A Brief Note On Risk Management Process And Monitoring Security Controls

During SDLC phase one, the initiation phase, “the need for a system is expressed and the purpose of the system is documented” (NIST, 2008). Some of the expected outcomes from this phase would be a project plan and schedule; system performance specifications outlining the operational requirements, system design documents, and a document that defines roles and responsibilities. The corresponding RMF step, security categorization, establishes the foundation for security standardization among information systems and provides a vital step towards integrating security into the information system (NIST, 2008). During this step, the type(s) of information processed by the information system are identified and the information system is categorized to determine the level of protection requirements to put in place. Some of the expected outputs of this step include a security project plan and schedule, documented system boundary, the system categorization, and the security roles and responsibilities. These two process steps are very similar except the focus of RMF is on information security related functions. In some cases, SDLC produces the expected outputs that RMF requires, and the security professionals only require a copy of the documentation for their records. For example, the system design document often depicts the system boundary. The reason this step is so critical is that it

This starts with five crucial risk management practices: protection, detection, prevention, reaction and documentation. Along with the risk management practices, the company should also implement good physical security measures. They include firewalls, user authentications- like strong passwords and user names, software protections like security suites, backups, Intrusion detection and automated constant system integrity

The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

An effective information security program should include, periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization. Policies and procedures should be based on risk assessments, cost effective reduced information security risk, and it should ensure that the information security is addressed throughout the entire life cycle of each and every organizational information system. Subordinate plans for providing sufficient information security for groups of the information system, facilities, networks, or information systems.

The most significant part of utilization is planning and will not even be credible for security, unless a full risk assessment is completed. Security planning encompasses the development of security guidelines as well as employing restrictions prohibiting computer risks from developing into the here and now. It is impossible to move forward with a plan of action prior to the risk assessment being implemented. The risk assessment will be responsible as a

Security requirements also apply to all VA or contractor-operated services and information resources located and operated at contract facilities, at other government agencies that support VA mission

In this second part of article review, it will be mainly focused on the controllable part (Risk Management Framework, RMF).  The controllable part contains six different phases that work among the system development life cycle (SDLC).  The controllable phases provide the system developers a way to enable security controls, measure the risk level of data, and the system.  Combine both parts, it becomes a security framework to allow the system developers to go through the step-by-step process to gather useful system data,

The purpose of each control on the Sphere of Protection is to protect the valuable information and information systems assets. The focus of each control is management, operational, and technical controls in which sums up the sphere of protection.  Management controls cover security processes designed by strategic planners and performed by security administration (2) Operational controls deal with operational functionality of security in organization and (3) Lastly, technical controls address tactical and technical implementations related to designing and implementing security in

In cutting edge business situations that depend vigorously on data innovation, the system security review or evaluation is a crucial part of system support and repair. A system security advisor will regularly play out a review as the primary stage in giving counseling administrations to a business. Notwithstanding, these establishment building reviews, organizations should likewise perform system security reviews or appraisals all the time to guarantee ideal execution.

Background - Country Girl Jewelry has expanded rapidly to the point at which they now have two offices and over 70 employees. There are now larger issues requiring the Security Department to be responsible for secure transactions for online clients, the personal financial data of all concerned, and a safe and secure network situation). Our first step in this process is to look at the situation carefully and, especially in the era of globalization, manage our security risk level by first considering our risk level. Basic risk management for any organization encompasses six general parameters" 1) The identification of a risk within the context of the organization or area; 2) Planning some sort of a process to mitigate the situation(s); 3) Mapping, either formally or informally, the scope, objectives, stakeholders, and constraints; 4) Defining a framework for managing the risk(s); 5) Developing a sound analysis of the risks using as many tools as possible; 6) Finding mitigating solutions using all available tools (Wan, 2009; Frenkel, Hommel, & Rudolf, 2005). Most experts, in fact, suggest that one look at risk as a simple formula: Risk Index = Impact of Risk Event(s) X Probability of Occurance.

The four risk building blocks are discovery, measurement, classification, and prioritization (Miller, 2006). Discovery identifies all the components necessary to ensure risk management programs are effective, including technology infracture, users of it, information assets, and processes. Measurement is assessing capabilities and requirements (compliance, service agreements, and information availability), vulnerabilities (including weaknesses in applications, networks, operations, and organization), and threats to security to be able to prioritize according to the degree of risk.

The use of the risk management process to identify and mitigate risk of information system is one of the best way to ensure the protection and security of information system. This often requires information security employees to assess the criticality of each system and all of the vulnerabilities the system has. To mitigate the risk of compromise on each system often requires the purchase of new software or devices which can be quite costly. This is why the use of a cost benefit analysis is a crucial part of risk management.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Security risk management is “the culture, processes and structures that are directed towards maximizing benefits and minimizing disbenefits in security, consistent with achieving business objectives”. (Australia, 2006) And where

The purpose of this project is to fully understand the purpose and functions of Risk Management, including what the risks are with respect to the information system, why it is important to understand those risks, and how should the risks be assessed and managed (Elky, 2006). Risks are associated with the requirements of business, infracture, application, and the security program (Zeltser). There are also standards for understanding the importance of risk management, integration of risk management, the key roles of senior managers and other executives, how to perform the risk assessment, the control methods, risk mitigation, and the evaluation and assessment (Stoneburner). The risk management and IT policy should have a relationship with the organization's strategic plans and mission, which identifies the individual organization and industry. The functions of the Risk Management should flow more smoothly with more understanding if they are implemented with known standards that bring about the understanding and appropriateness of the risk functions.