What Are the Three Primary Aspects of Information Security Risk Management & Why Is Each Important?
Information risk management is made up of assessing the risk, mitigating possible risk and monitoring the result. Assessing the risk involves defining the nature of the risk to information security and determining how information system security can fail. This leads directly to mitigation through upgrading systems so that the identified failures become unlikely. Finally, risk management includes monitoring the results of the interventions to see if they resulted in the desired mitigation.
Other People Are Reading
-
Basics
-
An organizational unit must ensure that it has the capabilities to accomplish its mission. It must identify risks that threaten those capabilities, and evaluate protective measures, keeping in mind the economic cost of those measures. One risk that most modern organizations face is compromised information security. An organizational unit must identify where compromised information security would affect its capabilities to accomplish its mission, and take appropriate corrective measures within its established budgetary framework.
Assessment
-
Once an organizational unit has concluded that information security poses a risk to its capabilities, it must assess its systems, operations, procedures and external interactions to find out where the risks lie. This means identifying possible threats, vulnerabilities to those threats, possible countermeasures, impact and likelihood. Risks can be classified as to severity depending on impact and likelihood. The importance of assessment is that it allows the identification of high risks that must be mitigated.
-
Mitigation
-
Mitigation means dealing with the risk that was identified by the assessment. Strategies for dealing with the risk include accepting the risk, adopting measures which will lower the risk, avoiding the risk by eliminating the cause, limiting the risk by putting in place controls, or transferring the risk to a supplier, customer or insurance company. Which strategy is appropriate is determined by the extent to which the risk impairs the ability of the organization to fulfill its mission, and the cost of implementing the strategy. Structured mitigation is important as a framework for risk management.
Evaluation and Monitoring
-
Once assessment and mitigation have been completed, the organizational unit must evaluate the result and monitor progress. This process starts with an evaluation of the effects of the assessment and mitigation, including the setting of benchmarks for progress. It continues with the evaluation of the effect of changes and additions to information systems. Finally, it performs continuous monitoring of information security performance, with the aim of identifying areas which may have to be assessed for additional risk. Evaluation and monitoring is important for determining how successfully the organizational unit has managed its information security risk.
-
References
- Photo Credit Ryan McVay/Photodisc/Getty Images
