Title: An Overview of Risk Management
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

An Overview of Risk Management

Risk management is the process of identifying vulnerabilities in an organization’s information systems and taking carefully reasoned steps to ensure the confidentiality, integrity and availability of all the components in the organization’s information system.

When an organization depends on IT-based systems to remain viable, information security and the discipline of risk management become an integral part of the economic basis for making business decisions.  These decisions are based on trade-offs between the costs of applying information systems controls and the benefits realized from the operation of secured, available systems.

Risk management requires two major undertakings: risk identification and risk control.  Risk identification is the process of examining and documenting the security posture of an organization’s information technology and the risks it faces.  Risk control is the process of applying controls to reduce the risks to an organization’s data and information systems.

Know Yourself

First, we must identify, examine and understand the information and systems currently in place. In order to protect our assets, defined here as the systems that use, store, and transmit information, we have to understand everything about the information.  Once we have examined these aspects, we can then look at what we are already doing to protect the information and systems from the threats.

Know the Enemy

For information security, knowing the enemy means identifying, examining and understanding the threats that most directly affect our organization and the security of our organization’s information assets.  We then can use our understanding of these aspects to create a list of threats prioritized by importance to the organization.

The Roles of the Communities of Interest

Each community of interest must manage the risks the organization encounters.  Each community of interest has a role to play, as described below.

Information security: Understand the threats and attacks that introduce risk into the organization.
Management and users: Play a part in the early detection and response process; ensure that sufficient resources are allocated.
Information technology: Assist in building secure systems and operating them safely.
General management, IT management and information security management are collectively accountable for identifying and classifying all levels of risk.  The three communities of interest are also responsible for the following:
- Evaluating the risk controls
- Determining which control options are cost effective for the organization
- Acquiring or installing the needed controls
- Ensuring that the controls remain effective