Chapter 8 Risk Management: Identifying and Assessing Risk

Risk identification and assessment process

- plan and organize process. - create system component categories. - develop inventory of assets. - identify threats. - specify vulnerable assets. - assign value of impact rating to assets. - assess likelihood for vulnerabilities. - calculate relative risk factor for assets. - preliminary review of possible controls. - document findings.

threats facing an organization should be examined

After identifying and performing a preliminary classification of information assets.

Threat assessment

Each identified threat must be further examined to determine its potential to affect the targeted information asset.

Human error or failure

Example: Accidents, employee mistakes, failure to follow policy

Technological obsolescence

Example: Antiquated or outdated technologies

information extortion

Example: Blackmail threat of information disclosure

Technical software failures or errors

Example: Bugs, code problems, loopholes, back-doors

Sabotage or vandalism

Example: Damage to or destruction of systems or information

Forces of nature

Example: Fire, flood, earthquake, lightning, etc.

Deviations in quality of service from service providers

Example: Fluctuations in power, data, and other services

Technical hardware failures or errors

Example: Hardware equipment failure

Theft

Example: Illegal confiscation of equipment or information

Software attacks

Example: Malware: viruses, worms, macros, denial of-services, or script injections

Compromises to intellectual property

Example: Software piracy or other copyright infringement

Espionage or trespass

Example: Unauthorized access and/or data collection

Knowing the enemy

Identifying, examining, and understanding the threats facing the organization's information assets

Risk Determination

Risk equals likelihood of vulnerability occurrence times value minus percentage risk already controlled plus an element of uncertainty

Risk assessment

a process that assigns a comparative risk rating or score to each specific information asset. (Enables the organization to gauge the relative risk introduced by each vulnerable information asset and allows comparative ratings later in the risk control process)

Each information asset

is evaluated for each threat it faces

goal of risk assessment

is the assignment of a risk rating or score that represents the relative risk for a specific vulnerability of a specific information asset

Threat identification

process of assessing potential weaknesses in each information asset.

Risk management

process of discovering and assessing the risks to an organization's operations. (Also determining how those risks can be controlled or mitigated).

Risk analysis

the identification and assessment of levels of risk in the organization. (A major component of risk management)

Project scope complexity

when assume every threat can and will attack every information asset.

Threats-Vulnerabilities-Assets (TVA) worksheet

worksheet lists the assets in priority order along one axis, and the threats in priority along the other axis