Sample by My Essay Writer
Information security risk assessment should be a continual process that aims at identifying, addressing, and preventing security problems in the information system. In the face of security threats and challenges such as cyberattacks, there is a need for increased security in data management. Risk assessment is, therefore, an important part of the risk management process since it fosters the establishment of sound security systems and practices to safeguard information. In conducting a risk assessment, there is a need to focus on the critical goals of information security such as confidentiality, availability, and assurance. For a new system, risk assessment should should be conducted at the commencement of the system life and regularly repeated throughout the System Development Life Cycle (SDLC). Risk assessment can also be done in an irregular pattern to respond to specific security threats such as cyberattacks. The aim of conducting a risk assessment in this regard is to produce a security risk management plan.
Assessing the Scope of Information and Infrastructure
In the initial step, the necessary hardware and software resources have to be assessed. One of the greatest challenges faced in the information world today is cyber threats. Risk management, therefore, emerges as a necessary process in any organization (Causey, 2013). Many smaller organizations fail to conduct a risk assessment on the account that they do not have enough resources and money. However, it is important to fully understand the scope of the organization’s information systems and the entire supporting infrastructure. When assessing the infrastructure, critical systems such as billing and knowledge repository must be carefully analyzed (Causey, 2013). Similarly, while looking at data, critical and confidential information such as HR data and intellectual property must be given greater concern. It is also important to set up the boundaries for the different segments that comprise the information systems.
Understanding Threats and Vulnerabilities
Every organization faces particular threats to its information. The U.S. Department of Homeland Security (DHS) (n.d.) stresses on the need for every organization to conduct regular risk assessments. At this risk determination phase, the goal is to evaluate the risk level of each vulnerability or threat. Additionally, it is important to determine how severe an attack would impact the system, its information, and capability. Cyber threats today come in various forms, and every organization is at risk. The risks also vary depending on location and industry. Cyber threats primarily seek to exploit certain vulnerabilities realized in information management. In risk assessment, it is important to outline all the software and hardware vulnerabilities that exist within the information system environment (DHS, n.d.). Unintentional threats such as an incorrect data entry and intentional threats such as a targeted cyberattack must all be considered. In this step, a list of all threats and their associated vulnerabilities should be compiled.
Vulnerabilities pose a risk to the information system on the basis of availability, confidentiality, accountability, and integrity. It is crucial to identify the existing control measures within the organization that can help to reduce the probability of a threat exploiting an existing vulnerability (Causey, 2013). Control measures also exist to mitigate the effect of an exploited vulnerability. Depending on the nature of threats, the current control measures can be strategic, operational, or technical (Causey, 2013). The likelihood of occurrence depends on factors such as system environment and system infrastructure and the effectiveness of the existing control measures. For some threats, the probability of occurrence can be negligible while in others it can be high or extreme. In determining risk, information can be collected through interviews, questionnaires, and automated scanning tools.
Safeguard Determination Phase
Safeguard determination comprises the identification of additional safeguards, control measures, and corrective actions that can help to reduce the exposure to the threat. A risk exposure coupled with a particular vulnerability poses a significant threat to information security. At any level, only the residual risk level should exist. Residual risk is the level of risk that remains in case all the recommended safeguards and control measures are implemented (Causey, 2013). At this stage, the assessment process should focus on identifying safeguards and oversight measures to mitigate the risk brought by each threat and vulnerability. When locating a control or safeguard, various factors should be considered. The security area (whether strategic, operational, or technical) should be considered in addition to the effectiveness of that measure in reducing risk to information security (Causey, 2013). In case an appropriate safeguard cannot be fully implemented due to cost or other factors, the circumstance should be documented.[Need an essay writing service? Find help here.]
Evaluating the residual likelihood of occurrence of a risk is important. In essence, the objective here is to forecast the adverse effects that would arise in case each potential threat was to occur (Causey, 2013). These negative consequences can be explained in terms of loss or degradation of security goals like integrity, availability, and privacy. While considering these goals, the scale of the impact should be classified. The classification can be done on the basis of low, medium and high risks where low has a relatively little impact while high has an immediate severe impact on the performance of the information system (Causey, 2013). Risk assessment is essentially done to identify and address the greatest risks to an information system on a regular basis. Advancements in technology and the constant emergence of security threats create the need for continuous improvements to update and upgrade the safeguards.
Planning Controls
In the final step, all the possible controls should be fully outlined to make them operational and able to eliminate or mitigate the identified risks. The objective of these controls is to bring down the level of risks to the information system environment. The control measures are wide-ranging and can include policy, procedures, system changes, people and the adoption of new technology (Causey, 2013). All the elements in the risk assessment process must fully comply with the required standards and meet the needs of the organization. To some extent, necessary recommendations can also be made in the risk assessment report order to improve the security situation of the organization. More importantly, risk assessment should be regarded as a continuous process given the challenging nature of ensuring information security in the present world. These steps basically outline a basic information security risk assessment process.
[“Write my essay for me?” Get help here.]
Student Response
It is indeed a matter of concern that despite the growing challenge of cybersecurity, many people are still ignorant about this subject. The ignorance is largely a function of the very nature of cyberattacks. For many, cyberattacks are not a concern of the ordinary person and should only worry governments and corporations (Singer, 2014). In any case, cyber terrorists largely target critical infrastructures like government and corporation servers. It is nevertheless a reality that cyber threats are constantly growing, and everyone should be concerned. The challenge is made worse by the difficulty in fighting cyber terrorists. In conventional terrorism, it is somewhat predictable how the country responds to attacks unlike in cyberattacks where options can be limited. Many cyber intrusions targeting government or large corporations rarely come to the public domain. It is important to improve the counter-offensive cyber capabilities and address all possible vulnerabilities that exist. [“Write my essay for me?” Get help here.]
One major challenge faced in fighting cyber threats is the limited information about the enemy (DHS, n.d.). A failure to fully understand the enemy makes the war half lost. The government should fully invest in understanding how cyber terrorists work, how they exploit existing vulnerabilities, their motivations, their funding sources and how they achieve their objectives. At a personal level, the public should be educated to understand that data breaches affect everyone. An attack on critical infrastructure like power grids can have long term effects. Just like in addressing conventional terrorism, public participation is crucial in combating cyber threats. Also, the traditional enemies of the country will naturally have a desire intrude into the country’s data and information systems by exploiting existing vulnerabilities. The government should, therefore, pay even greater focus on the existing terrorist groups and countries that fund them.
References
Causey, B. (2013). How to conduct an effective IT security risk assessment. Dark Reading, 180(1).
Singer, P. (2014, January 22). What Americans should fear in cyberspace. Los Angeles Times.
U.S. Department of Homeland Security (n.d.). Risk assessment.
