Title: Module 4 Objectives and Activities List
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Learning Objectives

By successfully completing this module, the student will be able to:

- Define risk management, risk identification, and risk control
- Describe how risk is identified and assessed
- Assess risk based on probability of occurrence and likely impact
- Explain the fundamental aspects of documenting risk via the process of a risk assessment
- Describe the various risk mitigation strategy options
- Identify the categories that can be used to classify controls
- Recognize the existing conceptual frameworks for evaluating risk controls and formulate a cost benefit analysis
- Describe how to maintain and perpetuate risk controls

Learning Activities

- Read Chapter 4
- Read Instructor notes

Before the design of new security solutions can begin, the security analysts must first understand the current state of the organization and its relationship to security.  Does the organization have any formal security mechanisms in place?  How effective are they?  What policies and procedures have been published to the security managers and end users?  This chapter examines the processes necessary to undertake formal risk management activities in the organization.  Risk management is the process of identifying, assessing and reducing risk to an acceptable level and implementing effective control measures to maintain that level of risk.  This is done with a number of processes from risk analysis through various types of feasibility analyses, including quantitative and qualitative assessment measures and evaluation of security controls.

Assessment Activities

- Complete Exam 1 (chapters 1-3)
- Complete Discussion Question 4
- Complete Exercise 4
- Complete Quiz 4