“Business Goals and Constraints.” Please respond to the following: •Discuss some of the key considerations in designing a network design strategy. What approaches have worked for you in your present role or would you propose in a future systems planning role for an organization? “Technical Goals and Tradeoffs.” Please respond to the following: •Describe how technical goals can be coupled with information assurance and security considerations in a network design project. 26/09/2018 1 © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson 2 Risk Management Planning 2 . CSCI-618: Information Security Risk Management and Legal Issues Page 3Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Developing a Risk Management Plan 26/09/2018 2 Page 4Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Objectives of a Risk Management Plan  A list of threats  A list of vulnerabilities  Costs associated with risks  A list of recommendations to reduce the risks  Costs associated with recommendations  A cost-benefit analysis  One or more reports Page 5Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Scope of Plan Dimensions  Extent the plan will be organized  Level of implementation  Range of view and outlook  Degree of application and operation  Measurement of effectiveness Page 6Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Assignment of Responsibilities Align resources Assign responsibilities Evaluate relationships 26/09/2018 3 Page 7Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Describing Procedures and Schedules for Accomplishment  Include a recommended solution for any threat or vulnerability, with a goal of mitigating the associated risk.  The solution will often include multiple steps. Page 8Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Describing Procedures and Schedules for Accomplishment  Describe each step in detail.  Include a timeline for completion of each step.  Remember: • Management is responsible for choosing the controls to implement. • Management is responsible for residual risk. Page 9Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Affinity Diagram 26/09/2018 4 Page 10Managing Risk.

1. “Business Goals and Constraints.” Please respond to the
following:
•Discuss some of the key considerations in designing a
network design strategy. What approaches have worked for you
in your present role or would you propose in a future systems
planning role for an organization?
“Technical Goals and Tradeoffs.” Please respond to the
following:
•Describe how technical goals can be coupled with information
assurance and security considerations in a network design
project.
26/09/2018
1
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Managing Risk in Information Systems
Lesson 2
Risk Management Planning
2 .
CSCI-618: Information Security
Risk Management and Legal

2. Issues
Page 3Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Developing a Risk Management Plan
26/09/2018
2
Page 4Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Objectives of a Risk Management Plan
-benefit analysis

3. Page 5Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Scope of Plan Dimensions
entation
Page 6Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Assignment of Responsibilities

4. 26/09/2018
3
Page 7Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Describing Procedures and
Schedules for Accomplishment
or vulnerability, with a goal of mitigating the
associated risk.
Page 8Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Describing Procedures and
Schedules for Accomplishment
or completion of each
step.
• Management is responsible for choosing the controls

5. to implement.
• Management is responsible for residual risk.
Page 9Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Affinity Diagram
26/09/2018
4
Page 10Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Reporting Requirements
recommendations
Page 11Managing Risk in Information Systems

6. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Reporting Requirements (Cont.)
• Findings
• Recommendation cost and time frame
• Cost-benefit analysis
summarized in risk statements
• Use risk statements to communicate a risk and the resulting
impact
Page 12Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Using a Cause and Criteria Diagram
26/09/2018
5

7. Page 13Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Using a Cause and Criteria Diagram
Page 14Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Plan of Action and Milestones
(POAM)
track progress
management follow-up
Page 15Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Milestone Plan Chart

8. 26/09/2018
6
Page 16Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Gantt Chart
ll project schedule
Page 17Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Critical Path Chart
Page 18Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Risk Management Functions

9. ent
26/09/2018
7
Page 19Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Summary
of a risk management plan

10. documentation
Page 20Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Chapter 5: “Defining Risk
Assessment Approaches”
Page 21Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Learning Objectives
threats, vulnerabilities, and exploits.
26/09/2018
8
Page 22Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company

11. www.jblearning.com
All rights reserved.
Key Concepts
in a risk assessment
Page 23Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
What Is Risk Assessment?
of risk
recognized threat
to implement

12. Page 24Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Why Is Risk Assessment Important?
protect
provide the most value
26/09/2018
9
Page 25Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
When Should a Risk Assessment
Be Conducted?
When evaluating risk

13. When evaluating a control
Periodically after a control has been implemented
Page 26Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Critical Components of Risk
Assessment
Identify scope of assessment
Identify critical areas
Identify team
Page 27Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Identify Potential Scope for Web Server RA

14. 26/09/2018
10
Page 28Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Quantitative and Qualitative RAs
• Calculates absolute financial values, losses, and costs
itative Risk Assessments
• Calculates relative values, losses, and costs
Page 29Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Quantitative Risk Assessment
• Identify the priority of risks
• Determine the effectiveness of controls
Page 30Managing Risk in Information Systems

15. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Quantitative Risk Assessment Key
Terms
Single loss expectancy (SLE)
Annual rate of occurrence (ARO)
Annual loss expectancy (ALE)
Safeguard value
26/09/2018
11
Page 31Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Quantitative Risk Assessment
Benefits
-benefit analysis (CBA)
• Accurate values for SLE, ARO, and safeguard value
let’s you calculate CBA

16. terminology; easy to grasp details of the assessment and
its recommendations
Page 32Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Quantitative Risk Assessment
Limitations
• Especially true when identifying ARO reductions
• May need to take additional steps, such as
training, to ensure users are aware of the
importance of the control
Page 33Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Qualitative Risk Assessment

17. • The likelihood that a threat will exploit a
vulnerability
• The negative result if a risk occurs
26/09/2018
12
Page 34Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Using a Risk Matrix
Page 35Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Qualitative Risk Assessment
Benefits

18. understand
Page 36Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Qualitative Risk Assessment
Limitations
• Value of the assessment is only as valuable as the
expertise of the experts
26/09/2018
13
Page 37Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.

19. Comparing Assessment Methods
Quantitative
• SLE, ARO, ALE
Qualitative
• Probability
and impact
Page 38Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Risk Assessment Challenges

20. target
tency
allocation and risk acceptance
Page 39Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Best Practices for Risk Assessment
ear
recommendations.