Security Mgt U5, risk analysis & mgt (part 2)

Security Mgt U5, risk analysis & mgt (part 2)

1. stages of the risk analysis and management process

   • stage 1
     • What is the value of the information being processed?
       • costs of assets
         • replacement costs
         • for software: only valued insofar as it provides competitive advantage
       • what devalues assets?
         • modification
         • unavailability
         • disclosure
         • destruction
         • communication interference
     • What parts of the system support which business processes?
     • identify assets
   • stage 2
     • identify threats, vulnerabilities and risk
       • What threats affect the system?
       • How vulnerable are our systems?
       • What conclusions can be reached about the risks to our security?
       • assessing a new system for risk
         • I do have a similar system.
           • use stats from this system
         • I don't have a similar system.
           • seek industry stats or best guess
       • types of threats
         • logical
         • communications
         • technical failures
         • human errors
         • physical
       • types of vulnerabilities
         • facilities and functionalities
         • system dependence
         • design
   • stage 3
     • How can the identified risks be met?
       • countermeasures
         • kinds
           • 1. avoid
           • 2. transfer
           • 3. reduce threat
           • 4. reduce vulnerability
           • 5. reduce impact
           • 6. detect
           • 7. recover
         • review and mark countermeasrues
           • installed
           • not applicable
           • under consideration
             • requires management consultation to determine whether or not this countermeasure is applicable or not
         • prioritization
           • already in place
           • covers many threats
           • required
           • low cost high effectiveness
     • What improvements can be made to existing security?
       • gap analysis
         • highlights countermeasures that are not in place