Are you studying for the CISM certification?Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification. Show
Skillset helps you pass your certification exam.Practice QuestionsStudy thousands of practice questions that organized by skills and ranked by difficulty. Personalized TrainingCreate a tailored training plan based on the knowledge you already possess. Exam ReadinessKnow when you’re ready for the high-stakes exam. Have the confidence that you will pass on your first attempt. Get A Free Skillset Account What is Information Security Risk Management?Information security risk management, or ISRM, is the process of managing risks associated with the use of information technology. It involves identifying, assessing, and treating risks to the confidentiality, integrity, and availability of an organization’s assets. The end goal of this process is to treat risks in accordance with an organization’s overall risk tolerance. Businesses shouldn’t expect to eliminate all risks; rather, they should seek to identify and achieve an acceptable risk level for their organization. Stages of ISRM:Identification
Assessment Risk = (threat x vulnerability (exploit likelihood x exploit impact) x asset value ) - security controls Note: this is a very simplified formula analogy. Calculating probabilistic risks is not nearly this straightforward, much to everyone’s dismay. Treatment
Communication Rinse and Repeat Ownership:There are many stakeholders in the ISRM process, and each of them have different responsibilities. Defining the various roles in this process, and the responsibilities tied to each role, is a critical step to ensuring this process goes smoothly. Process Owners: At a high level, an organization might have a finance team or audit team that owns their Enterprise Risk Management (ERM) program, while an Information Security or Information Assurance team will own ISRM program, which feeds into ERM. Members of this ISRM team need to be in the field, continually driving the process forward. Risk Owners: Individual risks should be owned by the members of an organization who end up using their budget to pay for fixing the problem. In other words, risk owners are accountable for ensuring risks are treated accordingly. If you approve the budget, you own the risk. In addition to risk owners, there will also be other types of stakeholders who are either impacted by, or involved in implementing, the selected treatment plan, such as system administrators/engineers, system users, etc. Here’s an example: Your information security team (process owner) is driving the ISRM process forward. A risk to the availability of your company’s customer relationship management (CRM) system is identified, and together with your head of IT (the CRM system owner) and the individual in IT who manages this system on a day-to-day basis (CRM system admin), your process owners gather the information necessary to assess the risk. Assuming your CRM software is in place to enable the sales department at your company, and the data in your CRM software becoming unavailable would ultimately impact sales, then your sales department head (i.e. chief sales officer) is likely going to be the risk owner. The risk owner is responsible for deciding on implementing the different treatment plans offered by the information security team, system administrators, system owners, etc. and accepting any remaining risk; however, your system owner and system admin will likely be involved once again when it comes time to implement the treatment plan. System users—the salespeople who use the CRM software on a daily basis—are also stakeholders in this process, as they may be impacted by any given treatment plan. Managing risk is an ongoing task, and its success will come down to how well risks are assessed, plans are communicated, and roles are upheld. Identifying the critical people, processes, and technology to help address the steps above will create a solid foundation for a risk management strategy and program in your organization, which can be developed further over time. What would a risk management program be expected to accomplish?Essentially, the goal of risk management is to identify potential problems before they occur and have a plan for addressing them. Risk management looks at internal and external risks that could negatively impact an organization.
Why is an understanding of risk and risk management so important to an effective and successful information security program?A thorough risk management process can strengthen IT security significantly by identifying the risks to an organization's IT systems and data, and making informed decisions about how to mitigate and eliminate vulnerabilities.
What is the most important security objective in creating good procedures to meet the requirements of a relevant policy?An important objective of a security strategy is to implement cost-effective controls that ensure that residual risk remains within the organization's risk tolerance levels.
How do you manage risk in information security?Create an Effective Security Risk Management Program. Implement technology solutions to detect and eradicate threats before data is compromised.. Establish a security office with accountability.. Ensure compliance with security policies.. Make data analysis a collaborative effort between IT and business stakeholders.. |