An ninh là về quản lý rủi ro. Nếu không có sự hiểu biết về các nguy cơ bảo mật cho tài sản thông tin của tổ chức, quá nhiều hoặc không đủ nguồn lực có thể được sử dụng hoặc sử dụng một cách sai lầm. Quản lý rủi ro cũng cung cấp một cơ sở cho việc định giá tài sản thông tin. Bằng cách xác định nguy cơ, bạn tìm hiểu các giá trị của từng loại thông tin và giá trị của các hệ thống có chứa thông tin đó | CHAPTER 6 Managing Risk Copyright 2001 The McGraw-Hill Companies Inc. Click Here for Terms of Use. 79 80 Network Security A Beginner s Guide Security is about managing risk. Without an understanding of the security risks to an organization s information assets too many or not enough resources might be used or used in the wrong way. Risk management also provides a basis for valuing of information assets. By identifying risk you learn the value of particular types of information and the value of the systems that contain that information. WHAT IS RISK Risk is the underlying concept that forms the basis for what we call security. Risk is the potential for loss that requires protection. If there is no risk there is no need for security. And yet risk is a concept that is barely understood by many who work in the security industry. Risk is much better understood in the insurance industry. A person purchases insurance because a danger or peril is felt. The person may have a car accident that requires significant repair work. Insurance reduces the risk that the money for the repair may not be available. The insurance company sets the premiums for the person based on how much the car repair is likely to cost and the likelihood that the person will be in an accident. If we look closely at this example we see the two components of risk. First is the money needed for the repair. The insurance company needs to pay this amount if an accident occurs. This is the vulnerability of the insurance company. The second component is the likelihood of the person to get into an accident. This is the threat that will cause the vulnerability to be exploited the payment of the cost of repair . When risk is examined we therefore must understand the vulnerabilities and the threats to an organization. Together these two components form the basis for risk. Figure 6-1 shows the relationship between vulnerability and threat. As you can see from the figure if there is no threat there is no risk. .
