Implementing a Best Practice Risk Assessment Methodology

Textbook , 2013 , 37 Pages

Business economics - Information Management

Risk assessments play a critical role in the development and implementation of effective information security programs and help address a range of security related issues from advanced persistent threats to supply chain concerns.
The results of risk assessments are used to develop specific courses of action that can provide effective response measures to the identified risks as part of a broad-based risk management process.
The guidance provided here uses the key risk factors of threats, vulnerabilities, impact to missions and business operations, and the likelihood of threat exploitation of weaknesses in information systems and environments of operation, to help senior leaders and executives understand and assess the current information security risks to information technology infrastructure.

Inhaltsverzeichnis (Table of Contents)

• I. Overview
• II. Scope
• III. About the author
• 1 Introduction
• 2 Risk management
• 2.1 Framing risk
• 2.2 Assessing risk
• 2.2.1 Risk assessment process
• 2.2.2 Risk models
• 2.1.2.1 Threat
• 2.1.2.2 Vulnerability
• 2.1.2.3 Likelihood
• 2.1.2.4 Impact
• 2.1.2.5 Aggregation
• 2.1.2.6 Uncertainty
• 2.2.3 Risk assessment approaches
• 2.2.3.1 Quantitative
• 2.2.3.2 Qualitative
• 2.2.3.3 Hybrid
• 2.2.4 Risk analysis approaches
• 2.2.4.1 Threat oriented
• 2.2.4.2 Asset oriented
• 2.2.4.3 Vulnerability oriented
• 2.3 Responding to risk
• 2.4 Monitoring risk
• 3 Preparing for the risk assessment
• 3.1 Purpose
• 3.2 Scope
• 3.3 Assumptions
• 3.4 Information sources
• 3.5 Roles and Responsibilities
• 4 Conducting the risk assessment
• 4.1 Risk assessment scope
• 4.2 Risk Assessment Process
• 4.2.1 Collect information
• 4.2.2 Identify systems or processes at risk
• 4.2.3 Evaluate the likelihood of harm occurring
• 4.2.4 Evaluate the impact
• 4.2.5 Determine risk for the item
• 4.2.6 Investigate options for eliminating or controlling risks
• 4.2.7 Prioritize action and decide on control measures
• 4.2.8 Implement controls
• 4.2.9 Measure the effectiveness of implemented actions
• 4.3 Assessing risks at organizational level
• 4.4 Assessing risks at the business process level
• 4.5 Assessing risks at the information system tier
• 4.6 Communicating risk information

Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)

This document provides a comprehensive guide to implementing a best practice risk assessment methodology for information technology. It aims to equip organizations with the tools and knowledge necessary to effectively identify, assess, and manage information security risks. The methodology emphasizes a structured approach, incorporating key risk factors such as threats, vulnerabilities, impact, and likelihood, to ensure a thorough and comprehensive assessment.

• Risk assessment process and methodology
• Information security risk management
• Threat identification and vulnerability analysis
• Risk mitigation and control strategies
• Communication and reporting of risk assessment findings

Zusammenfassung der Kapitel (Chapter Summaries)

The first chapter provides an overview of the importance of risk assessment in information security and outlines the key principles and objectives of the methodology. It emphasizes the need for a comprehensive approach that considers various risk factors and aligns with established standards and best practices.

Chapter 2 delves into the core concepts of risk management, including framing risk, assessing risk, responding to risk, and monitoring risk. It explores different risk assessment models, approaches, and analysis techniques, providing a detailed understanding of the various methods available for evaluating information security risks.

Chapter 3 focuses on the preparation phase of the risk assessment process. It outlines the key steps involved in defining the purpose, scope, assumptions, and information sources for the assessment. It also emphasizes the importance of establishing clear roles and responsibilities for the assessment team.

Chapter 4 provides a step-by-step guide to conducting the risk assessment. It covers the process of collecting information, identifying systems or processes at risk, evaluating the likelihood and impact of threats, determining risk levels, investigating mitigation options, prioritizing actions, implementing controls, and measuring the effectiveness of implemented measures. It also discusses the assessment of risks at different organizational levels, including the organizational level, business process level, and information system tier.

Schlüsselwörter (Keywords)

The keywords and focus themes of the text include risk assessment, information security, risk management, threat identification, vulnerability analysis, risk mitigation, control measures, information technology, best practices, and NIST Special Publication 800-39.

• Author: Eric Vanderburg (Author)
• Publication Year: 2013
• Pages: 37
• Catalog Number: V282608
• ISBN (eBook): 9783656820468
• ISBN (Book): 9783656820451
• Language: English
• Tags: implementing, best, practice, risk, assessment, methodology