Basic principles of information security - risk management, Other Subject

Assignment Help:

Risk Management

Security is everyone's responsibility. Security awareness poster. U.S. Department of Commerce/Office of Security.

A complete treatment of the topic of risk management is further than the scope of this editorial. We will however, provide a helpful definition of risk management, draw round a usually used process for risk management, and describe some basic terminology.

The CISA Review Manual 2006 provides the following definition of risk management: "Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and make a decision what

Countermeasures, if any, to obtain in reducing risk to a suitable level, based on the value of the information reserve to the organization."

There are two things in this description that may require some explanation. First, the procedure of risk management is an ongoing iterative process. It must be frequent without letting up. The business environment is continuously changing and new fear and vulnerabilities come out every day. Second, the choice of countermeasures (controls) used to manage risks have to strike a balance between efficiency, cost, usefulness of the countermeasure, and the worth of the informational asset being sheltered.

Risk is the probability that something bad will occur that causes damage to an informational asset (or the loss of the asset). Vulnerability is a fault that could be used to put in danger or cause harm to an informational asset. A risk is anything (man made or act of nature) that has the possible to reason harm.

The probability that a danger will use a vulnerability to reason harm creates a risk. When a warning does use a vulnerability to impose harm, it has a crash. In the context of information security, the crash is a loss of integrity, confidentiality, availability, and possibly other losses (loss of life, lost income, and loss of real possessions). It should be pointed out that it is not possible to identify all risks, nor is it probable to remove all risk. The enduring risk is called residual risk.

A risk assessment is carried out by a team of people who have knowledge of exact areas of the trade. association of the team may contrast over time as dissimilar parts of the business are assessed. The measurement may use a prejudiced qualitative analysis based on informed opinion, or where reliable dollar statistics and historical information is existing, the analysis may use quantitative analysis.

The ISO/IEC 27002:2005 Code of put into practice for information security management suggests the subsequent be examined during a risk assessment

  • interactions and operations management,
  • access control,
  • security policy,
  • organization of information security,
  • asset management, human resources security,
  • physical and environmental security,
  • information security event management,
  • business continuity management, and
  • regulatory compliance.
  • information systems acquisition,
  • development and maintenance,

In wide provisions the risk management process consists of

1.   Recognition of assets and approximation their value. Include: building, persons, software, hardware, data (print, electronic, other), and supplies.

2.   carry out a threat assessment. Include: Acts of natural world, accidents, acts of war, malicious acts originating from inside or outside the association.

3.   Conduct a susceptibility assessment, and for each vulnerability, calculate the probability that it will be exploited. Evaluate policies, events, standards, training, physical security, quality control, technological safety

4.   compute the collision that each threat would have on each asset. Use qualitative analysis or quantitative analysis.

5.   recognize, select and implement suitable controls. offer a comparative response. Consider efficiency, cost efficiency, and value of the asset.

Evaluate the efficiency of the control procedures. make sure the controls provide

For any known risk, Executive Management can decide to accept the risk based upon the qualified low value of the asset, the comparative low rate of incidence, and the comparative low impact on the business. Or, management may prefer to mitigate the risk by selecting and implementing appropriate control actions to reduce the risk. In a number of cases, the danger can be transferred to an additional business by buying assurance or out-sourcing to another business. The reality of some risks may be doubtful. In such cases leadership may choose to deny the risk. This is itself a possible risk.


Related Discussions:- Basic principles of information security - risk management

Encryption in digital signatures, Encryption in Digital Signatures Dig...

Encryption in Digital Signatures Digital Certificates Work In physical transactions, the challenges of authentication, identification and privacy are solved with physical

Rehabilitation of gleno-humeral joint dislocation, Rehabilitation of Gleno-...

Rehabilitation of Gleno-humeral joint dislocation before and after arthroscopic reconstruction a-Pre-operative rehabilitation (before the surgery) Appropriate targets are ide

What is environmental law?, What is Environmental Law? This is the area...

What is Environmental Law? This is the area of law that seeks to direct human impact on the environment. The "environment" refers to all of the aspects of the natural environme

What do you meant by the term counseling, Problem 1: What do you meant ...

Problem 1: What do you meant by the term Counseling? In what ways is it similar and/or different from Psychotherapy? Give a detailed description of the different aims of

Alternative systems of e-cash, Alternative Systems of E-cash Officially...

Alternative Systems of E-cash Officially digital money or electronic is a illustration, or a system of credits and debits, used to replace value, inside another system, or itse

Public policy , can you find me 8 articles policies and write my reflection...

can you find me 8 articles policies and write my reflection for each one

Client-queue-client network architecture, Compariso n to Client-Queue-Clie...

Compariso n to Client-Queue-Client architecture Even as classic Client-Server architecture necessitate one of the communication endpoints to take action as a server, which is

Types of socialisation undergone by an individual, Question 1: Are Gend...

Question 1: Are Gender Roles culturally or biologically produced? Question 2: (a) Identify the different types of socialisation undergone by an individual. (b) Descr

Export control of data encryption, Export Control- Cryptographic strate...

Export Control- Cryptographic strategy and technical data concerning them are subject to Federal Government export controls as specified in Title 22, Code of Federal Regulation

Security model, SECURIT Y MODEL A computer security model is a system ...

SECURIT Y MODEL A computer security model is a system for identifying and enforcing security policies. A security model may be established upon a formal model of access rights

Write Your Message!

Captcha
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd