SecurityRiskAnalysis/RiskManagementPage1Copyright©1998,Countermeasures,Inc.SECURITYRISKANALYSISANDMANAGEMENT
Copyright©1998Countermeasures,IncRiskAnalysishelpsestablishagoodsecurityposture;RiskManagementkeepsitthatway.Securitymeasurescannotassure100%protectionagainstallthreats.Therefore,riskanalysis,whichistheprocessofevaluatingsystemvulnerabilitiesandthethreatsfacingit,isanessentialpartofanyriskmanagementprogram.Theanalysisprocessidentifiestheprobableconsequencesorrisksassociatedwiththevulnerabilitiesandprovidesthebasisforestablishingacost-effectivesecurityprogram.Riskmanagementistheprocessofimplementingandmaintainingcountermeasuresthatreducetheeffectsofrisktoanacceptablelevel.Theriskanalysisprocessgivesmanagementtheinformationitneedstomakeeducatedjudgmentsconcerninginformationsecurity.Theprocedureidentifiestheexistingsecuritycontrols,calculatesvulnerabilities,andevaluatestheeffectofthreatsoneachareaofvulnerability.Inmostcases,theriskanalysisprocedureattemptstostrikeaneconomicbalancebetweentheimpactofrisksandthecostofsecuritysolutionsintendedtomanagethem.Atthebasisofselectingcost-effectiveprotectivemeasuresistheassumptionthatthecostofcontrollinganyriskshouldnotexceedthemaximumlossassociatedwiththerisk.Forexample,ifthepotentiallossattributabletoariskisestimatedtobe$100,000,thecostoftheprotectivemeasuresintendedtopreventthatlossshouldnotexceedthatamount.Inothercases,however,thedecisiontoimplement(ornotimplement)countermeasuresmaybedrivenbytheimportanceofthesystemoritsdataorbymandatesasopposedtoitscost.Ineithercase,thesumofavertedrisksmustbeconsideredwhereasingleremedywillreduceseveralrisks.Theanalystmustalsoconsidertheuseandinteractionofmultipleremedies.Oneremedymayimproveornegatetheeffectivenessofanother.SecurityRiskAnalysis/RiskManagementPage2Copyright©1998,Countermeasures,Inc.Theseconsiderationsformthebasisfordeterminingwhichprotectivemeasuresarethemostappropriate.Afterhavingevaluatedthelossofeachrisk,assessmentscanbemadeaboutthefundsthatcanbeallocatedtolessentheestimatedannuallossestoanacceptablelevel.Withinformationonlossbeforeandaftertheapplicationofcontrols,costevaluationswillindicatewhichcountermeasuresaremostcost-effective.Whenidentifyingtheprotectivemeasuresthatshouldbeimplemented,considerationshouldbegiventothegreatestrisksfirst.Theriskanalysismethodologyselected(includingthequantitativecostanalysismethods)willlikelysuggesttheuseofcostindicatorsorcommondenominatorsthatfunctiontoidentifythemostcost-effectivesecuritysolutions.Thefollowingcostindicatorsprovideabasisforcomparisonamongprotectivemeasures:•Thepaybackperiodnecessarytorecoverthecostsattributabletoaprotectivemeasure•Theexpectedannualcostavoidance(thereductioninpotentialloss)attributabletoaprotectivemeasure(theamountofcostavoidancerealizedafterthecountermeasureisinstalledandhasachievedpayback)•Theamountofexpectedlossreductionprovidedthecounter-measureisimplementedSecuritypolicyrequiresthecreationofanongoinginformationmanagementplanningprocessthatincludesplanningforthesecurityofeachorganization'sinformationassets.Riskmanagementisanongoing,proactiveprogramforestablishingandmaintaininganacceptableinformationsystemsecurityposture.Onceanacceptablesecuritypostureisattained[accreditationorcertification],theriskmanagementprogrammonitorsitthrougheverydayactivit...
优质VIP
