3_Risk-Assessment-Process-Information-Security.pdfVIP专享VIP免费原创优质

RiskAssessmentProcessInformationSecurityFebruary2014All-of-GovernmentRiskAssessmentProcess:InformationSecurityFebruary20142Crowncopyright©.ThiscopyrightworkislicensedundertheCreativeCommonsAttribution3.0NewZealandlicence.Inessence,youarefreetocopy,distributeandadaptthework,aslongasyouattributetheworktotheDepartmentofInternalAffairsandabidebytheotherlicenceterms.Toviewacopyofthislicence,visithttp://creativecommons.org/licenses/by/3.0/nz/.PleasenotethatneithertheDepartmentofInternalAffairsemblemnortheNewZealandGovernmentlogomaybeusedinanywaywhichinfringesanyprovisionoftheFlags,Emblems,andNamesProtectionAct1981orwouldinfringesuchprovisioniftherelevantuseoccurredwithinNewZealand.AttributiontotheDepartmentofInternalAffairsshouldbeinwrittenformandnotbyreproductionoftheDepartmentofInternalAffairsemblemorNewZealandGovernmentlogo.All-of-GovernmentRiskAssessmentProcess:InformationSecurityFebruary20143GlossaryofTermsAvailabilityEnsuringthatauthorisedusershavetimelyandreliableaccesstoinformation.ConfidentialityEnsuringthatonlyauthoriseduserscanaccessinformation.ConsequenceTheoutcomeofanevent.Theoutcomecanbepositiveornegative.However,inthecontextofinformationsecurityitisusuallynegative.ControlArisktreatmentimplementedtoreducethelikelihoodand/orimpactofarisk.GrossRiskTheriskwithoutanyrisktreatmentapplied.ImpactSeeConsequence.InformationSecurityEnsuresthatinformationisprotectedagainstunauthorisedaccessordisclosureusers(confidentiality),unauthorisedorimpropermodification(integrity)andcanbeaccessedwhenrequired(availability).IntegrityEnsuringtheaccuracyandcompletenessofinformationandinformationprocessingmethods.LikelihoodSeeProbability.ProbabilityThechanceofaneventoccurring.ResidualRiskTheriskremainingaftertherisktreatmenthasbeenapplied.RiskTheeffectofuncertaintyonthebusinessobjectives.Theeffectcanbepositiveornegative.However,inthecontextofinformationsecurityitisusuallynegative.RiskAppetiteTheamountofriskthattheorganisationiswillingtoacceptinpursuitofitsobjectives.RiskOwnerApersonorentitywiththeaccountabilityandauthoritytomanagearisk.Usuallythebusinessowneroftheinformationsystemorservice.StakeholderApersonororganisationthatcanaffect,beaffectedby,orperceivethemselvestobeaffectedbyariskeventuating.ThreatThepotentialcauseofarisk.ThreatAgentAnindividual,grouporeventthatcancauseathreattooccur.VulnerabilityAweaknessinaninformationsystemorservicethatcanbeexploitedbyathreat.All-of-GovernmentRiskAssessmentProcess:InformationSecurityFebruary20144Contents1Introduction5Overview52RiskAssessmentProcess6EstablishingtheContext6BusinessContext6TechnicalContext6RiskAnalysis8ImpactAssessment9LikelihoodAssessment9RiskRating9ControlsIdentificationandAssessment10RiskEvaluation11RiskTreatment123MonitoringandReview144CommunicationandConsultation14AppendixA–ThreatCatalogue15ThreatSources15AppendixB–ExampleRiskScalesandMatrix17Introduction17DevelopingandTailoringScales17RiskRatingScalesandMatrix18Impact(Consequences)Assessment18Likelihood(Probability)Assessment21RiskMatrix21RiskEscalation22TableoffiguresFigure1–ISO3100:2009RiskManagement5Figure2–TypesofControls10TableoftablesTable1–ThreatSources15Table2–ThreatAgentMotivation16Table3–SimpleImpactScale19Table4–DetailedImpactScale20Table5–LikelihoodScale21Table6–RiskMatrix22Table7–RiskEscalationandReporting22All-of-GovernmentRiskAssessmentProcess:Informa...