Security Mgt U5, risk analysis and mgt (part 1)

risk model
1. risk
  1. identify, analyze, model
    1. assets
    2. threats
    3. vulnerabilities
  2. management
    1. countermeasures
    2. implementation
    3. audit
definitions
1. risk
  1. potential for an unwanted event to have a negative impact upon an activity by exploiting an exposure
2. risk management
  1. reduction of the exposures identified by risk analysis to a level acceptable to the organization
3. gap analysis
  1. highlights areas where there are significant gaps i the security managemen process or in security measures implemented
4. business impact analysis
  1. identifies impact for organization if the functions that core information systems are interrupted. quantifies importance for business
5. assets
  1. physical environment
  2. hardware
  3. data
  4. software/systems
  5. communications network
  6. infrastructure
  7. staff
4 kinds of risk
1. business
2. project
3. operational
4. financial
related legislation
1. HIPAA
2. Gamm Leach Bliley Act
3. Basel II
4. Sarbanes Oxley
5. financial services and markets act
manuallly documented or software-guided?
1. manual
  1. low cost to entry
  2. simpler but error prone
  3. less efficient
  4. harder to share and repeat
  5. increased cost of expertise maintenance
2. software guided
  1. consistently implements a specific methodology
  2. guides user
  3. reusable, shareable
  4. dynamic, efficient
  5. software options (image)
    Attachments:
    - Security Mgt U5, Risk Analysis Methods and Tools (image)
ISMS documentation set
1. infosec policy
2. information asset register
3. risk assessment report
4. statement of applicability
5. policies and procedrues
threat motivation
1. resources
2. opportunity
3. capability
4. publicity
5. asset attractiveness
qualitative vs. quantitative
1. qualtitative
  1. capable of handling soft impacts
  2. handles hard & soft impacts consistently
  3. adapts to emerging best practices
  4. accepts that risk mgt is evolving
  5. relies on consensus of "best placed"
  6. dependent on expert opinion
    1. only as good as your best expert opinion
2. quantitative
  1. every loss is capable of beig expressed in financial terms
    1. requires careful records
    2. formula for financial impact (image)
      Attachments:
      - Security Mgt U5, quantitative risk assessment forumula (image)
    3. expected frequency of attacks is known (statistics bank)
    4. has problems with new risks
    5. has problems with less concrete risk

Next up

Security Mgt U5, risk analysis and mgt (part 1)

Description

Resource summary

Similar

	Created by jjanesko about 11 years ago