Risk Management Methods and Frameworks Part II

Posted by Pantazis March 30, 2011 12:50 PM 0 comments

Risk Management Framework 


A continuous risk management process is a necessary part of any approach to Information security. Information security risk includes risks found in artifacts during assurance activities, risks introduced by insufficient process, and personnel related risks. A risk management framework is an essential philosophy for approaching security work. Following the risk management framework introduced here is by definition a full life-cycle activity. For the purposes of this description, consider risk management a high-level approach to iterative risk analysis that is deeply integrated throughout the system  development life cycle.
This Risk Management Framework described here is a mixed version of the both qualitative and quantitative frameworks combined to create a more open framework that includes advantages and excludes disadvantages of  qualitative and quantitative approaches. This is accomplished through the application of five simple stages, relevant technical expertise, tools, and technologies that produce a reasonable risk management approach.


Risk Management Framework Stages


This Risk Management Framework consists of the five fundamental  stages shown in Figure 1:


1.Establish the business context and goals
2.Identify the business risks.
3.Analyze and prioritize the risks.
4.Evaluate the risks.
5.Define the risk treatment strategy.

Figure 1


Preceding the five stages we also have an activity that cannot be omitted from the approach. Above the afore mentioned five stages we introduce the communicate and consult activity. Consultation and communication are both key components of the risk  management process and a major beneficial side effect. Successful risk  management relies on achieving a high level of creative input and involving all parties with a role to play in achieving a successful outcome for the project or business process being addressed. In both the planning and execution of the risk management process, it is important to ensure that all those who need to be involved are given adequate opportunity to do so and are kept informed of developments in the understanding of risks and the measures taken to deal with them.


Following the five steps of this Risk Management Framework is another activity that includes monitoring  and reviewing the success of the treatment process and take the necessary actions to sustain this status. There are two levels to the underlying monitoring and review component of the process. The outputs of the other five stages must be kept under review as time moves on. Changes in the environment or simply the discovery of better information might make the original assessment out of date. It is not generally necessary to begin the whole process over again when this happens, unless the change is significant, but those parts which are directly affected by changing circumstances must be brought up to date. The second component of this part of the process, is the monitoring of the operation of the other five stages. The execution of the risk management process absorbs resources and must be managed to ensure that it is conducted cost-effectively.

Risk Management Methods and Frameworks Part I

Posted by Pantazis February 8, 2011 11:36 PM 0 comments

Risk and Vulnerability Assessment Services 

In the international business environment, where decision-making follows a risk-based approach and business efficiency relies on the right balance, Information Security risk assessment is essential.
Risk Assessment services provide focus on identifying the threats and vulnerabilities regarding the security of corporate information, evaluating their potential impact on the business and recommending the appropriate mitigation controls to manage the risk. Risk and vulnerability management services provide organizations with the preventative, detective, and corrective measures needed to help limit the frequency and impact of security incidents.
Risk and vulnerability assessment can help management in decision making on Information Security, regarding the evaluation of policies effectiveness, and the selection of cost-effective mitigation controls to manage the risk of potential harm. Assessing organization's current security state is an integral step to securing sensitive data and meeting regulatory requirements.

Corporate Information Security Risk Assessment

Complete Information Security Risk Assessment using a structured methodology, best practices and strong quality procedures, involving the entire corporate environment. This service provides an assessment, which examines the level of security provided by the majority of information systems, networks, and applications.
Security Risk Assessment focuses on assisting organization's to detect any security weaknesses and sensitive spots of critical systems in the network. It also examines the effectiveness and completeness of Information Security controls (either technical or procedural). Security experts provide a thorough analysis of the organization's current security state, based on the globally-recognized ISO 27001 standard and industry best practices and a specific actionable plan to improve overall security posture based on the business needs.

Information Security Management Framework Implementation

The design and implementation of the organization’s Information Security framework including the relevant policies, standards, procedures, guidelines and organizational structures, as well as the determination of controls requirements, must be adequate enough to enforce the required level of Information Security, throughout the organization.
Organizations can take advantage standards and best practices, in order to implement the required Information Security infrastructure leading to the achievement of the organization’s desirable level of security. The significance and the level of protection required, depends on the nature and value of the corporate information.
This framework results in the establishment and enforcement of an effective Information Security Management System that safeguards information against unauthorized use, disclosure, modification, damage or loss.

Subscribe to: Posts (Atom)