Risk Management

Week 1:
1. What is the role of the security risk assessment?

Security risk assessment help a company to detect vulnerabilities that in turn
helps the company set up defenses against attackers. Risk assessment assists in
identifying, assessing, mitigating and preventing threats and vulnerabilities.
This enables a company to develop risk profiles for their assets that allows for
measuring the risk and ranking it for assets. This allows for the prioritization of
risk and the reallocation of resources to. Security risk assessment involves the
“overall security management process” which ensures the acceptable allowable
risk of a company.
2. Why do we need a security risk assessment?

Most companies have PII that can either be of their employees, partners, clients
or customers. This confidential data either has to be transmitted, created or
stored and any delicate information being handled by a company should
undergo a risk assessment. The risk assessments are also required by law.
These laws include the HIPAA and the Sarbanes-Oxley Audit standard 5. So
under law a security risk assessment is required.
3. What is a Gap Assessment/analysis?

A gap assessment according to The Security Risk Assessment Handbook, “is the
comparison between what exists within a corporation and what is required.” A
gap assessment basically it is the quantitative and qualitative comparisons of
performances within a company that helps to determine how close or far they
are from a target. It can identify problems and find solutions for a company to
help a company get to where its target goal is.
Week 2:
The 6 phases are comprised of the following:

1) Project definition:This phase basically describes the scope and the
deliverables that the assessment aims to produce. This step is used in many
projects and is crucial because if well thought it out it can save time and money
in the long run.
2) Project Preparation: This phase ensures the proper preparations are taken in
executing the defined project scope. It prepares to ensure the executables of the
project will be successful are properly supported.
3) Data Gathering: The 3rd phase is broken up into 3 subcategories of data

gathering. The first, Administration data gathering, aims to analyze
and define the admin controls of the project which includes training, interviews,
and policy. The second subcategory is the technical data gathering. This sub
of data gathering looks to analyze and define the design, architecture
and security testing of the product. The third sub is the physical data gathering.
4) Risk Analysis: This category defines the risks of the project. It analyzes the
assets and what the vulnerabilities are. This phase calculates the risks and uses
the data gathered in the previous phase to do so.
5) Risk Mitigation: This phase looks to use the analysis previously deduced in
the other phases and create solutions to safeguard costs and ensure an effective
project.
6)Recommendations: This phase basically gives recommendations in regards to

the risks and creates the documentation with the resolutions.
Ensuring success of the project must first be defined. Based on the business
goals and what the project scope is, success must be defined to be able to
measure success. This is largely based on the technical report because this
deliverable will outlast any other trace of the project. This report is what is what
most consumers will use to judge the success of the project. The numbers dont
lie.
Week 3:
1. Explain how to prepare risk assessment.

There are steps that include introductions, briefing, setting milestones and
expectations of executables that are used in the preparation of risk assessment.
Planning tools are used and ideas developed in how the risk assessment will
enter the risk management process. Preparation helps to clarify the objectives of
the whole process and the meaning of success. Some steps involved include
defining the cope of permission, creating the accounts required, creating the
policies and ensure they do not violate and acts and laws. Preparation also
means creating the business mission. The business mission is the “reason for
existence.” To prepare the criticalities also have to be determined. This
determines the critical systems based off the various information systems.
Preparation will help plan the timing of all milestones and look to track success
and completion.
2. Describe the data gathering processes.

Gathering data is one of the first steps of developing a successful risk assessment.
This enables the team and others to develop an understanding of the scope involved
and what risks are associated with all aspects of the project. This involves an in
depth analysis of all associated aspects and systems. This exposes the
vulnerabilities in the security controls and evaluating the security requirements that
need to be met, mitigation can then be devised. Sampling is involved in data
gathering. The objective of sampling is to create characteristics of the total system
based the testing of a controlled portion. This helps when dealing with large
amounts of data.
Week 4:
1. Describe what administrative data gathering is.

Administrative data gathering is based on determining, analyzing and mitigating
administrative security threats with administrative safeguards. Administrative
threats include errors, omissions, fraud, waste abuse and excessive priveleges. The
admin areas in which these apply include human resources, organizational
structure, information control, and system control. Data gathering for Admin mostly
includes going through a large amounts of documents.
2. Describe what technical data gathering is.

Technical data gathering again includes data gathering that involves identifying
technical threats and enacting technical safeguards to protect against those threats.
The technical aspect of data gathering and the safeguards it aims to evoke look to
restrict user error. It looks to gather data from the technical data structure such as
the network, the storage used, technical policy statements, and network maps.

Risk Management

Uploaded by

Copyright:

Available Formats

Risk Management

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Risk Management

Uploaded by

Copyright:

Available Formats

Week 1:

1. What is the role of the security risk assessment?

2. Why do we need a security risk assessment?

3. What is a Gap Assessment/analysis?

The 6 phases are comprised of the following:

3) Data Gathering: The 3rd phase is broken up into 3 subcategories of data

6)Recommendations: This phase basically gives recommendations in regards to

1. Explain how to prepare risk assessment.

2. Describe the data gathering processes.

1. Describe what administrative data gathering is.

2. Describe what technical data gathering is.

You might also like