 2000s, and they date back as far as 2003 when China-based hackers ran the Titan Rain campaign against U.S. government targets in an attempt to steal sensitive state secrets. The attackers targeted military data and launched APT attacks on the high-end systems of government agencies, including NASA and the FBI. Security analysts pointed to the Chinese People's Liberation Army as the source of the attacks.

Some examples of advanced persistent threats include:

• The Sykipot APT malware family exploits flaws in Adobe Reader and Acrobat. It was detected in 2006, and further attacks using the malware reportedly continued through 2013. Threat actors used the Sykipot malware family as part of a long-running series of cyberattacks, mainly targeting U.S. and U.K. organizations. The hackers used a spear phishing attack that included links and malicious attachments containing zero-day exploits in targeted emails.
• The GhostNet cyberespionage operation was discovered in 2009. Executed from China, the attacks were initiated via spear phishing emails containing malicious attachments. The attacks compromised computers in more than 100 countries. The attackers focused on gaining access to the network devices of government ministries and embassies. These attacks enabled the hackers to control these compromised devices, turning them into listening and recording devices by remotely switching on their cameras and audio recording capabilities.
• The Stuxnet worm used to attack Iran's nuclear program was detected by cybersecurity researchers in 2010. It is still considered to be one of the most sophisticated pieces of malware ever detected. The malware targeted SCADA (supervisory control and data acquisition) systems and was spread with infected USB devices. The U.S. and Israel have both been linked to the development of Stuxnet, and while neither nation has officially acknowledged its role in developing it, there have been unofficial confirmations that they were responsible for Stuxnet.
• APT28, the Russian advanced persistent threat group also known as Fancy Bear, Pawn Storm, Sofacy Group and Sednit, was identified by researchers at Trend Micro in 2014. APT28 has been linked to attacks against military and government targets in Eastern Europe, including Ukraine and Georgia, as well as campaigns targeting NATO organizations and U.S. defense contractors.
• APT29, the Russian advanced persistent threat group also known as Cozy Bear, has been linked to a number of attacks, including a 2015 spear phishing attack on the Pentagon, as well as the 2016 attacks on the Democratic National Committee.
• APT34, an advanced persistent threat group linked to Iran, was identified in 2017 by researchers at FireEye, but has been active since at least 2014. The threat group has targeted companies in the Middle East with attacks against financial, government, energy, chemical and telecommunications companies.
• APT37, also known as Reaper, StarCruft and Group 123, is an advanced persistent threat linked to North Korea that is believed to have originated around 2012. APT37 has been connected to spear phishing attacks exploiting an Adobe Flash zero-day vulnerability.

Characteristics of advanced persistent threats

Advanced persistent threats often exhibit certain characteristics reflecting the high degree of and coordination necessary to breach high-value targets.

Most APTs are carried out in multiple phases, reflecting the same basic sequence of gaining access, maintaining and expanding access, and attempting to remain undetected in the victim network until the goals of the attack have been accomplished.

Advanced persistent threats are also distinguished by their focus on establishing multiple points of compromise. APTs usually attempt to establish multiple points of entry to the targeted networks, which enables them to retain access even if the malicious activity is discovered and incident response is triggered, enabling cybersecurity defenders to close one compromise.

Detecting advanced persistent threats

Advanced persistent threats have certain warning signs despite typically being hard to detect. An organization may notice certain symptoms after it has been targeted by an APT, including:

• unusual activity on user accounts;
• extensive use of backdoor Trojan horse malware, a method that enables APTs to maintain access;
• odd or uncharacteristic database activity, such as a sudden increase in database operations involving massive quantities of data; and
• presence of unusual data files, which may indicate data that has been bundled into files to assist in the exfiltration process.

Detecting anomalies in outbound data is perhaps the best way for cybersecurity professionals to determine if a network has been the target of an APT attack.

Risk Management: Disaster Recovery and Continuity of Operations Concepts

Disaster Recovery plan: Disaster recovery plan is also called as business continuity plan or business process continuity plan.

DRP: DRP stands for Disaster Recovery Planning should include information security, asset security, and financial security plans.

As part of disaster recovery, it is important to have a location from which the recovery of a failed site can take place. This location is known as a backup site. In the event of a disaster, your site is recreated at the specified backup site and made available. Once the failed site is recovered, the backup site will be reverted to its previous status.

There are three different types of backup sites:

1. Cold backup sites

2. Warm backup sites

3. Hot backup sites

1. Cold site: Here the bare minimums, such as space and furniture are available. Everything else need to be procured. The delay going to a fully operational site could be very large in this case

2. Warm site: Here, most of the hardware is in place, and probably you need to recover the site from off-site backup, and configure. The site could be restored in a reasonable amount of time.

3. Hot site: A facility designed to provide immediate availability in the event of a system or network failure. All the systems are appropriately configured and working. Only thing that is required is the restoration of latest backup.

Note that onsite backup is not a back up site.

Backup concepts: It is recommended to store the backup tapes in a secure, physically distant location. This would take care of unforeseen disasters like natural disasters, fire, or theft. It is also important that the backup tapes are regularly verified for proper recovery in a test server, even though recovery is not really required at that time. Otherwise, it may so happen that you find a backup tape corrupt when it is really required. The backup policy identifies the methods used to archive electronic and paper file systems. This policy works in conjunction with the information retention and storage policies.

A properly managed tape backups should include the following:

• Regular backups according to a pre-determined plan
• Verifying the backup tapes for integrity
• Labeling tapes properly for easy and unique identification
• Storing tapes securely at off-site location
• Destroying data on old tapes before disposing off the same

There are primarily three types of backups:

1. Full backup: Here all the data gets backed up. It usually involves huge amounts of data for large systems, and may take hours to complete. A full backup is preferred instead of incremental or differential backups where it is feasible. However, when there is large amount of data, full backup is done once in a while and incremental or differential backups are done in between. A backup plan is usually put in place prior to taking backup of data.

2. Differential backup: A differential backup includes all the data that has changed since last full backup. The "differential backup" that was taken earlier (after the "full backup" but before the current "differential backup") becomes redundant. This is because all changed data since last "full backup" gets backed up again.

3. Incremental backup: It includes all the data changed since last incremental backup. Note that for data restoration the full backup and all incremental backup tapes since last full backup are required. The archive bit is set after each incremental backup. Incremental backup is useful for backing up large amounts of data, as it backs up only the changes files since previous incremental backup.

Risk Response Strategies: Mitigation, Transfer, Avoidance, and Acceptance

 

6 Key Steps in the Risk Management Process

The risk management process can make the unmanageable manageable, and can allow the project manager to operate on what seems to be a disadvantage and turn it into an advantage. Let’s see how:

1. Risk identification

It is not possible to solve a risk if you do not know it. There are many ways to identify risk.

One way is through brainstorming, a methodology which allows a group to examine a problem.

Another method is that of individual interviews. It consists of finding people with relevant experience, so that it is possible to gather information that will help the project manager identify the risk and find a possible solution.

Imagining the current project and thinking about the many factors that can go wrong is another technique. What can you do if a key team member is sick? What can you do if the material does not arrive within the defined deadline? Etc.

An aid in this phase is also to read the reports of similar past projects, verifying the presence of any problems encountered during the path, and see how these have been solved.

2. Risk analysis

The next step is to determine the likelihood that each of these risks will occur. This information should also be included in the risk register.

When evaluating the risks of a project, it is possible to proactively address the situation. For example, potential discussions can be avoided, regulatory problems can be solved, new legislation must be known, etc.

Analyzing the risks is certainly difficult. There is never a limit to the information that can be collected in this sense.

Moreover, risks must be analyzed based on qualitative and quantitative analyzes. This means, that you determine the risk factor based on how it will potentially affect the project through a variety of metrics.

3. Risk prioritization

Not all risks have the same level of severity. It is therefore necessary to assess each risk in order to know which resources will be gathered to resolve it, when and if it occurs.

Some risks will be more acceptable, others may even risk to completely stop the project, making the situation quite serious.

Having a long list of risks can be daunting, but the project manager can manage them simply by classifying the risks as high, medium or low.

With this perspective, the project manager can then start planning how and when these risks will be addressed.

Some risks require immediate attention; these are the risks that can derail the project.

Other risks are important, they probably won’t threaten the success of the project, but will delay it.

Then, there are those risks that have little or no impact on the program and the overall project budget.

Some of these low priority risks could be important, but not enough to be urgently addressed. Indeed, they could be somehow ignored and also time could delete them and improve the situation.

4. Assign an owner to the risk

All the hard work of identifying and assessing risks is useless unless the project manager assigns someone to oversee the risk.

Who is the person responsible for that risk that, if this were to happen, would take charge of its resolution?

This decision, in general, is up to the project manager who knows the level of experience and training of each team member and is therefore able to assess the most suitable person to face a particular risk.

It is certainly important to identify the risks, but if these are not managed by a person in charge, the work will have been completely useless and the project will not be adequately protected.

5. Respond to the risk

Now comes the moment, when all that has been planned must be put into practice.

For each identified risk, based on priority, a mitigation plan or strategy is created.

The project manager should deal with the risk owner in order to decide together which strategy to implement to resolve the risk.

6. Risk monitoring

Obviously, every strategy to respond to the risk is useless if it is not monitored in its success – or failure.

The risk owner is also responsible for monitoring the progress towards resolution.

But also the project manager needs to stay updated in order to get an accurate picture of the overall progress and to identify and monitor potential new risks that may arise from the new situation.

It is better to ensure that dedicated communication channels for risk management are organized, so that important elements and information are not lost.

Risk mitigation

After the risk has been identified and assessed, the project team develops a risk mitigation plan, ie a plan to reduce the impact of an unexpected event.

Here are the four ways to manage or mitigate a risk:

• Risk avoidance
• Risk acceptance and sharing
• Risk mitigation
• Risk transfer

Each of these mitigation techniques can be an effective tool to reduce individual risks and the risk profile of the project.

Let’s see these four techniques in detail.

1. Risk avoidance

This technique usually involves developing an alternative strategy that is more likely to succeed, but is usually linked to a higher cost.

A very common risk elimination technique is to use proven and existing technologies rather than adopting new technologies, although they could lead to better performance or lower costs.

A project team can choose a supplier with a proven track record instead of a new supplier that offers significant price incentives; this, in order to avoid the risk of working with a new supplier that is not known whether it is reliable or not.

Eliminating a risk is definitely the best technique you can use. If the project manager can avoid it, surely he will not have negative impacts derived from it on the project.

2. Risk acceptance and sharing

This technique involves accepting the risk and collaborating with others in order to share responsibility for risky activities.

Many organizations working on international projects will reduce the political, legal, and employment risks associated with international projects by developing a joint venture with a company based in a particular country, for example.

Partnering with another company to share the risk associated with a part of the project is advantageous when the other company has experience that the project team does not have. If a risk event occurs, the partner company absorbs all or part of the negative impact of the event.

3. Risk mitigation

Risk mitigation represents an investment in order to reduce the risk on a project.

On international projects, for example, companies will often buy a guaranteed exchange rate in order to reduce the risk associated with exchange rate fluctuations.

A project manager can hire an expert to review technical plans or cost estimates on a project in order to increase confidence in that plan.

Assigning high-risk management activities to highly qualified project personnel is another risk reduction method.

Experts who run a high-risk business can often anticipate problems and find solution.

4. Risk transfer

Risk transfer is a risk reduction method that shifts risk from the project to another party.

A classic example of risk transfer is the purchase of an insurance. The risk is transferred from the project to the insurance company.

Purchasing an insurance is usually in areas beyond the control of the project team. Weather, political unrest, and strikes are examples of events that can have a significant impact on the project and that are beyond the control of the project team.

Simply put, it is simply a matter of paying someone else to accept the risk.

Risk management may seem superfluous at the beginning of the project. When a project manager is starting a new project, it is indeed difficult to think about things that could go wrong, especially if he is caught up in the initial enthusiasm.

It is essential to remember, however, that the development of a management plan will – most likely – be useful later during the development of the project.

This is why risk management must be considered an absolute priority from the start.