Week 2 Flashcards
The Importance of Project Risk Management
Security risk management deals with identifying, analyzing, and responding to risks (Threats) in an organization.
Involves identifying, assessing, and prioritizing risks.
Mitigating and monitoring of those risks.
Also known as information assurance (IA).
Preceded by Vulnerability Assessment
Assess the vulnerability of computer systems and network devices using common network assessment tools like
Network mappers, vulnerability scanners, protocol analyzers, packet sniffers, and password crackers.
Important Terms
Asset
Valuables that need to be protected
Could be IT systems, data, buildings, paper files, etc.
The value and criticality of the asset will determine what safeguards or countermeasures must be put in place.
Threats
A potential harmful event like power outage, virus attack, etc that can harm a system.
Something that causes harm
Vulnerability
A weakness within a system that can allow a threat to cause harm.
Ex: A data center without a backup.
Gap/ Weakness
Important Terms
Risk
Likelihood that the vulnerability in a system can be exploited to cause harm.
Potential harm or outcome of the threat exploiting the vulnerability
Exposure
Instance of being exposed to losses when a risk materializes.
Control
Safeguard or countermeasure put in place to address the risk.
Identify the following as threat/ vulnerability/ risk. Misconfigured Firewall
Vulnerability
Identify the following as threat/ vulnerability/ risk.
Loss of credit card data
Risk
Identify the following as threat/ vulnerability/ risk.
Hacker
Threat
Identify the following as threat/ vulnerability/ risk.
Virus
Threat
Identify the following as threat/ vulnerability/ risk. Fire
Threat
Identify the following as threat/ vulnerability/ risk. Virus infection
Risk
Identify the following as threat/ vulnerability/ risk. Loss of data integrity
Risk
Identify the following as threat/ vulnerability/ risk. Outdated anti-virus software
Vulnerability
Review Slide 6 in week 2
Review Slide 6 in week 2
Negative Risk
A dictionary definition of risk is “the possibility of loss or injury”
Negative risk involves understanding potential problems that might occur in the project and how they might impede project success
Negative risk management is like a form of insurance; it is an investment
Risk Can Be Positive
Positive risks are risks that result in good things happening; sometimes called opportunities.
The goal of risk management is to minimize potential negative risks while maximizing potential positive risks.
Risk Classification
External
Regulatory, Environmental, Market Conditions.
Internal
Disgruntled employees, poor separation of duties
Technical
Backdoors, Trapdoors.
Unforeseeable
DOS attacks, Natural disasters
Risks can also be:
Business risks – Loss or gain
Pure risk – Loss only (Insurable, fire, theft).
Identifying Risks
Identifying risks is the process of understanding what potential events might hurt or enhance a particular project
Another consideration is the likelihood of advanced discovery
Risk identification tools and techniques include:
Brainstorming Focus Groups
The Delphi Technique Storyboarding
Interviewing Surveys, Checklists
SWOT analysis Interviews
Conducting Risk Assessments
Risk assessment:
The goal is to determine the amount of threats or harm that could possibly occur in a given timeframe to computers and networks
Generally, risk assessments follow this order:
- Identify the organization’s assets.
- Identify vulnerabilities.
- Identify threats and threat likelihood.
- Identify the potential monetary impact.
Risk register:
Also known as a risk log
Helps to track issues and address problems as they occur
Risk Assessment
Single most important step in developing a secure infrastructure in an organization.
Identify and assigns risk levels to identified threats/ risks
By comparing the nature of threats to the safeguards/ controls designed to minimize them
Use a control spreadsheet/ Risk Register
List down assets on the side
List threats across the top
List the controls that are currently in use to address each threat in the corresponding cells
Allows optimization of controls based on risk
Risk Assessment
Identify the assets critical to an organization and its infrastructure
Organization’s data files most important
Mission-critical applications also very important
Programs critical to survival of business
Hardware, software components
Important, but easily replaceable
Evaluate assets based on their importance
Prioritizing assets is a business decision, not a technology decision
Value of an asset is a function of:
Its replacement cost
Personnel time to replace the asset
Lost revenue due to the absence of the asset
Risk Register/ Control Spreadsheet
The main output of the risk identification process is a list of identified risks and other information needed to begin creating a risk register
A risk register is:
A document that contains the results of various risk management processes and that is often displayed in a table or spreadsheet format
A tool for documenting potential risk events and related information
Risk events refer to specific, uncertain events that may occur to the detriment or enhancement of the project
Performing Qualitative Risk Analysis
Assess the likelihood and impact of identified risks to determine their magnitude and priority.
Subjective Analysis
The probability of each risk occurring, using a standard scale - High, Medium, or Low (or a scale of 1 to 10).
The impact of each risk using a standard scale as above.
Probability/impact matrixes
An assessment that assigns numeric values to the probability of a risk and the impact it can have on the system or network
Probability/Impact Matrix
A probability/impact matrix or chart lists the relative probability of a risk occurring on one side of a matrix or axis on a chart and the relative impact of the risk occurring on the other
List the risks and then label each one as high, medium, or low in terms of its probability of occurrence and its impact if it did occur
Review Slide 18 Week 2
Review Slide 18 Week 2
Security Threats
Identify threats
Any potentially adverse occurrence that can
Harm or interrupt the systems in an organization, or
Cause a monetary loss to an organization
Rank threats according to
Their probability of occurrence
Likely cost if the threat occurs
Take the nature of business into account
Example: Internet banking vs. a restaurant
Bank’s web site: has a higher probability of attack and much bigger loss if happens
Restaurant web site: much less likely and small loss
