Hệ thống, hoặc các trang web vật lý. Có một khả năng thực tế rằng điều này có thể xảy ra. Hành động để loại bỏ các lỗ hổng này là khuyến khích. L Cao Lỗ hổng này đặt ra một mối nguy hiểm thực sự cho sự bảo mật, tính toàn vẹn, tính sẵn có, và / hoặc trách nhiệm của các thông tin, hệ thống của tổ chức, hoặc các trang web vật lý. | 86 Network Security A Beginner s Guide systems or physical sites. There is a real possibility that this may occur. Action to remove the vulnerability is advisable. High The vulnerability poses a real danger to the confidentiality integrity availability and or accountability of the organization s information systems or physical sites. Action should be taken immediately to remove this vulnerability. When available the ramification of a successful exploitation of a vulnerability by a threat must be taken into account. If the cost estimates are available they should be applied to the risk level to better determine the feasibility of taking corrective action. IDENTIFYING THE RISK TO AN ORGANIZATION The identification of risk is straightforward. All you need to do is to identify the vulnerabilities and the threat and you are done. How do these identified risks relate to the actual risk to an organization The short answer is not very well. The identification of risks to an organization must be tailored to the organization. Figure 6-2 shows the components of an organizational risk assessment. As you can see from the figure I ve added another component to the risk calculation existing countermeasures. 87 Chapter 6 Managing Risk Identifying Vulnerabilities When identifying specific vulnerabilities begin by locating all the entry points to the organization. In other words find all the access points to information in both electronic and physical form and systems within the organization. This means identifying Internet connections Remote access points Connections to other organizations Physical access to facilities User access points For each one of these access points identify the information and systems that are accessible. Then identify how the information and systems may be accessed. Be sure to include in this list any known vulnerabilities in operating systems and applications. In Chapter 7 we will go into more detail on how detailed risk assessments are performed. However
