Course Review

00:01

This is risk management and information technology

00:05

in this lesson, We will do a complete review of our previous lessons and tie them all together.

00:11

Let's start with defining risk management.

00:14

Risk management is an element of sustaining a secure environment.

00:17

It is also the process of identifying factors that cause damage to an organization or information structure, as well as the methods for implementing cost saving solutions for reducing risk.

00:29

With that in mind, let's define risk

00:32

risk is the likelihood that a threat will exploit the vulnerability,

00:35

which leads to the damage or theft of an asset in an organization,

00:40

reducing threats or vulnerability,

00:42

we'll lower the risk

00:45

since assets are affected by risk, what is an asset?

00:49

An asset is anything in an organization that should be protected and has value.

00:54

It can be tangible, such as products or intangible such as business process or task

01:00

assets. An organization must be protected from threats and vulnerabilities.

01:03

In most cases has its referred to customer information and trade secrets. Such a source good for risk management, information technology.

01:12

So what is vulnerability?

01:15

It is a weakness in an asset or protecting an asset?

01:19

It can be weaknesses in the IT infrastructure or a process.

01:23

It can be exploited, which lost an asset can occur.

01:29

What is a threat?

01:30

Attract is a potential currents that can cause a loss or theft of an asset.

01:34

It can be an action or inaction that can cause damage or disclosure of assets.

01:40

Threats can be large and small.

01:42

It can be accidental or intentional.

01:47

Since we have threats and vulnerabilities, we also have safeguards which reduces threats and vulnerabilities by implementing a process or control around an asset.

01:56

This is the only way to reduce risk

01:57

by implementing risk mitigation or risk removal.

02:05

So how do we implement the risk assessment?

02:07

We have management requesting a risk assessment by a 3rd party audit.

02:13

The risk assessment team determines risk by qualitative or quantitative risk assessments are a combination of both.

02:20

That assessment is passed back. The management which reviews the report.

02:25

Upon receiving a report. Either management mitigator rejects the risk identified and works with their staff to implement safeguards into the infrastructure process or environment.

02:38

As security auditors, we have two methods of creating a risk assessment.

02:42

We use qualitative risk analysis or quantitative risk analysis.

02:46

We can also combine both to have a more comprehensive report

02:53

in a qualitative risk assessment, we use different scenarios and service to determine risk.

02:57

We do this by interviews or surveys that utilize a scale

03:01

to evaluate risks, costs and threats.

03:07

In quantitative risk assessment, we use calculation based risk methodologies and probability percentages to determine the risk

03:15

data used for this methodology comes from industry standards and calculation based from previous assessments.

03:23

To accomplish quantitative risk assessment. First we assign a value to an asset.

03:29

Then we calculate exposure factor, which the potential losses. If the risk is realized,

03:34

then we calculate the single loss expectancy

03:37

which the exact amount of loss an organization were experienced. If the risk is realized,

03:43

we then determine how frequent is that as a leak can occur,

03:46

which is derived from historical records and statistics from industry standards.

03:52

That is used to determine the annualized risk loss expectancy, which the yearly cost of all instances of realized threats.

04:00

Annualized loss expectancy is determined

04:02

by using software data modeling and tools used in the industry.

04:08

And his calculations modified

04:10

by applying safeguards or countermeasure.

04:13

We then perform a cost benefit analysis of implementing safeguards and countermeasures to determine if the risk is worth preventing against the cost of preventing a threat.

04:25

Once we have all these calculations and risk assessments completed and given to management to review,

04:30

management has different responses to the risk.

04:32

Management can optimistic. eight. The risk by implementing recommended safeguards and countermeasures.

04:38

This is also cost restrictive since the different mitigation methods have a dollar impacted organization.

04:46

If the risk can be avoided, by removing threats and modifying process,

04:49

management can opt apply risk avoidance.

04:53

This can be restricted to the growth of the organization as it becomes a practical scale when your procedures

04:59

will introduce new threats and vulnerabilities

05:03

as such. If the organization cannot handle the risks of threats and vulnerabilities to its assets, they cannot the transfers to a third party who should be more equipped or or specialist to handle the risk.

05:15

This can cost significantly higher in the long run.

05:19

If the organization has exhausted all options to mitigate the risk, they can accept the risk and responsibilities for any threat that is realized and has a form that needs to be completed to record such an agreement.

05:33

An organization can also reject the risk as invalid, which the risk assessment team has to calculate the residual risk, which the remaining risk percentage once any counter measures are implemented.

05:46

Finally, in a class review,

05:48

we learn different concepts and terminologies and processes and risk management for information technology.

05:56

We're also able to provide a preliminary risk analysis report by use of qualitative and quantitative risk assessment to management

06:04

within work with management to determine what next steps are in mitigating or rejecting the risk.

06:13

I hope this small. She has been informative for you.

06:15

Their quizzes and a glossary provided to the car Smallville as well.

06:19

Feel free to send me an email for more information or guidance about this course.

06:24

Thank you.