This document discusses risk identification and management for information technology assets. It defines risk as the probability and consequence of an event, and defines assets as anything tangible or intangible that is worth protecting. The document outlines the risk identification process, which includes identifying assets, threats, vulnerabilities, and consequences to estimate risks. It discusses maintaining a risk register to consolidate risk information and methods for identifying risks, such as interviews, workshops, and vulnerability assessments.

1. RISK IDENTIFICATION 1

2. Overview
• Asset Identification
• Asset Classification
• Key Terms
• Risk Elements and Factors
• Context Establishment
• IT Risk Identification Process
• Risk Scenarios and Risk Register
• Risk Matrix
2

3. What is Risk?
• Risk is the combination of the probability of an event and its
consequence
• Information technology or IT risk is basically any threat to your
business data, critical systems and business processes
3

4. Asset
• An asset is something of either tangible or intangible value that is worth
protecting. Examples of assets commonly found in organizations include:
• Information
• Reputation
• Brand
• Intellectual property
• Facilities
• Equipment
• Cash and investments
• Customer lists
• Research
• People
• Service/business process
4

5. Risk Identification
• Risk identification is the process for
discovering, recognizing and
documenting the risk an organization
faces, and it is the first of the four
processes that operate within the risk
management life cycle
5

6. Governance & Risk Management 6

7. Elements of Risk
• Asset
• Threat
• Vulnerability
7

8. Risk Factors
• External
• Internal
8

9. Key Terms in Risk Identification
• Asset
• Asset Value
• Impact
• Impact Analysis
• Threat
• Threat Analysis
• Threat Vector
• Vulnerability
• Vulnerability Analysis
• Vulnerability Scanning
9

10. Risk Factors 10

11. Threat Types
• Physical
• Natural events
• Loss of essential services
• Disturbance due to radiation
• Compromise of information
• Technical failures
• Unauthorized actions
• Compromise of functions
11

12. Risk Identification Process
• The process of risk identification serves as the input to another
aspect of risk management
• Identify Assets
• Identify Threats
• Identify Existing Controls
• Identify Vulnerabilities
• Identify Consequences
• Risk Estimation Process
12

13. Methods of Risk Identification
• The risk practitioner has several possible sources for identification of risk
including:
• Historical
• Audit or Incident Reports
• Public Media
• Annual Reports
• Systematic Approaches
• Vulnerability assessment
• Review of business continuity and disaster recovery plans
• Interviews and workshops with managers, employees, customers,
suppliers and auditors
• Inductive methods (theoretical analysis), where a team examines a process
to determine the possible point of attack or compromise, such as
penetration testing
13

14. Risk Register
• Organizations maintain risk
registers in order to
consolidate all information
about risk into one central
repository
• The risk register allows senior
management and the managers
of each department to obtain
the status of the risk
management process from a
single source
14

15. IT CONCEPTS AND AREAS OF CONCERN FOR
THE RISK PRACTITIONER
• Hardware
• Software
• OS
• Applications
• Environmental Controls
• Platforms
• Network Components
• Cabling
• Switches/Routers
• Firewalls
• Network Architecture
15