Identifying the risk to an organization.
Risk is the potential for loss that requires protection.
Risk management provides a basis for valuing an
organization’s information assets.
Risk is the measure of vulnerabilities and threats.
Vulnerabilities make computer systems and networks prone
to technical, non-technical, or social engineering attacks.
It is characterized by the difficulty and the level of technical
skill that is required to exploit it.
The result of such exploitation must also be considered.
A threat is an action or event that violates the security of
an information system environment.
It can have multiple targets.
The components of threat are targets, agents, and events.
The targets of threat or attack are security services such as:
Confidentiality - Disclosure of classified information to
Integrity - Tampering of information.
Availability - Denial-of-service attack.
Accountability - Prevents organization from reconstructing past
The characteristics of agents who are the people who may wish to
harm the organization are:
Access - An agent must have direct or indirect access to system,
network, facility, or information.
Knowledge - An agent must have some knowledge about the
target. More familiar an agent is with the target, more likely the
agent will know about the vulnerabilities.
Motivation - An agent may tamper with information as a
challenge, greed to gain something, or purely with a malicious
A threat occurs when an agent with access and knowledge gains
motivation to take action. Such agents could be:
Employees having necessary access and knowledge to systems.
Ex-employees having any grudges.
Hackers, terrorists, and criminals with a malicious intent to
harm the organization.
Commercial rivals who are interested in classified business
information of the organization.
Events are the ways in which an agent of threat may cause
harm to an organization.
It is the extent of harm that could possibly be done if the
agent gained access.
Risk and How to Identify the Risk to
Risk is the combination of
threat and vulnerability.
Risks can be categorized as low,
medium, or high-risk.
To identify specific vulnerabilities:
Locate all the entry points (electronic and physical) to the
Identify system configurations.
Identify which information and systems are accessible.
Include any known vulnerabilities in operating systems and
Identifying Real Threats
Real or targeted threats may not show themselves until an
event has occurred.
All targeted threats are time-consuming and difficult.
Countermeasures for each access point within an
organization must be identified.
Some of the countermeasures include firewalls, anti-virus
software, access control mechanisms, and biometrics.
Identify specific risks to the organization.
Identify what possible harm can be done through each
Rate each risk as high risk, medium risk, or low risk. The
same vulnerability may pose different levels of risk based
on the access point.
Risks can be measured in terms
Reputation and lost
The cost for managing risks include:
Stolen equipment or money.
Cost of an investigation.
Cost to repair or replace systems.
Cost of experts to assist.
The amount of time taken to manage risks may include:
The time a technical staff member is unavailable to perform
normal tasks due to a security event.
The downtime of a key system.
Delay in product delivery or service.
Includes people, systems, communication lines,
applications, or access as resources.
Computes the monetary cost of using a resource to
Reputation and Lost Business
Data compromise can affect the
Future business is in jeopardy
as people lose faith in the brand
Losses due to system failures
and production delay cannot be
To measure risk:
Identify the extent of risk – best case, worst case, or most
Identify the damage in terms of money, time, resources,
reputation, and lost business.
Identify the cost of restoration.
Examine the potential results in each risk measurement area.
Develop appropriate risk management approaches.
Security is managing risk.
To identify risks, identify vulnerabilities, and threats.
Examine countermeasures for each risk.
Identify the extent of risk.
Measure risk in terms of money, time, resources, reputation,
and lost business.