Information Security And Risk Management

19 Sep Information Security And Risk Management

· There are 3 tasks and 1 presentation that need to be submitted by tomorrow.

· Each task should contain 10 pages.

· All the topics covered 3 tasks should be presented in the PPT

·

Task 1:

Chapter 4 -covers of all Task #1

Objectives of a Risk Management Plan:

· A list of threats

· A list of vulnerabilities

· Costs associated with risks

· A list of recommendations to reduce the risks

· Costs associated with recommendations

· A cost-benefit analysis

· One or more reports

Minimum for Task #1 Risk Management Plan:

· Introduction- the objective and importance of the Risk Management Plan

· Purpose of the Risk Management Plan

· Scope/boundaries of the Risk Management Plan

· Compliance Laws and Regulations that pertain to the organization for this project

· Risk Assessment -Task #2

· Identified threats and vulnerabilities that pertain to the organization for this project

· Roles of people/department in the organization and their responsibilities for risk management

· Identify the cost of non-compliance

· Risk Mitigation- Task #3

· Create recommendations

· Create a high-level timeline/implementation plan for the recommendations (assume all were accepted)

· Reference list in APA format

Task 2:

Chapter 5-8 -covers of all Task #2

Objectives of a Risk Assessment Plan: (Chapter #5)

· Key step in a risk management process

· Determination of quantitative or qualitative value of risk

· Conducted for concrete situation and recognized threat

· Used to help identify which safeguards (controls) to implement

· Required for evaluating risk or control

· Often conducted after implementation of a control

Minimum for Task #2 Risk Assessment Plan: (Chapter #5-#8) (pg 129)

· Introduction- the objective and importance of the Risk Assessment Plan

· Purpose of the Risk Assessment Plan

· Scope/boundaries of the Risk Assessment Plan

· Approach to the Risk Assessment for the organization for this project

· System Characterization

· Threat statement

· Roles of people/department in the organization and their responsibilities for this Risk Assessment

· Create a high-level timeline/plan for the risk assessment process-(tasks)

· Reference list in APA format

Task 3:

Chapter 9-10 -covers of all Task #3

Where Should Your Organization Start with Risk Mitigation?

· Identify assets

o High, medium, low

· Identify and analyze threats and vulnerabilities

· Evaluate the controls to determine what controls to implement

Risk Mitigation Best Practices

• Review historical documentation

– Although risks change, many of the threats and vulnerabilities will be the same

• Include both a narrow and broad focus

– Identify specific risks and mitigation strategies and broaden the focus to include the entire organization

• Ensure that governing laws are identified

– If you don’t know what laws apply, you won’t be in compliance

• Redo RAs when a control changes

– If a control changes, the original RA is no longer valid

• Include a cost-benefit analysis

·

·

§ CBAs provide justification for controls and help determine their value

§

Minimum for Task #3 Risk Mitigation Plan: (Chapter #9-#10)

· Introduction- the objective and importance of the Risk Mitigation Plan

· Purpose of the Risk Mitigation Plan

· Scope/boundaries of the Risk Mitigation Plan

· Approach to the Risk Mitigation plan for the organization for this project

· Legal and Compliance Implications for the organization for this project

· Threat statement

· Roles of people/department in the organization and their responsibilities for this Risk Mitigation Plan

· Create a high-level timeline/plan for the Risk Mitigation process-(tasks)

· Reference list in APA format

Task 4:

Minimum for Task #4 Presentation

· High level summary of your deliverables

· Lessons learned-Best practices