RunningHead:InformationSecurityRiskAssessmentMethods,FrameworksandGuidelinesInformationSecurityRiskAssessmentMethods,FrameworksandGuidelinesMichaelHaythornEastCarolinaUniversityInformationSecurityRiskAssessmentMethods,FrameworksandGuidelines2AbstractAssessingriskisafundamentalresponsibilityofinformationsecurityprofessionals.Thebasicneedtoprovideproductsorservicescreatesarequirementtohaveassets.Withassetscomestheneedprotectthemfromthepotentialforloss.Conductingariskassessmentisanessentialstepfororganizationsinordertoensurethanpropercontrolsareinplacetoprotectassetsthatarecriticaltobusinessfunctions.Riskassessmentcanbeaverycomplextask,onethatrequiresmultiplemethodologiesandresourcestoperformquantitativeandqualitativeanalysisbasedonfactualevidenceaswellassubjectiveopinion.Ultimatelytheorganizationbearstheresponsibilityforaccurateanalysisandcontrolmeasures.Theneedforanaccurateriskassessmenthascreatedmultipleentitiesforbaselineframeworksthatorganizationscanusetobuildupontomeettheirneeds.Theseframeworksareguidelines,butcannotreplacetheindepthknowledgethatanorganizationmusthavetobesuccessfulinimplementingcontrolsbasedonariskassessment.Itistheresponsibilityofinformationsecurityprofessionalswithintheorganizationanalyzemultipleframeworksandutilizethemethodsthatareidealinacasebycasebasis.Thefollowingarticlepresentsdetailsonrisk,theassessmentofriskincludingmultipleindustryframeworksandfinallymanagingtherisksthathavebeenidentified.Exampleshavebeenprovidedtoshowabroadscopeexplanationofhowtheseprinciplesmaybeappliedtoorganizations.InformationSecurityRiskAssessmentMethods,FrameworksandGuidelines3TableofContentsWhatisRisk?............................................................................................................................................4-5Event................................................................................................................................................4Probability........................................................................................................................................4Asset.................................................................................................................................................4Outcome...........................................................................................................................................5AssessingRisk.........................................................................................................................................5-11Threats.............................................................................................................................................6Vulnerabilities..................................................................................................................................7Assets............................................................................................................................................7-8Impact..............................................................................................................................................8Likelihood........................................................................................................................................9Controls...........................................................
优质VIP
