MODULE 4

IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 93

RISK MANAGEMENT

Topics

1. Introduction
2. Overview of Risk Management
3. Risk Identification
4. Risk Assessment
5. Risk Control and Strategies
6. Selecting a Risk Control Strategies
7. Quantitative VS Qualitative Risk Control Practices

Learning Objectives

Define risk management, risk identification, and risk control

Describe how risk is identified and assessed
Assess risk based on probability of occurrence and likely
impact
Explain the fundamental aspects of documenting risk via the
process of risk assessment
Describe the various risk mitigation strategy options
Identify the categories that can be used to classify controls
Recognize the existing conceptual frameworks for evaluating
risk controls and formulate a cost benefit analysis
Describe how to maintain and perpetuate risk controls

Content

1. Introduction

In the early days of information technology, corporations used

IT systems mainly to gain a definitive advantage over the
competition. Establishing a competitive business model,
method, or technique enabled an organization to provide a
product or service that was superior and created a competitive
advantage. This earlier model has given way to one in which
all competitors have reached a certain level of automation.

IT is now readily available to all organizations that make the

investment, allowing competitors to react quickly to changes
in the market. In this highly competitive environment,
organizations cannot expect the implementation of new
technologies to provide a competitive lead over others in the
industry. Instead, the concept of competitive disadvantage—
falling behind the competition—has emerged. Effective IT-
enabled organizations quickly absorb emerging technologies
now, not to gain or maintain competitive advantage, but to
avoid loss of market share resulting from an inability to
maintain the highly responsive services required in today’s
marketplaces.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 94

To keep up with the competition, organizations must design and

create safe environments in which business processes and
procedures can function. These environments must maintain
confidentiality and privacy and assure the integrity of
organizational data — objectives that are met via the
application of the principles of risk management.

2. Overview of Risk Management

Risk management is the process of identifying risk, as

represented by vulnerabilities, to an organization’s
information assets and infrastructure, and taking steps to
reduce this risk to an acceptable level.

When an organization depends on IT-based systems to remain

viable, information security and the discipline of risk
management must become an integral part of the economic basis
for making business decisions. These decisions are based on
trade-offs between the costs of applying information systems
controls and the benefits realized from the operation of
secured, available systems.

Risk management involves three major undertakings:

a) Risk identification - is the examination and

documentation of the security posture of an
organization’s information technology and the risks it
faces.

b) Risk assessment - is the determination of the extent to

which the organization’s information assets are exposed
or at risk.

c) Risk control - is the application of controls to reduce

the risks to an organization’s data and information
systems.

The defenders attempt to prevent, protect, detect, and recover

from a seemingly endless series of attacks. Moreover, those
defenders are legally prohibited from deploying offensive
tactics, so the attackers have no need to expend resources on
defense.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 95

In order to be victorious, you, a defender, must;

a) Know Your Self

First, you must identify, examine, and understand the

information and systems currently in place within your
organization. This is self-evident. To protect assets,
which are defined here as information and the systems
that use, store, and transmit information, you must know
what they are, how they add value to the organization,
and to which vulnerabilities they are susceptible. Once
you know what you have, you can identify what you are
already doing to protect it.

b) Know the Enemy

This means identifying, examining, and understanding the

threats facing the organization. You must determine which
threat aspects most directly affect the security of the
organization and its information assets, and then use
this information to create a list of threats, each one
ranked according to the importance of the information
assets that it threatens.

Management and users, when properly trained and kept aware of

the threats the organization faces, play a part in the early
detection and response process.

Management must also ensure that sufficient resources (money

and personnel) are allocated to the information security and
information technology groups to meet the security needs of
the organization.

Users work with the systems and the data and are therefore
well positioned to understand the value these information
assets offer the organization and which assets among the many
in use are the most valuable.

3. Risk Identification

A risk management strategy requires that information security

professionals know their organizations’ information assets —
that is, identify, classify, and prioritize them. Once the
organizational assets have been identified, a threat

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 96

assessment process identifies and quantifies the risks facing

each asset.
Steps of Risk Identification

1st Steps: Plan and Organize the Process

The first step in the Risk Identification process is to follow

your project management principles. You begin by organizing a
team, typically consisting of representatives of all affected
groups. With risk identification, since risk can exist
everywhere in the organization, representatives will come from
every department from users, to managers, to IT and InfoSec
groups.

The process must then be planned out, with periodic

deliverables, reviews, and presentations to management.

2nd Steps: Asset Identification and Inventory

This iterative process begins with the enumeration of assets,

including all of the elements of an organization’s system,
such as people, procedures, data and information, software,
hardware and networking elements. Then, you classify and
categorize the assets, adding details as you dig deeper into
the analysis.

3rd Steps: People, Procedures, and Data Asset Identification

Identifying human resources, documentation, and data assets is

more difficult than identifying hardware and software assets.
People with knowledge, experience, and judgment should be
assigned the task. As the people, procedures, and data assets
are identified, they should be recorded using a reliable data-
handling process.

When deciding which information assets to track, consider the

following asset attributes:

People: Position name/number/ID (avoid names and stick to

identifying positions, roles, or functions); supervisor;
security clearance level; special skills
Procedures: Description; intended purpose; relationship
to software, hardware, and networking elements; storage
location for reference; storage location for update
Data: Classification; owner, creator, and manager; size
of data structure; data structure used (sequential or
relational); online or offline; location; backup
procedures employed

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 97

4th Steps: Hardware, Software and Network Assets identification

Which attributes of hardware, software, and network assets

should be tracked? It depends on the needs of the organization
and its risk management efforts, as well as the preferences and
needs of the information security and information technology
communities.

Consider including the following asset attributes:

Name: Use the most common device or program name.

Organizations may have several names for the same
product.

IP address: This can be a useful identifier for network

devices and servers, but does not usually apply to
software.

Media access control (MAC) address: MAC addresses are

sometimes called electronic serial numbers or hardware
addresses.

Serial number: For hardware devices, the serial number

can uniquely identify a specific device. Some software
vendors also assign a software serial number to each
instance of the program licensed by the organization.

Manufacturer name: Record the manufacturer of the device

or software component. This can be useful when responding
to incidents that involve these devices or when certain
manufacturers announce specific vulnerabilities.

Manufacturer’s model number or part number: Record the

model or part number of the element. This record of
exactly what the element is can be very useful in later
analysis of vulnerabilities, because some vulnerability
instances only apply to specific models of certain
devices and software components.

Software version, update revision, or FCO number:

Whenever possible, document the specific software or
firmware revision number and, for hardware devices, the
current field change order (FCO) number.

Physical location: Note where this element is located

physically. This may not apply to software elements, but

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 98

some organizations have license terms that specify where

software can be used.
Logical location: Note where this element can be found on
the organization’s network. The logical location is most
useful for networking devices and indicates the logical
network where the device is connected.

Controlling entity: Identify which organizational unit

controls the element. Sometimes a remote location’s
onsite staffs controls a networking device, and at other
times the central networks team controls other devices of
the same make and model.

5th Steps: Data Classification and Management

Data classification scheme is used to help secure the

confidentiality and integrity of information.

Information owners are responsible for classifying the

information assets for which they are responsible. At least
once a year, information owners must review information
classifications to ensure the information is still classified
correctly and the appropriate access controls are in place.

The typical information classification scheme has three

categories:

a) Confidential: Used for the most sensitive corporate

information that must be tightly controlled, even within
the company. Access to information with this
classification is strictly on a need-to-know basis or as
required by the terms of a contract. Information with
this classification may also be referred to as
“sensitive” or “proprietary.”

b) Internal: Used for all internal information that does not

meet the criteria for the confidential category and is to
be viewed only by corporate employees, authorized
contractors, and other third parties.

c) External: All information that has been approved by

management for public release.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 99

6th Steps: Classifying and Prioritizing Information Assets

A data classification scheme generally requires a

corresponding personnel security clearance structure, which
determines the level of information individuals are authorized
to view, based on what they need to know.

There are 3 Data classification categories, confidential,

internal, and public.

7th Steps: Information Asset Valuation

To assign value to information assets for risk assessment

purposes, you can pose a number of questions and collect your
answers on a worksheet like the one shown in Figure 4-5 for
later analysis. Before beginning the inventory process, the
organization should determine which criteria can best
establish the value of the information assets.

Criteria to be considered is:

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 100

a) Which information asset is the most critical to the

success of the organization?
b) Which information asset generates the most revenue?
c) Which information asset generates the most profitability?
d) Which information asset would be the most expensive to
replace?
e) Which information asset would be the most expensive to
protect?
f) Which information asset would most expose the company to
liability or embarrassment if revealed?

7th Steps: Information Assets Prioritization

In this process, each information asset is assigned a score

for each of a set of assigned critical factor. In the example
shown in Table 4-2, there are three assigned critical factors
and each asset is assessed a score for each of the critical
factors. In the example, the scores range from 0.1 to 1.0,
which is the range of values recommended by NIST SP800-30,
Risk Management for Information Technology Systems a document
published by the National Institute of Standards and
Technology.

8th Steps: Identifying and Prioritizing Threats

After identifying and performing the preliminary

classification of an organization’s information assets, the
analysis phase moves on to an examination of the threats
facing the organization. A wide variety of threats face an
organization and its information and information systems. The
realistic threats must be investigated further while the
unimportant threats are set aside.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 101

You can begin a threat assessment by answering a few basic

questions, as follows:

a) Which threats present a danger to an organization’s assets

in the given environment?
b) Which threats represent the most danger to the
organization’s information?
c) How much would it cost to recover from a successful attack?
d) Which of the threats would require the greatest expenditure
to prevent?

9th Steps: Vulnerability Identification

Once you have identified the organization’s information assets

and documented some criteria for beginning to assess the
threats it faces, you then review each information asset for
each threat it faces and create a list of vulnerabilities.

What are vulnerabilities? They are specific avenues that

threat agents can exploit to attack an information asset. They
are chinks in the armor — a flaw or weakness in an information
asset, security procedure, design, or control that could be
exploited accidentally or on purpose to breach security.

4. Risk Assessment

Now that you have identified the organization’s information

assets and the threats and vulnerabilities, you can evaluate
the relative risk for each of the vulnerabilities. This

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 102

process is called risk assessment. Risk assessment assigns a

risk rating or score to each information asset.
While this number does not mean anything in absolute terms, it
is useful in gauging the relative risk to each vulnerable
information asset and facilitates the development of
comparative Ratings later in the risk control process.

The following sections itemize the factors that are used to

calculate the relative risk for each vulnerability.

Likelihood

Likelihood is the probability that a specific vulnerability

will be the object of a successful attack. Many
asset/vulnerability combinations have sources for likelihood,
for example:

• The likelihood of a fire has been estimated actuarially

for each type of structure.
• The likelihood that any given e-mail contains a virus or
worm has been researched.
• The number of network attacks can be forecast based on
how many assigned network addresses the organization has.

Identify Possible Control

For each threat and its associated vulnerabilities that have

residual risk, you must create a preliminary list of potential
controls. Residual risk is the risk to the information asset
that remains even after the application of controls.

There are three general categories of controls: policies,

programs, and Security technologies.

a) Policies are documents that specify an organization’s

approach to security.

There are 4 types of security policies:

1. General security policy is an executive-level

document that outlines the organization’s approach
and attitude toward information security and relates
the strategic value of information security within
the organization. This document, typically created
by the CIO in conjunction with the CEO and CISO,
sets the tone for all subsequent security
activities.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 103

2. Program security policy is a planning document that

outlines the process of implementing security in the
organization. This policy is the blueprint for the
analysis, design, and implementation of security.
3. Issue specific policies address the specific
implementations or applications of which users
should be aware. These policies are typically
developed to provide detailed instructions and
restrictions associated with security issues,
Examples include policies for Internet use, e-mail,
and access to the building.
4. Systems specific policies address the particular use
of certain systems. This could include firewall
configuration policies, systems access policies, and
other technical configuration areas.
b. Programs are activities performed within the organization
to improve security. These include security education,
training, and awareness programs.
c. Security technologies are the technical implementations
of the policies defined by the organization

Documenting the Result of Risk Assessment

By the end of the risk assessment process, you probably have in

hand long lists of information assets with data about each of
them. The goal so far has been to identify the information
assets that have specific vulnerabilities and list them, ranked
according to those most needing protection. In preparing this
list, you collected and preserved a wealth of factual
information about the assets, the threats they face, and the
vulnerabilities they expose. You should also have collected
some information about the controls that are already in place.
The final summarized document is the ranked vulnerability risk
worksheet, a sample of which is shown in Table 4-9.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 104

5. Risk Control and Strategies

Once the project team for information security development has

created the ranked vulnerability worksheet, the team must
choose one of five basic strategies to control each of the
risks that result from these vulnerabilities.

The five strategies are,

a. Defend- The defend control strategy attempts to prevent the

exploitation of the vulnerability. This is the preferred
approach and is accomplished by means of countering threats,
removing vulnerabilities from assets, limiting access to
assets, and adding protective safeguards. There are three
common methods used to defend:

• Application of policy
• Education and training
• Application of technology

b. Implementing the Defend Strategy

Organizations can mitigate risk to an asset by countering

the threats it faces or by eliminating its exposure.

Another defend strategy is the implementation of security

controls and safeguards to deflect attacks on systems and
therefore minimize the probability that an attack will be

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 105

successful. An organization with dial-in access

vulnerability, for example, may choose to implement a
control or safeguard for that service.

c. Transfer

The transfer control strategy attempts to shift risk to

other assets, other processes, or other organizations. This
can be accomplished by rethinking how services are offered,
revising deployment models, outsourcing to other
organizations, purchasing insurance, or implementing service
contracts with providers.

This principle should be considered whenever an organization

begins to expand its operations, including information and
systems management and even information security. If an
organization does not already have quality security
management and administration experience, it should hire
individuals or firms that provide such expertise

d. Mitigate

The mitigate control strategy attempts to reduce the impact

caused by the exploitation of vulnerability through planning
and preparation. This approach requires the creation of
three types of plans: the incident response plan, the
disaster recovery plan, and the business continuity plan.
Each of these plans depends on the ability to detect and
respond to an attack as quickly as possible and relies on
the quality of the other plans. Mitigation begins with the
early detection that an attack is in progress and a quick,
efficient, and effective response.

• Incident Response Plan - The actions an organization

can and perhaps should take while an incident is in
progress should be specified in a document called the
incident response (IR) plan. The IR plan provides
answers to questions victims might pose in the midst
of an incident, such as “What do I do now?
• Disaster Recovery Plan - The most common of the
mitigation procedures is the disaster recovery (DR)
plan. Although media backup strategies are an integral
part of the DR plan, the overall program includes the
entire spectrum of activities used to recover from an
incident. The DR plan can include strategies to limit
losses before and during the disaster. These

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 106

strategies are fully deployed once the disaster has

stopped
• Business Continuity Plan The business continuity (BC)
plan is the most strategic and long term of the three
plans. It encompasses the continuation of business
activities if a catastrophic event occurs, such as the
loss of an entire database, building, or operations
center. The BC plan includes planning the steps
necessary to ensure the continuation of the
organization when the scope or scale of a disaster
exceeds the ability of the DR plan to restore
operations. This can include preparation steps for
activation of secondary data centers, hot sites, or
business recovery sites,

e. Accepts

The accept control strategy is the choice to do nothing to

protect a vulnerability and to accept the outcome of its
exploitation. This may or may not be a conscious business
decision. The only industry-recognized valid use of this
strategy occurs when the organization has done the
following:

• Determined the level of risk

• Assessed the probability of attack
• Estimated the potential damage that could occur from
attacks
• Performed a thorough cost benefit analysis
• Evaluated controls using each appropriate type of
feasibility
• Decided that the particular function, service,
information, or asset did not justify the cost of
protection

f. Terminate

The terminate control strategy directs the organization to

avoid those business activities that introduce
uncontrollable risks. If an organization studies the risks
from implementing business-to-consumer e-commerce operations
and determines that the risks are not sufficiently offset by
the potential benefits, the organization may seek an
alternate mechanism to meet customer needs—perhaps
developing new channels for product distribution or new

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 107

partnership opportunities. By terminating the questionable

activity, the organization reduces the risk exposure.

6. Selecting a Risk Control Strategies

“Top 10 Security Mistakes”

1. Passwords on Post-it notes

2. Leaving unattended computers on
3. Opening e-mail attachments from strangers
4. Poor password etiquette
5. Laptops on the loose (unsecured laptops that are easily
stolen)
6. Blabbermouths (people who talk about passwords)
7. Plug and play (technology that enables hardware devices to
be installed and configured without the protection provided by
people who perform installations)
8. Unreported security violations
9. Always behind the times (the patch procrastinator)
10. Not watching for dangers inside the organization

When weighing the benefits of the different strategies, keep

in mind that the level of threat and value of the asset should
play a major role in strategy selection.

• When a vulnerability (flaw or weakness) exists: Implement

security controls to reduce the likelihood of a
vulnerability being exercised.

• When a vulnerability can be exploited: Apply layered

protections, architectural designs, and administrative
controls to minimize the risk or prevent occurrence.

• When the attacker’s cost is less than his or her

potential gain: Apply protections to increase the
attacker’s cost (e.g., use system controls to limit what
a system user can access and do, thereby significantly
reducing an attacker’s gain).

• When potential loss is substantial: Apply design

principles, architectural designs, and technical and
nontechnical protections to limit the extent of the
attack, thereby reducing the potential for loss.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 108

Ways before implementing a Control Strategies is to conduct a,

a. Feasibility Studies

Before deciding on the strategy (defend, transfer,

mitigate, accept, or terminate) for a specific
vulnerability, the organization must explore all the
economic and noneconomic consequences of the
vulnerability facing the information asset. This is an
attempt to answer the question, “What are the actual and
perceived advantages of implementing a control as opposed
to the actual and perceived disadvantages of implementing
the control?

b. Cost Benefit Analysis (CBA)

In its simplest definition, CBA (or economic feasibility)

determines whether or not a particular control is worth
its cost. CBAs may be calculated before a control or
safeguard is implemented to determine if the control is
worth implementing. CBAs can also be calculated after
controls have been functioning for a time. Observation
over time adds precision to the evaluation of the
benefits of the safeguard and the determination of
whether the safeguard is functioning as intended.

c. Evaluation, Assessment, and Maintenance of Risk Control

The selection and implementation of a control strategy is

not the end of a process; the strategy, and its
accompanying controls, must be monitored and re-evaulated
on an on-going basis to determine their effectiveness and
to calculate more accurately the estimated residual risk.

7. Quantitative VS Qualitative Risk Control Practices

The many steps described previously were performed using

actual values or estimates. This is known as a quantitative
assessment. However, an organization could decide that it
cannot put specific numbers on these values. Fortunately, it
is possible to repeat these steps using an evaluation process,
called qualitative assessment, that does not use numerical
measures. For example, instead of placing a value of once
every 10 years for the ARO, the organization could list all
possible attacks on a particular set of information and rate
each by the probability of occurrence.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 109

This could be accomplished using scales rather than specific

estimates. A sample scale could include none, representing no
chance of occurrence, then low, medium, high, up to very high,
representing almost certain occurrence. Organizations may, of
course, prefer other scales: A–Z, 0–10, 1–5, or 0–20. Using
scales also relieves the organization from the difficulty of
determining exact values. Many of these same scales can be
used in any situation requiring a value, even in asset
valuation.

Benchmarking and Best Practices

Instead of determining the financial value of information and

then implementing security as an acceptable percentage of that
value, an organization could take a different approach to risk
management and look to peer organizations for benchmarks.

Benchmarking is the process of seeking out and studying the

practices used in other organizations that produce results you
would like to duplicate in your organization. An organization
typically benchmarks itself against other institutions by
selecting a measure upon which to base the comparison. The
organization then measures the difference between the way it
conducts business and the way the other organizations conduct
business.

Applying Best Practices

The preceding sections have presented a number of sources you

can consider when applying standards to your organization. You
can study the documented best practice processes or procedures
that have been shown to be effective and are thus recommended
by a person or organization and evaluate how they apply to
your organization.

When considering best practices for adoption, consider the

following?

• Does your organization resemble the identified target

organization with the best practice under consideration?

• Are the resources your organization can expend similar to

those identified with the best practice?

• Is your organization in a similar threat environment as

that proposed in the best practice?

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 110

Organizational Feasibility

Organizational feasibility analysis examines how well the

proposed information security alternatives will contribute to
the efficiency, effectiveness, and overall operation of an
organization. In other words, the proposed control must
contribute to the organization’s strategic objectives. Above
and beyond their impact on the bottom line, the organization
must determine how the proposed alternatives contribute to the
business objectives of the organization.

• Does the implementation align with the strategic planning

for the information systems?
• Or does it require deviation from the planned expansion
and management of the current systems?

Operational Feasibility

Operational feasibility analysis addresses several key areas

not covered in the other feasibility measures. Operational
feasibility analysis examines user acceptance and support,
management acceptance and support, and the overall
requirements of the organization’s stakeholders. Operational
feasibility is also known as behavioral feasibility, because
it measures the behavior of users. One of the fundamental
requirements of systems development is user buy-in. If the
users do not accept a new technology, policy, or program, it
will fail. Users may not openly oppose a change, but if they
do not support a control, they will find ways of disabling or
circumventing it, thereby creating yet another vulnerability.

Technical Feasibility

In addition to the economic costs and benefits of proposed

controls, the project team must also consider the technical
feasibilities of their design, implementation, and management.
Some safeguards, especially technology-based safeguards, are
extremely difficult to implement, configure, and manage.
Technical feasibility analysis examines whether or not the
organization has or can acquire the technology necessary to
implement and support the proposed control. Does the
organization have the hardware and software necessary to
support a new firewall system? If not, can it be obtained?

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 111

Political Feasibility

For some organizations, the most important feasibility

evaluated may be political. Politics has been defined as the
art of the possible. Within organizations, political
feasibility determines what can and cannot occur based on the
consensus and relationships among the communities of interest.
The limits placed on an organization’s actions or behaviors by
the information security controls must fit within the realm of
the possible before they can be effectively implemented, and
that realm includes the availability of staff resources.

Summary

Risk management examines and documents the current

information technology security being used in an
organization. It is the process of identifying
vulnerabilities in an organization’s information systems
and taking carefully reasoned steps to assure the
confidentiality, integrity, and availability of all of
the components in the information systems.

A key component of a risk management strategy is the

identification, classification, and prioritization of the
organization’s information assets.

The human resources, documentation, and data information

assets of an organization are more difficult to identify
and document than tangible assets, such as hardware and
software.

After identifying and performing a preliminary

classification of information assets, the threats facing
an organization should be examined. There are fourteen
categories of threats to information security.

To fully understand each threat and the impact it can

have on the organization, each identified threat must be
examined through a threat assessment process.

The goal of risk assessment is the assignment of a risk

rating or score that represents the relative risk for a
specific vulnerability of a specific information asset.

Once the vulnerabilities are identified and ranked, the

organization must choose a strategy to control the risks

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 112

resulting from these vulnerabilities. The five control

strategies are defend, transfer, mitigate, accept, and
avoid.

The economic feasibility study determines the costs

associated with protecting an asset. The formal
documentation process of feasibility is called a cost
benefit analysis.

Benchmarking is an alternative method to the economic

feasibility analysis that seeks out and studies the
practices used in other organizations that produce the
results desired in an organization.

The goal of information security is to reduce residual

risk, the amount of risk unaccounted for after the
application of controls and other risk management
strategies, to an acceptable level.

Self-Assessment Activity

Quiz

1. What is risk management? Why is the identification of

risks, by listing assets and their vulnerabilities, so
important to the risk management process?

2. According to Sun Tzu, what two key understandings must

you achieve to be successful in battle?

3. Which community of interest usually takes the lead in

information security risk management?

4. What’s the difference between an asset’s ability to

generate revenue and its ability to generate profit?

5. What are vulnerabilities? How do you identify them?

6. What are the strategies for controlling risk as described

in this chapter?

7. Describe the “defend” strategy. List and describe the

three common methods.

8. Describe the “transfer” strategy. Describe how

outsourcing can be used for this purpose.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS

MODULE 4
IT34-INFORMATION ASSURANCE AND TECHNOLOGY Page | 113

9. Describe the “mitigate” strategy. What three planning

approaches are discussed in the text as opportunities to
mitigate risk?

10. What is a cost benefit analysis?

11. What is residual risk

References

1. Sun Tzu. The Art of War, trans. Samuel B. Griffith. Oxford:

Oxford University Press, 1988, p. 84.
2. Godwin, Mike. “When Copying Isn’t Theft.” Electronic Frontier
Foundation Online. Accessed 16 April 2007 from
www.eff.org/Misc/Publications/Mike_Godwin/phrack_
riggs_neidorf_godwin.article.
3. Department of the Army. Army Training and Leadership
Development AR 350-1. Accessed 26 February 2007 from
www.army.mil/usapa/epubs/350_Series_Collection_1.html.
4. Bridis, Ted, and Buckman, Rebecca. “Microsoft Hacked! Code
Stolen?” ZDNet News Online. 20 March 2004. Accessed 16 April
2007 from zdnet.com.com/2100-11525083.html.
5. Whitman, Michael E. “Enemy at the Gates: Threats to
Information Security.” Communications of the ACM, 46, no. 8
(August 2003): 91–95.
6. Gordon, Lawrence A., Loeb, Martin P. Lucyshyn, William and
Richardson, Robert. 2006 CSI/FBI Computer Crime and Security
Survey. Accessed 25 April 2006 from www.gocsi.com.
7. National Institute of Standards and Technology. Risk
Management Guide for Information Technology Systems. SP 800-
30. January 2002.
8. Greenberg, Jack M. “Corporate Press Release: First Worldwide
Social Responsibility Report.” McDonald’s Corporation Online.
15 April 2002.
9. 37th IETF. “Remote Authentication Dial-In User Service
(RADIUS) Charter.” Proceedings at the 37th IETF meeting, San
Jose, California, December 1996.
10. Peters, Thomas J., and Waterman, Robert H. In Search of
Excellence: Lessons from America’s Best Run Companies. New
York: Harper and Row, 1982.
11. Horowitz, Alan S. “Top 10 Security Mistakes.”
Computerworld 35, no. 28 (9 July 2001): 38.
12. Avolio, Frederick M. “Best Practices in Network
Security.” Network Computing 11, no. 5 (20 March 2000): 60–66.

ISABELA STATE UNIVERSITY – ILAGAN CAMPUS