Information System Risks

Factor Analysis of Information Risk (FAIR) is a framework for understanding, analyzing and measuring information risk (Violino, 2010). FAIR is a Value at Risk (VaR) model for cyber security and operational risk and is considered an international standard by The Open Group. The FAIR model quantifies information risk in financial terms using a scientific approach (RiskLens, 2015). Other risk models measure risk in qualitative terms based on the opinions of subject matter experts, reliance on practitioner intuition and experience, industry lore and best practices (Violino, 2010). The primary components of the FAIR framework are a taxonomy for information risk, standardized terms and definitions for information risk terms, data collection criteria, scales for measuring risk factors, a computational engine for calculating risk, and a simulation model to measure risk scenarios (Jones, 2005). The framework is used to develop threat-modelled information risk processes based on past experiences, up‐to‐date intelligence feeds, recognition of trends, and a valuation of the organizational assets (Optimal Risk, 2015).

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Physical security will involve the company securing its assets by devices such as alarm system for off hour use, and identification cards for employees. A process should be in place to make sure that guests are properly identified before gaining assess to the facility. Users cannot take computer home unless they are protected by encryption software. Downloading proprietary information onto floppies, CD, thumb/flash/memory drives and other portable media should be disallowed unless such transactions are pre-approved and proper security measures are taken.

Information technology can be very costly, and it is imperative for organizations not to overspend when it comes to their IT budget. However, it is vital for organizations to understand the risks associated with information technology. As we saw in the TJX case, TJX’s senior management did not update their systems and had very little IT knowledge. This led to multiple risks involving several security breaches which could have been contained by improving their information systems more efficiently. It is not just developing and implementing information technology; it is also understanding risks and formulating solutions to issues associated with IT. In Adventures of an IT Leader, Barton faced many challenges when it came to the budget of IVK. He assumed full responsibility for all the risks associated with the technology used and the IT budget. When the power shut off at IVK, Barton was faced with many challenges including possible customer records compromised, IVK’s systems infected, and deciphering solutions to secure the system. Barton suggested that IVK shut down operations to build a new and secure system to ensure IVK’s systems could identify where the infection originated and repairing the system for future

I am Professor Kirk Mooring and I will be your instructor for this class. In this class, you will learn the fundamental core theories of information and network security. In this course, you will learn and use technology skills that are in demand in today’s job market. With so many threats and vulnerabilities created daily that we have to learn to work as a team in order to protect our data with the appropriate security safeguards. You will study the concepts that will help you evaluate and mitigate risk by selecting the appropriate security controls and technologies.

In the final chapter of CompTIA Security + Study Guide eBook, it covers some great topics, key elements of implementation, support, and managing the security efforts in a company or organization. It’s important for IT Professionals to understand their role in a company/ organization. It’s also extremely important for them to understand the boundaries of security within that company/organization. Adopting best security practices while adhering to company policies will ensure that both parties are happy. There are many fines lines with security management.

Moreover, now days using information system is not as walking as in the park, it has many new security treats that the company might lose their confidential data, financial and personal information.

Ask any IT manager about the challenges in conveying IT risks in terms of business risks, or

Aloul (2012) supports the reiteration for information security training. An aspect of securing organizational data and information in the public school system brings about the need for information security awareness and training due to increases in security incidents (Aloul, 2012). In addition, Aloul (2012) added that a method for mitigating and combating the unauthorized release of PII is the training and education of users in the arena of information security. Trinkle et al. (2014) explained that the unauthorized release of information or information leakage can be attributed to either internal or external entities that are conducted either by a human or technical

Vulnerability exposure is one of the most important security issues Information Technology managers face. “An information security ‘exposure’ is a system structure issue or a fault in software that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network” (CVE, 2013). With the globalization of the internet, vulnerabilities in

Step 1 – categorizing information and information systems. Here unique department traits are highlighted and assigned impact levels (high, medium or low) in line with

While it lessens the burden on organizations, reducing and shifting the cost and risk of its IT operation, security and management issues to an external service provider or vendor, outsourcing any portions of an organization's Information System has significant risks that can sometimes become detrimental to the outsourced organization. According to the Commission on Government Outsourcing, "when outsourcing an organization exposes itself to significant risks in terms of security, accuracy, and completeness of information (Holroyd City Council, 2008)". Comprised in the rest of this document is an

The risk of a breach due to an insider is something that Cybercom must consider and have measures in place for. Some of the vulnerabilities associated with an insider attach include the setting up of a rogue access point and the use of thumb drives. A rogue WiFi access point setup near an external wall could be used to access the network from outside the facility, and thumb drives can be used to steal data, keeping it in a small, easy to conceal medium. According to Kelly Jackson Higgins, “The difference with insiders is they can inflict measurable financial, measurable IP, measurable brand and reputation damage -- more so than an outsider can” (2012).

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.