Risks, Threats, And Vulnerabilities

The definition of Hazard means something that could cause harm, and Risk means the likelihood of a hazard causing harm.

To start off with I chose to go with our banking or financial industry. The banking industry is constantly getting attacked by various methods on a daily basis. I chose this industry because I happen to know someone who works in the security sector at Wells Fargo Bank, he was a good person to get information on what he sees on a daily or weekly basis. This paper is the opinion of myself and with gathered information from various resources.

Threat: An action or event that might compromise security. A threat is a potential violation of security.

Risk: A risk is the chance, high or low, that any hazard will actually cause somebody harm. (the likelihood of it happening).

There is strengths and weaknesses; threats and vulnerabilities of every organization’s security system. These issues tend to be those of the same at national and global levels; crime and criminology tend to have an impact on it.

Vulnerable eventually gotten from the Latin word vulnus ("wound"). "Vulnerable" initially signified "capable for being physically injured" or "having the ability to wound", yet since the late 1600s, it has additionally been utilized metaphorically to propose a lack of protection against non-physical assaults.

Risk refers to a likelihood, probability, a chance that a loss may occur in a given organization. Most of the times, there is a high risk when there is vulnerability. In this case, vulnerability refers to a weakness that the organization has. Risk assessment refers to the process of identification of potential hazards and proper analysis of the expected losses if those hazards occur (Homeland Security, n.d.). Risk assessment as a way of profiling risk according to impact to the organization. Some organizations have business impact analysis exercises geared towards determination of potential hazards based risk assessment approaches. Organizations’ risk differ depending on the size and the type of business they are doing. The disparity in organizations’ risk call for different adaptation of risk assessment approaches. Even with the disparities of the businesses, proper risk management not only ranks the risks according to the seriousness but also identifies the best methods to control risks in an organization.

Risk can be defined as R=f(C, V, T). R stands for the level of risk and helps to establish priority for a critical infrastructure asset. C stands for the consequences of an attack on a particular target in terms of general public health. V is an assessment of the vulnerability of a target. Some targets are more easily attacked than others (Gaines and Kappeler, 2012). T stands for the likelihood that a target will be attacked. Once security goals have been established and risk has been assessed the next thing to do is establish security priorities. This should help planning and coordination between agencies with the allocation of resources. A larger amount of resources will be needed for assets with higher risk than the others. Prevention and mitigation efforts include various processes and security approaches or a combination of measures. This process will help to provide substantial information relative to securing critical infrastructure assets as well as implementing cost effective security measures (Gaines and Kappeler,

a) Risk: A probability or threat of damage, injury, liability, loss, or any other negative occurrence that is caused by external or internal vulnerabilities, and that may be avoided through preemptive action.

Defined by Coopers textbook, risk is the exposure to the consequences of uncertainty and has two elements: the likelihood of something happening that has an impact on the project objectives, and the positive or negative consequences of something impacting the project objectives (Cooper, Grey, Raymond, & Walker, 2005)

Vulnerabilities are always developing as attackers keep discovering the new purposes of flaws to obtain entrance into IT environments.

Threat: a category of objects, persons, or other entities that presents a danger to an asset

Definition: A Risk is an unwanted situation which might arise in an organization which might lead to negative impact on the desired result. Risk management plans involves the analyzing, managing and evaluating the projects risk and threats. It involves layout of the entire project i.e from the beginning during and after results of the project.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

The reader will become familiarised with the term risk and it definitions from specifically the ISO 31000 standard of risk management and also the definition of risk from the criminology crime triangle. Which one of these two definitions that are the most suitable for usage within the security industry will be discussed and evaluated. How and why consequence is important when assessing risk priorities and determining where to allocate resources will be examined and answered.