Approaches to Risk Analysis Essay

Risk assessment is used to determine the extent of handling threats and the risks associated with an IT system throughout its life cycle.

Throughout the many different types of establishments that currently exist today, there are risk assessments methodologies which are used to estimate or determine risk. According to the Department of Homeland Security (DHS) Risk Lexicon (2010), risk assessment methodologies are defined as, “set of methods, principles, or rules used to identify and assess risk and to form priorities, develop courses of action, and inform decision-making” (p.25). Whether it is a risk assessment tailored for the government or private companies, the methods and principles are similar in a sense that they all aim at evaluating risk. Once risk can be determined, they can then decipher what types of strategies and decisions that should be used. Of the many risk assessments out there three distinct models who stood out were the Maritime Security Risk Analysis Model (MSRAM), The CARVER model, and lastly the Transportation Sector Security Risk Assessment (TSSRA). This paper will discuss the three risk assessment methodology’s origin, the intended audience, as well as some main elements and attributes. Afterward, the paper will conclude with my personal opinion to its strengths and weaknesses. But first, background on the selected risk analysis models in its designated order is needed starting with MSRAM.

The periodic assessment of risk to agency operations or assets resulting from the operation of an information system is an important activity. It summarizes the risks associated with the vulnerabilities identified during the vulnerability scan. Impact refers to the magnitude of potential harm that may be caused by successful exploitation. It is determined by the value of the resource at risk, both in terms of its inherent (replacement) value, its importance (criticality) to business missions, and the sensitivity of data contained within the system. The results of the system security categorization estimations for each system, is used as an aid to determining individual impact estimations for each finding. The level of impact is rated

Risk assessment and threat assessment should go hand-in-hand.The outcome of the risk assessment and threat assessment should provide recommendations that maximize the protection of confidentiality, integrity and availability while still providing functionality and usability. The purpose of a risk assessment is to ensure sensitive data and valuable assets are protected. An organization should take a hard look at who has access to sensitive data and if those accesses are required. The security audit should monitor the companies systems and users to detect illicit activity.The security audit should

Whitman, M. E., & Mattord, H. J. (2010). Management of information security (3rd ed.). Boston, MA: Course Technology.

Risk analysis is an integral part of data safety within an organization and the analysis is vital to the mission and success of an organization. Risk analysis is used “to identify threats and then provide recommendations to address these threats” (Taylor et al, 2006). Risk analysis encompasses not only the equipment and programs used in an organization but also covers the culture, managerial, and administrative processes to assure data security. A key factor in risk analysis is to have a good Information Resource Management Plan.

Threat numbers for each scenario are determined by subject matter experts at an Intelligence Coordination Center (ICC) and provided through the MSRAM tool. It is important to note that users do not calculate threat probabilities. Instead, they use threat probabilities provided by the MSRAM tool. This is an

There are two main types of risk management assessments. They are qualitative and quantitative methodologies. With the qualitative methodology, a relative values are used to determine the probability and impact of a risk (Gibson, 2011). This type of information can be collected quickly. A quantitative risk assessment is used to estimate how much money would be lost should a vulnerability be exploited (Vanderberg, n.d.). With the quantitative methodology, actual dollar values are used. It can take a time to gather this type of data. Once the data is gathered, however, a math formula is used to determine the priority of risks and in turn show the results of controls (Gibson, 2011).

A robust information security system with an exemplary scope of coverage is the ultimate goal

The framework provides a roadmap for the implementation, evaluation and improvement of information security practices. An important feature of the information security governance framework is that it defines the roles of different members of an organization. The framework specifies what corporate executives, senior management, and CIOs/CISOs should do. The framework is also flexible enough to apply to different business models. The framework benefits are it identifies cornerstone security practices that nearly all organizations are following and makes recommendations where in an organization the responsibility falls. Some disadvantages to BSA's framework is that it is still a work in progress and it still needs to develop useful metrics that enable managers to quantify the return on investments in information security and the effectiveness of information security programs and measures (BSA).

You will be able to identify different risk management techniques for the seven domains of a typical IT

Research shows that various risk management tools exist, ranging from the strict minimum to very comprehensive methodological (Harrison 1997). In different countries there are different methods applied in risk management, however the methodology is the same, systems characterization and description, threat and vulnerability identification, risk assessment and recommended

“First, it neglects the fact that those who benefit may not be the same as those who pay the costs.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

The reader will become familiarised with the term risk and it definitions from specifically the ISO 31000 standard of risk management and also the definition of risk from the criminology crime triangle. Which one of these two definitions that are the most suitable for usage within the security industry will be discussed and evaluated. How and why consequence is important when assessing risk priorities and determining where to allocate resources will be examined and answered.