Fundamentals and Methods of Risk Assessments of Is

1431 Words6 Pages
Trident University Fundamentals and Methods of Risk Assessments of IS Module 1 Case Assignment ITM527: Security and Disaster Recovery Management Dr. Kenneth Phillips May 25, 2012 Introduction An effective risk management process is an important component of a successful information security program. The objective of an organization’s risk management process is to protect the organization and its ability to perform its mission, not just its information assets. Therefore, the risk management process should not be treated primarily as a technical function carried out by the information security experts who operate and manage the information security system, but as an essential management function of the organization that is tightly integrated into the system development lifecycle (SDLC). Risk management encompasses three processes: risk assessment, risk mitigation, and evaluation & assessment. Because the risk can’t be eliminated entirely, the risk management process allows information security program managers to balance the operational and economic costs of protective measures and achieve gains in mission capability (NIST, 2011). Principles and Fundamentals The most effective way to implement risk management is to identify systematically critical assets and operations, as well as vulnerabilities across the agency. Risk is the impact of the realized threat on vulnerability as per the following risk equation: Risk = Threat × Vulnerability × Event Cost. Threat is the likelihood that a particular vulnerability will be successfully attacked over a certain period. Vulnerability is any weakness in a given system whose exploitation leads to a violation well as any non-compliance with any mandated information security requirements. Event cost is the quantum value of the loss that is incurred if the vulnerability is successfully exploited. One of the

More about Fundamentals and Methods of Risk Assessments of Is

Open Document