Risks

Question 1

Risk Analysis: Threats

Answer 1

Terrorism - Cyber attacks to slow down or prevent online services (DDOS)
—Consequence: Loss of reputation

Criminal sabotage - Attacks on firewalls by viruses to destroy data
—Consequence: Loss of business and income

Theft by Hacker/Employee - Hacking into data to steal companies private files or copying the files onto disc and selling it to rivals.
—Consequence: Cost of recovering data

Natural Disasters - Floods, Earthquakes etc.
—Consequence: Cost of recovering data

Accidental Altering of Data - Overwriting files or accidental deletion of files
—Consequence: Legal action

Theft of Data - Stealing storage media containing data
—Consequence: Loss of business and income Bankruptcy

Fire – Electrical fire in server room
—Consequence: Cost of new hardware

Question 2

Risk Analysis: Consequences

Answer 2

—Loss of business and income

—Loss of reputation

—Legal action

—Costs of recovering data (NOT just data loss)

Question 3

Risk Analysis: Prevent Risks

Answer 3

—Methods for controlling access to computer rooms

—Methods of securing integrity of transmitted data

—Methods of including private and public keys

—Call back procedures for remote access

—Establish firewalls

—Use virus scanners

—Proxy servers

—Password systems

—Methods to define security status and access rights for users

—Methods for physical protection of hardware and software

—Security of document filing systems

Question 4

Prevention of accidental misuse

Answer 4

Backup and recovery procedures
—What, where, who, how, when? Standard backups to floppy disc

RAID systems (MIRRORING)
--- Data copied twice on each server, so that if one storage disc fails, the data is still safe

Grandfather, father, son system
—Three generations of files are kept where the son files become the father file, then the father becomes the grandfather (updated constantly)

Backing up program files

Question 5

Risk Stages

Answer 5

Identify potential risks

• –Viruses
• –Fire
• –Natural damage
• –Hacking
• –Systems failure
• –Fraud

Likelihood of risk occurring
—Some things such as power cut are inevitable but explosions much less likely - senior managers have to assess the likelihood of each risk occurring and put in the necessary security.

Short and long term consequences of threat

• –Resources (staff equipment, etc) need to be directed towards recovering the data
• –May have to pay compensation
• –Financial loss due to loss of business through not being able to take orders
• –Embarrassment
• –Prosecution
• –Loss of integrity
• –Bankruptcy
• –Cost of replacing equipment

How well equipped is the company to deal with the threat (What procedures are in place)
—Has to be reviewed periodically because of changing needs - disaster recovery programme – backup strategy – cost (how much they are prepared to spend), use of firewalls – use of anti virus