{"id":190,"date":"2009-01-06T11:52:34","date_gmt":"2009-01-06T17:52:34","guid":{"rendered":"http:\/\/www.securitycoordinators.com\/?p=190"},"modified":"2009-01-06T11:55:22","modified_gmt":"2009-01-06T17:55:22","slug":"risk-assessment","status":"publish","type":"post","link":"https:\/\/www.securitycoordinators.com\/?p=190","title":{"rendered":"Risk Assessment"},"content":{"rendered":"

Risk assessment<\/strong>, \u201cAssess The harm that is likely to result from a significant breach of information security and its potential consequences on significant breaches, and the realistic likelihood of a breach in light of prevailing threats vulnerabilities and controls\u201d. ISO-17799 Standard <\/p>\n

Information security risk<\/strong> is a threat and a vulnerability to an asset.<\/p>\n

An asset<\/strong> can be people or machinery or information and they are given a value. <\/p>\n

Those values are enhanced by either the threat or vulnerability. An Asset is something of value, it can be tangible or intangible, it can be a resource it can be a process (a way of doing something) it can be
\na product or it can be a system it can be may other things. <\/p>\n

A threat<\/strong> is a natural or man made circumstance, that is any potential cause of an
\n unwanted incident that causes harm or consequential loss to a system or
\nan organization. It is the cause of an incident, and vulnerability is a weakness
\nin a safeguard or a control. This is where Risk assessment comes into information security. <\/p>\n

Vulnerability<\/strong> is the absence or a weakness of a safeguard
\nor a control of an asset or a group of assets that may be exploited by
\na threat. <\/p>\n

Scope<\/strong>
\nIt has to be agreed before hand and if it is not the risk or redundancy and rework is high and the risk threat key risks are missed is also high
\nThe first thing that has to happen in a risk assessment and this actually has to happen to any standard, is to define the scope. The definition of scope is a pre requisite to starting a risk activity\/project. setting boundaries is a mandatory part of a process so after the scope,
\nthe organisation identifies the assets and gives them a value. A value can be a value to whichever process they want to undertake,
\nthe whole point of giving values is that one can scale them. Thus an organization
\ncan prioritize them start from the top and work its way down. <\/p>\n

So having given values on the impact of failure and the likely hood of the
\nThreat, assessing the likely hood of a threat which depends on what sort of business is the organisation in. it depends on the industry its in its all very subjective but threats are assessed by how likely the incident is to occur and from that an organization can determine over all risk in terms of priority, how likely is this to happen, then evaluate these controls and are these controls enough?
\nResidual riskAt the bottom there will always be residual risk. Therefore it is imperative that information security officers objectively assess which risks are left over present their findings and have management sign off on them.<\/p>\n","protected":false},"excerpt":{"rendered":"

Risk assessment, \u201cAssess The harm that is likely to result from a significant breach of information security and its potential consequences on significant breaches, and the realistic likelihood of a<\/p>\n

Continue reading…Risk Assessment<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[212],"class_list":["post-190","post","type-post","status-publish","format-standard","hentry","category-general-information-security","tag-risk-assessment"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/posts\/190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=190"}],"version-history":[{"count":3,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/posts\/190\/revisions"}],"predecessor-version":[{"id":192,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=\/wp\/v2\/posts\/190\/revisions\/192"}],"wp:attachment":[{"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitycoordinators.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}