Ch4 - RISK MANAGEMENT

Ch4 - RISK MANAGEMENT

1. DEVELOPING A RISK MANAGEMENT PROGRAM

   • establish the purpose
     • reduce the cost of insurance
     • evaluated by KPI
     • determined by the senior management and board of directors
   • Assign responsibility
     • Developed by team
     • integrate risk management at all level of oraganization

2. Risk Management process

   • Articulate the risk / Calculation of Risk
     • probability of occurrence × magnitude of impact
   • define a risk management action protifolio
   • maintain a risk profile / Evaluation of the impact
     • Ex.
       • Interruption of business activity
       • Reduction in operational efficiency/performance
       • Loss of business opportunity
       • Loss of reputation/goodwill
       • Direct loss of money
       • Breach of legislation
       • Endangering of staff or customers
   • respond to risk / Evaluation of and Response to Risk
     • evaluate the existing controls
     • Design new controls
     • Acceptable risk level depens on
       • Organizational policy
       • Risk appetite
       • Risk identification and measurement
       • Uncertainty incorporated in the risk assessment approach
       • Cost and effectiveness of implementation
       • Cost of control versus benefit
     • IT risk management operates on several levels
       • operational level
       • thr project level
       • the strategic level
     • Control can be
       • Detective, corrective
       • Manual, automated
       • Preventive
   • analyze risk / Evaluation of Threats and Vulnerabilities to Assets
     • Assess the likelihood of occurrence of threats and vulnerabilities
     • Classes of threats
       • Errors
       • Malicious damage/attack
       • Fraud
       • Theft
       • Equipment/software failure
     • Human threats
       • Novice (Kiddie screpter)
       • Hacktivists
       • Criminals
       • Terrorists
       • Nation state
       • riot and civil unrest
     • Environmental threats
       • Tornado
       • lightning
       • Floods
       • Hurricane
       • Earthquick
     • Vulnerabilities ex.
       • Lack of user knowledge
       • Lack of security functionality
       • Inadequate user awareness/education
       • Untested technology
   • Collect data / assets identification
     • identify and collect relevant data
     • identify information resources or assets that are vulnerable to threat -> this information need protection
     • Typical assets associated with information and IT
       • Information and data
       • HW
       • SW
       • personnel
       • Documents
     • Traditional assets
       • Buildings
       • Stock, Goods
       • Cash (money)
       • Reputation

3. Sourcing practices.

   • IT function:
     • how they are perofoemed
       • hybrid
       • outsourced
         • Adv
           • economies
           • more time
           • more experience
           • better specifications
         • Disadv / risk business
           • loss of internal IT experience
           • loss of control over IT
           • vendor failure
           • contract term not being met
           • lack of loyality
           • cost
           • difficulty in changing agreement
           • Disgruntled customers/employees
           • service cost
           • failure of either company to recieve anticipated benefits
           • exp. litigation
           • leakage of info.
           • limited product access
           • deficient in compliance with legal requirement
           • reputational damage due to project failure
         • Risk reduction
           • shared goals
           • multiple suppliers
           • competitive reviews
           • include many contingencies in the contract
           • SW escrow
           • short-term contract
       • Insourced
     • Where?
       • offsite/nearshore
       • onsite
       • offshore
   • Strategy
     • is this a core function for the organizaton?
     • Does it need specific knowledge, cannot be replicated externally?
     • can this function performed by 3ed party, with same or lower price, same or higher quality?
     • does the org have experience managing 3ed party?
     • Are there any restriction preventing offshore location?

4. planned action on a risk

   • Avoid
   • mitigate
   • share/transfer
   • accept

5. Identify vulnerabilities and threats of information resources

6. Different companies may have a different appetite for risk