The Choice of Risk Management or Compliance?

Risk Management is an internal IT strategy used to align the IT risk management plans with the business strategic initiatives to reduce the IT threats. Incorporating this process will ensure IT risks are managed, and the impacts are identified and monitored effectively.

Byrnes, C., Proctor, P. (2002). Information Security Must Balance Business Objectives. Retrieved February 13, 2012 from http://www.informit.com/articles/article.aspx?p=26952.

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Risk management includes the “overall decision-making process of identifying threats and vulnerabilities and their potential impacts, determining the costs to mitigate such events, and deciding what actions are cost effective to take to control these risks” (Conklin et al, 2012, pg. 678). For the proper development of risk management techniques, every person at every level of the organization, especially those involved in the Information Security (IS) department “must be actively involved in the following activities:

Threat modeling is the process of optimizing an organizations’ security of their network by finding vulnerabilities in that system, and then deploying countermeasures to protect against those threats should they happen in the future. If a company wants to know what vulnerabilities they may have then threat modeling is an excellent way of determining these threats. An individual threat is when an event occurs that has a negative impact on an organization’s daily operations. (Rouse, 2006). These negative impacts can manifest themselves in many ways from damaging the reputation of that organization to interrupting the functions of that organization. These threats can be in the form of destruction or stealing sensitive data, cracking of weak passwords, malware, phishing, or other scams and frauds. The goal of this paper is to address how the organizations code of ethics and security policies apply, what specific security policies can be deployed, and to identify the impact of asset security standards and governance. I chose Northrop Grumman as the focus of my paper

Risk analysis is an integral part of data safety within an organization and the analysis is vital to the mission and success of an organization. Risk analysis is used “to identify threats and then provide recommendations to address these threats” (Taylor et al, 2006). Risk analysis encompasses not only the equipment and programs used in an organization but also covers the culture, managerial, and administrative processes to assure data security. A key factor in risk analysis is to have a good Information Resource Management Plan.

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

“The cyber security landscape has changed in the past couple of years – and not for the better” (Steen, 2013). Banks are faced with attacks to retrieve customer account information, the military battles with attempts to obtain secrets. These attacks are not just committed by induvial hackers but entire countries. Data privacy rules differ from country to country. For example, Fisher, 2014 states individual search engine access is restricted in different ways depending on the country. China along with other countries restrict access to politically sensitive information, while the United States protects the free flow of information (Gonzalez-Padron, 2014). With companies relying more on technology such as cloud computing and virtual storage their level of vulnerability rises. IT personnel have the difficult task of protecting company data, this is why it is vital to have an ethical compliance program in place protect the organization from internal and external threats.

Risk management is a systematic and analytical process that considers the potential of a threat that could endanger an asset, individual, or function. The principles of risk management use an approach that includes three elements; threat assessment, vulnerability assessment, and

Risk management is the term applied to a logical and systematic method of establishing the context, identifying, analyzing, evaluating, treating, monitoring and communicating risks associated with any activity, function or process in a way that will enable organizations to minimize losses and maximize opportunities. (Lecture notes)Risk Management is also described as 'all the things you need to do to make the future sufficiently certain'. (The NZ Society for Risk Management, 2001)

Database security is vital for any and every organization which uses databases. Without proper security, the databases can be breached and the breaches can lead to confidential information being released. This has happened to many organizations whether they are large or small; for example, in the past few years Target and Sony both fell victim to database breaches. To make matters worse both Target and Sony were actually warned about the flaws in their security, but neither took any action to resolve the flaws. Looking into these breaches and how they were handled could lead to designing better databases. Organizations should also look within themselves to assure all employees know good security practices. Simply following regular procedures such as installing antivirus software and firewalls can help create more secure databases. An organization should look at all of their databases to ensure the same top level security is established for all of their databases.

We look at risk management as a physical and ethereal thing or what takes place on the internet between us and the user’s computer at the business and see how we can keep attacks from happening to our business. The process that this involves is staggering if you have no knowledge of IT or how to incorporate it into your business security plan than you become vulnerability. This vulnerability leads to a big problem that will cost a company millions of dollars or more. Thus starting at the bottom of the risk management process will help build a strong program you can always add to but don’t take away from.

Good security management requires risk management to mitigate or reduce risk to an acceptable level within an organization. Security management’s objective is to protect the company and its assets. A proper risk analysis will identify the company’s major assets, threats that put those assets at risk, and estimate the possible damage and loss a company may endure if any of the threats were to become real. With a good risk analysis, management can determine the type of budget they want to set to mitigate threats. Risk analysis justifies the cost of the countermeasures against the threats and determines the benefit or worth of security

Security risk management is “the culture, processes and structures that are directed towards maximizing benefits and minimizing disbenefits in security, consistent with achieving business objectives”. (Australia, 2006) And where

One well accepted description of risk management is the following: risk management is a systematic approach to setting the best course of action under uncertainty by identifying, assessing, understanding, acting on and communicating risk issues. In order to apply risk management effectively, it is vital that a risk management culture be developed. The risk management culture supports the overall vision, mission and objectives of an organization. Limits and boundaries are established and communicated concerning what are acceptable risk practices and outcomes. Since risk management is directed at uncertainty related to future events and outcomes, it is