After studying this chapter you will be able to understand: Information security departments are created primarily to manage IT risk; managing risk is one of the key responsibilities of every manager within the organization; in any well-developed risk management program, two formal processes are at work; Risk identification and assessment, risk control. | Professional Practices in Information Technology HandBook COMSATS Institute of Information Technology (Virtual Campus) Islamabad, Pakistan Lecture 31 Risk Management Threat Identification Vulnerability Assessment Begin to review every information asset for each threat This review leads to the creation of a list of vulnerabilities that remain potential risks to the organization – Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset At the end of the risk identification process, a list of assets and their vulnerabilities has been developed Figure Threat Identification This list serves as the starting point for the next step in the risk management process - risk assessment Figure Threat Identification The TVA Worksheet At the end of the risk identification process, a list of assets and their vulnerabilities has been developed. Another list prioritizes threats facing the organization based on the weighted table discussed earlier. These lists can be combined into a single worksheet. Figure : The TVA Worksheet Introduction to Risk Assessment The goal is to create a method to evaluate the relative risk of each listed vulnerability Figure : Introduction to Risk Assessment Likelihood The overall rating of the probability that a specific vulnerability will be exploited – Often using numerical value on a defined scale (such as – ) Using the information documented during the risk identification process, you can assign weighted scores based on the value of each information asset, . 1-100, low-med-high, etc Assessing Potential Loss Questions to ask when assessing potential loss – Which threats present a danger to this organization’s assets in the given environment? – Which threats represent the most danger to the organization’s information? – How much would it cost to recover from a successful attack? Questions to ask when assessing potential loss (cont’d.) – Which threats would require the greatest expenditure to prevent? – Which of the aforementioned questions is the most important to the protection of information from threats within this organization? Percentage of Risk Mitigated by Current Controls If vulnerability is fully managed by an existing control, it can be set aside. If it is partially controlled, estimate what percentage of the vulnerability has been controlled. Uncertainty It is not possible to know everything about each vulnerability. The degree to which a current control can reduce risk is also subject to estimation error. Uncertainty is an estimate made by the manager using judgment and experience. Professional Practices in Information Technology CSC 110
