Factor Analysis Of Information Risk

The problem experienced by the Wayward Pines Public Library of having one of their public access computers (PAC) becoming a zombie member of a Botnet army is not an isolated one.

The periodic assessment of risk to agency operations or assets resulting from the operation of an information system is an important activity. It summarizes the risks associated with the vulnerabilities identified during the vulnerability scan. Impact refers to the magnitude of potential harm that may be caused by successful exploitation. It is determined by the value of the resource at risk, both in terms of its inherent (replacement) value, its importance (criticality) to business missions, and the sensitivity of data contained within the system. The results of the system security categorization estimations for each system, is used as an aid to determining individual impact estimations for each finding. The level of impact is rated

Risk assessment and threat assessment should go hand-in-hand.The outcome of the risk assessment and threat assessment should provide recommendations that maximize the protection of confidentiality, integrity and availability while still providing functionality and usability. The purpose of a risk assessment is to ensure sensitive data and valuable assets are protected. An organization should take a hard look at who has access to sensitive data and if those accesses are required. The security audit should monitor the companies systems and users to detect illicit activity.The security audit should

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

In order to diminish both security and privacy risks to organizations, measures need to be taken to combat risks throughout the various stages of the threat’s life cycle. Specific processes must be implemented to identify threats, procedures to follow when the attack occurs, and finally methods to recover from the attack (Houlding, 2011).

Due to the lack in data security elements, the following recommendations are suggested: strategy and risk assessment. Overall data security begins with the identification of risks and the strategy on the solution to those risks. This can be accomplished through a Strength Opportunities, and Threats (SWOT) analysis. Strengths and weaknesses are derived from internal factors, such as employees, while opportunities and threats are derived from external factors, such as hackers (Value Based Management, 2011).

Categorization of information systems according to respective risk level: In a bid to provide appropriate levels of information security, all information and information systems must be categorized according to risk

One may need to be careful when ranking risk or displaying certain information related to risk. Qualitative and quantitative risk approaches are necessary and the timing and exact situation or risk need management level consideration. Combining a variety of these approaches with subject matter expertise can benefit DHS in determining a way forward (Rozell, 2015). It is beneficial in understanding risk associated with critical infrastructure. This can help in determining additional measures, and this can influence risk management

Risk refers to a likelihood, probability, a chance that a loss may occur in a given organization. Most of the times, there is a high risk when there is vulnerability. In this case, vulnerability refers to a weakness that the organization has. Risk assessment refers to the process of identification of potential hazards and proper analysis of the expected losses if those hazards occur (Homeland Security, n.d.). Risk assessment as a way of profiling risk according to impact to the organization. Some organizations have business impact analysis exercises geared towards determination of potential hazards based risk assessment approaches. Organizations’ risk differ depending on the size and the type of business they are doing. The disparity in organizations’ risk call for different adaptation of risk assessment approaches. Even with the disparities of the businesses, proper risk management not only ranks the risks according to the seriousness but also identifies the best methods to control risks in an organization.

When we delve into the word 'risk ', we find that it has a multitude of meanings, and that it is nowhere near as clear and precise as the advocates of traditional risk assessment assert, for example Hansson (2002) identifies five different common uses for the word risk, and Ekberg points out a "proliferation of risk definitions" and a whole range of different understandings of risk (2007 p345).

Background- In its most basic sense, risk management identifies, allows assessment, and prioritizes risks that are associated and central to an individual project or organization. Risk management allows the organization to be proactive in preventing or mitigating risks, for improving certain processes within the organization, and with the hope of preventing fiscal exposure. However, in almost every organization there are risks individuals are unique and do not always perform at a high level of safety; mechanical or design failures exist, construction projects have supply or labor issues, there are uncertainties in computer or data modification, of course natural disasters, and even deliberate attacks from competitors, etc. Because this is such a common occurrence, national and even international standards have been developed in conjunction with the insurance and regulatory institutions to at least provide basic guidelines to minimize risks risk (International Organization for Standardization, 2009).

Risk can be defined as R=f(C, V, T). R stands for the level of risk and helps to establish priority for a critical infrastructure asset. C stands for the consequences of an attack on a particular target in terms of general public health. V is an assessment of the vulnerability of a target. Some targets are more easily attacked than others (Gaines and Kappeler, 2012). T stands for the likelihood that a target will be attacked. Once security goals have been established and risk has been assessed the next thing to do is establish security priorities. This should help planning and coordination between agencies with the allocation of resources. A larger amount of resources will be needed for assets with higher risk than the others. Prevention and mitigation efforts include various processes and security approaches or a combination of measures. This process will help to provide substantial information relative to securing critical infrastructure assets as well as implementing cost effective security measures (Gaines and Kappeler,

One of the most common frame works that is used by risk assessment professionals is the FAIR risk management methodology FAIR stands for Factor Analysis of Information Risk and was first introduced in 2005 by Jack Jones with the goal of being able to provide an answer to two common questions asked by management in relation to risk management which are “how much risk does the organization have” and “how much less risk will there be if we spend the money you propose on mitigation.”

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

The reader will become familiarised with the term risk and it definitions from specifically the ISO 31000 standard of risk management and also the definition of risk from the criminology crime triangle. Which one of these two definitions that are the most suitable for usage within the security industry will be discussed and evaluated. How and why consequence is important when assessing risk priorities and determining where to allocate resources will be examined and answered.