ICT380 - Workshop 9

Risk Management
Si Risk Statement Approach Remark

No.
1 FTP is being used by the clients to receive data from Defense Need to provide a fix
the company. immediately.
2 Still using Windows XP SP2. Defense Need to upgrade
immediately.
3 The stairs in the building directly leads to the upper Mitigation Can be mitigated with
levels from the basement. better security.
4 A visitor is escorted inside the building but while Mitigation Can be mitigated by
going out the visitor is not escorted. providing escort out.
5 The sales team are provided laptops which have the Defense Need to change the
facility to attach an external hard drive. practice.
6 As per the IT policy the users are advised to changed Acceptance Proper awareness and
passwords periodically. software enforcement.
7 The door or access to the lobby and the server room Mitigation Keep the door locked.
are always kept open.
8 The process of keeping the backup tapes in the same Acceptance Need to set up proper
location as of the server. BCP location for tapes.
It is very necessary to manage the risks in the project to make sure that the project keeps
working in the way it is supposed to. To achieve this we must identify the risk which we did in
the previous assignment and then we need to develop the strategy to manage the risk. There
can be five type of risk response and they are:
Defense
This is the strategy where we defend our system from the risk by changing the scope, planning
and scheduling activities in a different manner. We use this strategy when we are well aware of
the possibility of the occurrence of the risk and we have the tools to defend the system against
the risk and protect the system from having any serious damage.
For example, if the company is using an outdated operating system then in defense to this risk
we can change the operating system to a newer version.
Transfer
This strategy means that we can transfer the risk to some other third party supplier or vendor
who is professionally capable to handle the risk type. This strategy is used when handling of
certain risk is not possible with the current capability of the company or handling by self will
mean investing a lot of time, effort or money which does not seems logical.
For example certain data link at the client side is not active and due to that the company is not
able to send data to that client. Now we can transfer this risk to the client’s end as it will be
their IT department’s responsibility to fix the issue.
Mitigation
The risk of a system is the combination of Level of the risk means the severity of the risk and
the probability of the risk to occur in the real life. Now to mitigate the risk means that we can
reduce the severity of risk means the effect of the risk is reduced by making some adjustments
or by reducing the probability of the occurrence of the risk in the system. This way the risk will
be mitigated to some point but not entirely expired.
For example if the visitor is not escorted out of the office by someone then we can mitigate the
risk by assigning someone to escort the visitor out of the office when his work is done. This will
reduce the probability of the occurrence of the risk and it does not completely terminates the
risk.
Acceptance
If for certain type of risk, we do not take any action and just accept the risk, then that type of
risk response strategy is called acceptance. This strategy is used for non-critical risk or the effort
involved in resolving the risk is far higher than the actual effect of the risk. The risk response of
the acceptance strategy can be active or passive. Active acceptance can be that situation when
there will be some back up plan for the risk have kept in place and passive acceptance is when
we just note down the risk and move on.
For example suppose the system is built with a BCP strategy in the event of disaster in the city
but in the case of global pandemic that BCP strategy will be useless as all the location has been
hit by the pandemic, so in this type of probable risk we can just note done the risk and do
nothing about it.
Termination
When a risk is completely mitigated and new systems have been implements which ensure that
certain type of risk will never reoccur then we can mark the risk as terminated as the risk no
longer exist.
For example if there is a risk that there is no specialised resource for certain type of technology
and when we hire a new associate for that post and he takes over the responsibility, then the
risk is terminated.
Incident Response Plan (IRP)
Incident Response Plan is the set of steps which is predetermined by the IT security team and
will be executed in the event of any cyber security breach. For this we will have a plan, a
dedicated team which will be trained to manage the incident and minimise the extent of
damage and cost of recovery. There is generally accepted 6-sets framework that is widely
accepted and used:
1. Preparation: This is the first step of the response action, the IRP needs to work like
clockwork and there cannot be any gaps. The team handling it must have all the
resources that are required for the IRP. The resources can include well documented
activity list, step-by-step guide and the internal and external communication guidelines.
2. Identification: When the team should be activated or how the team will recognise the
need to start working need to be explained. Like what the team will do if it finds that the
external server is under DDoS attack or there has been an unauthorised breach attempt
on any of the server nodes.
3. Containment: This means that intrusion is contained to some extent. Containment can
be of two types, short and long. The short containment is the immediate action when
the intrusion is contained to few of the systems to stop the spreading. The effected
systems are backed up to save data and the systems are sent for forensics. The long
term containment is when the systems are allowed to perform business activities except
the infected system and accounts.
4. Eradication: The next step is to remove the infection and restore the affected systems.
The backdoor or point of intrusion needs to be patched immediately so that this type of
breach does not happen again. The steps to restore the affected systems will be to
reimage all the systems which had the intrusion and remove any trace of the infection.
5. Recovery: This is the step to bring all the system to production after making sure that all
the systems are clean and no residual code of the intrusion is left in the system.
6. Lesson Learned: This step is performed to understand the extent of the attack and
update the breach details and any identified deficiencies or weakness in the system.
Disaster Recovery Plan (DRP)

In an industry and IT infrastructure is implemented to ease out the data processing and support
the business activities. In the event of any type of disaster, be it small or big, the company
should be ready with a disaster recovery plan which will help the company to recover from that
disaster with as low as possible damage. The damages to the company data and other assets
like servers, workstations, printers etc. should be minimum and they should be back to service
once the disaster has passed. Below are the steps that the company will take for DRP:
1. Inventory the assets of the company.
2. Define the tolerance of any downtime by the business team.
3. The DRP team should be always ready for activity.
4. An internal and external communication plan should be ready.
5. Have the evacuation plan pasted at all the important location of the office area.
6. The Service Level Agreement must contain the DRP in consideration.
7. The procedure to handle sensitive information must be handled.
8. The DRP drill must be conducted regularly.
Business Continuity Plan (BCP)

The is a strategy to keep the business going in the event of a disaster. A BCP is planned in
conjunction with the Disaster recovery plan. A BCP is invoked by a company when the current
location of the office becomes unsuitable for continuing business due to disaster or some kind
of breach. A lot of the companies which fails to prepare a BCP, often fails to survive 6 months
after any major disaster. There need to be 16 areas where the BCP should focus:
Si No Vital Area This company's status
Fire
Flood and water damage
Earthquake
Hurricane
Bomb Threat
Terrorist Attack
1 Threat Matrix Malicious Intruder
Social Engineering Attack
Denial of Service Attack
Pervasive Malware Attack
Stolen Confidential Information (digital and documents)
Loss of Key Digital Files and/or Databases
Server Failure
Customer Seismic Data Processing.

2 Critical Processes Support for SensorDril and MeasureMe Software.
Research on new product release
Who Can Declare
A Company
3 CIO
Emergency or
Disaster
Evacuation of In case of fire alarm or disaster notification employees will have to follow instructions and
4
Facility evacuate to safe locations
Contact Details of Client
Contact of Admin
Communication
5 Contact of C-Class executives
Plan
Call Tree of the whole office team.
Contact of third Party vendors
6 Backup Facilities Backup Facility in another location
Emergency and Emergency contact of Network Teams, Admin Teams, and Transport Team are available.
7
Vendor Numbers Emergency contact of Vendors is available with the admin teams.
Employee
There is a special call tree available in the case of disaster which mentions the hierarchy
8 Contact
also.
Information
9 Vendor List All vendor list is available with office admins
10 Client Contacts Client contacts are available with concerned teams.
For every office related issues, Admins are the single point of contact.
Notification
11 For every network related issues. Network team is concerned.
Matrix
For any other issue, there is a reception desk to call into.
Insurance,
12 Financial, and There is point of contact for insurance, Finance, Legal departments.
Legal Contacts
For every Licenses and Permits, first employees have to contact to concerned department
Licenses &
13 like for software license they will have to contact software dept. etc.
Permits
For those licenses which are not present with company, Legal dept. will help in that.
Disaster
14 Recovery A full fledge DRP is implemented
Systems
Hardware
15 Hardware inventory in kept as per DRP
Inventory
Software
16 Software inventory in kept as per DRP
Inventory

ICT380 - Workshop 9

Uploaded by

Copyright:

Available Formats

ICT380 - Workshop 9

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ICT380 - Workshop 9

Uploaded by

Copyright:

Available Formats

Risk Management

Si Risk Statement Approach Remark

Disaster Recovery Plan (DRP)

Business Continuity Plan (BCP)

Si No Vital Area This company's status

Customer Seismic Data Processing.

You might also like