Course Review
Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Time
1 hour 39 minutes
Difficulty
Intermediate
CEU/CPE
1
Video Transcription
00:01
This is risk management and information technology
00:05
in this lesson, We will do a complete review of our previous lessons and tie them all together.
00:11
Let's start with defining risk management.
00:14
Risk management is an element of sustaining a secure environment.
00:17
It is also the process of identifying factors that cause damage to an organization or information structure, as well as the methods for implementing cost saving solutions for reducing risk.
00:29
With that in mind, let's define risk
00:32
risk is the likelihood that a threat will exploit the vulnerability,
00:35
which leads to the damage or theft of an asset in an organization,
00:40
reducing threats or vulnerability,
00:42
we'll lower the risk
00:45
since assets are affected by risk, what is an asset?
00:49
An asset is anything in an organization that should be protected and has value.
00:54
It can be tangible, such as products or intangible such as business process or task
01:00
assets. An organization must be protected from threats and vulnerabilities.
01:03
In most cases has its referred to customer information and trade secrets. Such a source good for risk management, information technology.
01:12
So what is vulnerability?
01:15
It is a weakness in an asset or protecting an asset?
01:19
It can be weaknesses in the IT infrastructure or a process.
01:23
It can be exploited, which lost an asset can occur.
01:29
What is a threat?
01:30
Attract is a potential currents that can cause a loss or theft of an asset.
01:34
It can be an action or inaction that can cause damage or disclosure of assets.
01:40
Threats can be large and small.
01:42
It can be accidental or intentional.
01:47
Since we have threats and vulnerabilities, we also have safeguards which reduces threats and vulnerabilities by implementing a process or control around an asset.
01:56
This is the only way to reduce risk
01:57
by implementing risk mitigation or risk removal.
02:05
So how do we implement the risk assessment?
02:07
We have management requesting a risk assessment by a 3rd party audit.
02:13
The risk assessment team determines risk by qualitative or quantitative risk assessments are a combination of both.
02:20
That assessment is passed back. The management which reviews the report.
02:25
Upon receiving a report. Either management mitigator rejects the risk identified and works with their staff to implement safeguards into the infrastructure process or environment.
02:38
As security auditors, we have two methods of creating a risk assessment.
02:42
We use qualitative risk analysis or quantitative risk analysis.
02:46
We can also combine both to have a more comprehensive report
02:53
in a qualitative risk assessment, we use different scenarios and service to determine risk.
02:57
We do this by interviews or surveys that utilize a scale
03:01
to evaluate risks, costs and threats.
03:07
In quantitative risk assessment, we use calculation based risk methodologies and probability percentages to determine the risk
03:15
data used for this methodology comes from industry standards and calculation based from previous assessments.
03:23
To accomplish quantitative risk assessment. First we assign a value to an asset.
03:29
Then we calculate exposure factor, which the potential losses. If the risk is realized,
03:34
then we calculate the single loss expectancy
03:37
which the exact amount of loss an organization were experienced. If the risk is realized,
03:43
we then determine how frequent is that as a leak can occur,
03:46
which is derived from historical records and statistics from industry standards.
03:52
That is used to determine the annualized risk loss expectancy, which the yearly cost of all instances of realized threats.
04:00
Annualized loss expectancy is determined
04:02
by using software data modeling and tools used in the industry.
04:08
And his calculations modified
04:10
by applying safeguards or countermeasure.
04:13
We then perform a cost benefit analysis of implementing safeguards and countermeasures to determine if the risk is worth preventing against the cost of preventing a threat.
04:25
Once we have all these calculations and risk assessments completed and given to management to review,
04:30
management has different responses to the risk.
04:32
Management can optimistic. eight. The risk by implementing recommended safeguards and countermeasures.
04:38
This is also cost restrictive since the different mitigation methods have a dollar impacted organization.
04:46
If the risk can be avoided, by removing threats and modifying process,
04:49
management can opt apply risk avoidance.
04:53
This can be restricted to the growth of the organization as it becomes a practical scale when your procedures
04:59
will introduce new threats and vulnerabilities
05:03
as such. If the organization cannot handle the risks of threats and vulnerabilities to its assets, they cannot the transfers to a third party who should be more equipped or or specialist to handle the risk.
05:15
This can cost significantly higher in the long run.
05:19
If the organization has exhausted all options to mitigate the risk, they can accept the risk and responsibilities for any threat that is realized and has a form that needs to be completed to record such an agreement.
05:33
An organization can also reject the risk as invalid, which the risk assessment team has to calculate the residual risk, which the remaining risk percentage once any counter measures are implemented.
05:46
Finally, in a class review,
05:48
we learn different concepts and terminologies and processes and risk management for information technology.
05:56
We're also able to provide a preliminary risk analysis report by use of qualitative and quantitative risk assessment to management
06:04
within work with management to determine what next steps are in mitigating or rejecting the risk.
06:13
I hope this small. She has been informative for you.
06:15
Their quizzes and a glossary provided to the car Smallville as well.
06:19
Feel free to send me an email for more information or guidance about this course.
06:24
Thank you.
06:25
This is your instructor, robert Ghana.
Up Next
Course Assessment - Risk Management and Information Systems Control
Assessment
30m
Instructed By
Similar Content
