Risk Assessment Case Study

Open, View, and/or
Download this Document

Total Length: 3324 words ( 11 double-spaced pages)

Total Sources: 5

Page 1 of 11

Chief Information Security Officer-Level Risk Assessment

The objective of this work in writing is to examine Chief Information Security Officer-Level Risk Assessment. Specifically, the scenario in this study is securing information for the local Emergency Management Agency in an Alabama County. The Director of Emergency Management in this County has tasked the Chief Information Security Officer with setting out a plan for information security of the Department's networking and computing systems.

Information Security Management involves the "identification of an organization's assets and the development, documentation, and implementation to policies, standards, procedures, and guidelines, which ensure their availability, integrity, and confidentiality." (Official ISC Guide to the CISSP Exam, nd) Threats are identified, assets classified and security controls implemented through use of "data classification, security awareness training, risk assessment, and risk analysis and as well their vulnerabilities are rated. (Official ISC Guide to the CISSP Exam, nd)

Risk management involves the "identification, measurement, control, and minimization of loss associated with uncertain events or risks." (Official ISC Guide to the CISSP Exam, nd) Included are over-all security reviews, risk analysis, evaluation, and selection of safeguards, cost/benefit analysis, management decisions, safeguard implementation, and effectiveness reviews." (Official ISC Guide to the CISSP Exam, nd)

I. Security Plans and Implementation

It is important that the CISSP understand the following:

(1) The planning, organization, and roles of individuals in identifying and securing an organization's information assets;

(2) The development of effective employment agreements; employee hiring practices, including background checks and job descriptions; security clearances; separation of duties and responsibilities; job rotation; and termination practices

(3) The development and use of policies stating management's views and position on particular topics and the use of guidelines, standards, baselines, and procedures to support those policies;

(4) The differences between policies, guidelines, standards, baselines, and procedures in terms of their application to information security management;

(5) The importance of security awareness training to make employees aware of the need for information security, its signi-cance, and the speci-c security-related requirements relative to the employees' positions;

(6) The importance of data classi-cation, including sensitive, con-dential, proprietary, private, and critical information;

(7) The importance of risk management practices and tools to identify, rate, and reduce the risk to speci-c information assets, such as:

(a) Asset identi-cation and evaluation

(b) Threat identi-cation and assessment

(c) Vulnerability and exposures identi-cation and assessment

(d) Calculation of single occurrence loss and annual loss expectancy

(e) Safeguards and countermeasure identi-cation and evaluation, including risk management practices and tools to identify, rate, and reduce the risk to speci-c information assets

(f) Calculation of the resulting annual loss expectancy and residual risk

(g) Communication of the residual risk to be assigned (i.e., insured against) or accepted by management

(h) The regulatory and ethical requirements to protect individuals from substantial harm, embarrassment, or inconvenience, due to the inappropriate collection, storage, or dissemination of personal information

(i) The principles and controls that protect data against compromise or inadvertent disclosure

(j) The principles and controls that ensure the logical correctness of an information system; the consistency of data structures; and the accuracy, precision, and completeness of the data stored

(k) The principles and controls that ensure that a computer resource will be available to authorized users when they need it

(l) The purpose of and process used for reviewing system records, event logs, and activities

(m) The importance of managing change and the change control process

(n) The application of commonly accepted best practices for system security administration, including the concepts of least privilege, separation of duties, job rotation, monitoring, and incident response

(o) The internal control standards reduce that risk; they are required to satisfy obligations with respect to the law, safeguard the organization's assets, and account for the accurate revenue and expense tracking;

(p) there are three categories of internal control standards -- general standards, speci-c standards, and audit resolution standards: (i) General standards must provide reasonable assurance, support the internal controls, provide for competent personnel, and assist in establishing control objectives and techniques (Official ISC Guide to the CISSP Exam, nd) (ii) Speci-c standards must be documented, clear, and available to personnel; they allow for the prompt recording of transactions, and the prompt execution of authorized transactions; speci-c standards establish separation of duties, quali-ed supervision, and accountability (Official ISC Guide to the CISSP Exam, nd) and (iii) Audit resolution standards require that managers promptly resolve audit ?ndings; they must evaluate the ?nding, determine the corrective action required, and take that action. (Official ISC Guide to the CISSP Exam, nd)

II. Risk Assessment

In the event that the Emergency Management Agency in the county at issue in this scenario is required to respond to a severe weather event, it is likely that the network and computing system of the agency will be using backup or generator power to run the system should the electrical power be knocked out during a severe weather event.

Stuck Writing Your "Risk Assessment" Case Study?

View All Our Example Risk Assessment Case Study

Have A Custom Example Essay Written

The Information Security Manager is required to "establish and maintain a security program that ensures the "availability, integrity, and confidentiality of the organization's information resources. Availability is reported to be the assurance "that a computer system is accessible by authorized users whenever needed." (Official ISC Guide to the CISSP Exam, nd)

There are two aspects of availability including: (1) denial of service; and (2) loss of processing capabilities as a result of natural disasters, or human actions. (Official ISC Guide to the CISSP Exam, nd) Denial of service relates to user or intruder actions that result in computing services being tied up resulting in the system being unable to be utilized by users who are authorized to use the system. (Official ISC Guide to the CISSP Exam, nd, paraphrased)

III. Contingency Planning

Contingency planning is reported to involve: (1) business resumption planning; (2) alternative-site processing; or (3) simple disaster recovery planning results in another method of processing so that availability is ensured. (Official ISC Guide to the CISSP Exam, nd, paraphrased) Important aspects of security considerations are: (1) physical; (2) technical; and (3) administrative controls. (Official ISC Guide to the CISSP Exam, nd)

Physical controls include unauthorized persons coming into contact with computing resources and include "fault-tolerance mechanisms and access control software to prevent unauthorized users from disrupting services." (Official ISC Guide to the CISSP Exam, nd) Physical controls are those set in place to prevent individuals who are not authorized to come in contact with resources including computing resources, fire and water controls, as well as processing and off-site backup facilities used for storage. (Official ISC Guide to the CISSP Exam, nd, paraphrased)

Technical controls are reported to be inclusive of fault-tolerance mechanisms as well as electronic vaulting and access control software so that users that are not authorized are unable to disrupt services. Administrative controls include "access control policies, operating procedures, contingency planning, and user training." (Official ISC Guide to the CISSP Exam, nd) It is important that operators, programmers, and security personnel are trained so that they can assist in the avoidance of computing errors causing availability loss.

Integrity is reported as the "protection of system information or processes from intentional or accidental unauthorized changes." (Official ISC Guide to the CISSP Exam, nd) While the security program in place is unable to ensure or improve the data accuracy in terms of that which is input into the system, it is such that can assist in making sure that changes are intended and that intended changes are effectively applied to the system. There are three basic principles to the establishment of integrity controls including:

(1) Granting access on a need-to-know basis;

(2) Separation of duties; and (3) Rotation of duties. (Official ISC Guide to the CISSP Exam, nd)

The 'need-to-know' access principle is that users should be only granted access to files and programs that are required for the users to effectively perform their assigned tasks. The access of users to production data and programs should be restricted "through use of well-formed transactions" that serve to ensure that "users can change data or programs only in controlled ways that maintain integrity." (Official ISC Guide to the CISSP Exam, nd)

Separation of duties ensures that no one employee has control of a transaction "from beginning to end" and that at least two individuals or more are responsible for performing the transaction. Rotation of duties involves changing job assignments on a periodical basis so that users are not able to gain complete control of a transaction collaboratively subverting it for some fraudulent reason.

IV. Confidentiality

Confidentiality protects the system information barring users that are not authorized as well as barring resources and processes from information access. It is reported "Con-dentiality must be well de-ned, and procedures for maintaining con-dentiality must be carefully implemented. Crucial aspects of con-dentiality are user identi-cation, authentication, and authorization." (Official ISC Guide to the CISSP Exam, nd)

Threats to confidentiality are stated to be inclusive of the following threats:

(1) Hackers. A hacker or cracker is someone who bypasses the system's access controls by taking advantage of security weaknesses that the system's developers have left….....

Show More ⇣

     Open the full completed essay and source list


OR

     Order a one-of-a-kind custom essay on this topic


Related Essays

HSMS Gap Analysis Hazard Identification and Risk Assessments

HSMS Gap Analysis and Hazard Identification Risk Assessments Description of APM Terminals Legal Environment Review of the Health and Safety Management System Description Gap Analysis Hazard Identification Physical Hazards Health and Welfare Hazards Risk Assessment Physical Hazard -- Working at Height - Scaffolding Health & Welfare Hazard -- Noise Action Plans Action Plan 1 - Management System Action Plan 2 -- Hazards and Risks Barbour Checklist: BS OHSAS 18001 Audit Checklist Occupational health and safety management has numerous benefits for business, not only an employer's duty of care, a legal and moral obligation but also critical… Continue Reading...

Child Risk Assessment for Therapy

behaviors that lead you to create a risk assessment. Clearly, Lennox portrayed substantial distress by "acting out" at school (in class and in the playground) because of several risk factors within his household environment. The boy displayed superior intelligence, but couldn't engage in schoolwork. Alternately, he was needy, withdrawn, and displayed aggression towards fellow students in scenarios where he experienced "crowding." His school's project manager and his biological father claim that he is still, at times, needy and demanding. However, his now-stable domestic life and attachment with his dad have offered him the strong and reliable relationship… Continue Reading...

Georgia Environmental Quality Departments

pregnancy are cautioned not to travel in high risk areas, especially so, where Zika virus is concerned. 2. Current environmental risk assessment methods which apply to public health issues The mission of GDPH is to offer primary prevention measures by integrating surveillance work, education programs, enforcement measures and programs for assessment aimed at identifying, preventing and alleviating the conditions likely to negatively affect human health (Georgia.Gov, 2017b). GDPH carries out inspections on foods, motels and hotels and pools to ensure that safety and health standards are upheld. Information on inspections and scores can be found on this link https://dph.georgia.gov/environmental-health-inspections (Georgia.Gov, 2017c). GDPH has a comprehensive waste water management system. GDPH… Continue Reading...

Birth Defects in Pregnant Woman over 35

women avoid or delay this proper due diligence and this is not a new phenomenon. While general risk assessments and non-invasive screening can be useful, there are some other methods that are much more exhaustive and effective (Dunn, 2003). Another dimension that truly exists but is not commonly looked at is who precisely to target when it comes to the screening for birth defects. Rather than simply cast a wide net and try to get as many people as possible with no specificity other than perhaps age, there are many that say that certain groups and cultures should get more scrutiny than others (Zhu et al., 2016).… Continue Reading...

Implementation Process Fall Reduction Project

of Blake Hospital was via effective and comprehensive employee training on fall prevention. Towards this end, training focused on the following three areas: · Fall risk assessment · Adherence to the fall prevention strategies/approaches · Identification of the steps to take in case a fall occurs 1.2.2.1. Fall Risk Assessment · Medication fall risk assessment: pharmacists were introduced into the Medication fall Risk Score with an intention of ensuring that are capable of assessing hospital patients’ medication-related risk factors for falls. In seeking to determine if a patient is at risk for falls so that care can be planned as appropriate, the tool was utilized alongside a nursing risk scale and a clinical assessment. ·… Continue Reading...

Reducing Patient Falls

Explanation of Causes In a comprehensive analysis of patient fall data, research shows that ineffective risk assessment is a contributing factor in preventable falls (Health Research & Educational Trust, 2016). Each patient should be considered a fall risk, “regardless of age or other factors,” (Health Research & Educational Trust, 2016, p. 14). Lack of patient alert systems, lack of patient education or awareness, and lack of staff training are some of the underlying causes of preventable falls, too. Administrative issues include the lack of staff training and inconsistent application of fall prevention procedures. Identification of Stakeholders Stakeholders include all healthcare staff in the hospital, along… Continue Reading...

Critical Infrastructure Security Information Technology

critical infrastructure components in the United States are privately owned, compliance with Department of Homeland Security risk assessment methods remains voluntary. Risk assessments of critical infrastructure focus on threat, vulnerability, and consequences, with all types of assessments integral to helping improve resilience and mitigate problems (GAO, 2017). A vulnerability analysis of the nation’s information technology critical infrastructure reveals several points of weakness and security gaps. The Department of Homeland Security (2018) infrastructure survey tool can be used alongside the systems dynamics approach to vulnerability assessment. These tools reveal the inherent strengths of complex, interdependent information technology systems, while also revealing the potential weaknesses in a decentralized… Continue Reading...

Analyzing Two Global Security Organizations

in a wide range of jurisdictions. Wexford Group offers services including operational advising, law enforcement support, program management, risk assessment, operations and intelligence fusion, development and fielding, and also recruitment, assessment, selection, and training (RAST) support for government agencies and private industries. TAL Global offers airport and aviation security, emergency preparedness planning, executive protection, risk management, school safety and security, and a range of other security services within their organizational rubric. These two organizations have similar leadership structures, dividing their different duties into different departments, each with its own organizational sub-structures. Working within the laws and jurisdictions of any client context, TAL Global and the Wexford Group are… Continue Reading...

Physical Security Design and Methods of Security

Physical Security Design The physical security of any entity is largely pegged on the risk assessment mechanisms used. Prior to implementing any physical security plans, it is fundamental to comprehend the types of threats that the entity is faced with, the possibility that the threats will occur, and the level of damage likely to be inflicted in the threat happens. Firms involved in risk management should be able to assist in the identification of the vulnerability areas and thereafter form a functional and sound physical security plan. Schools, businesses, government agencies, and private institutions and individuals and can enjoy the benefits of using exert… Continue Reading...

Operation Anaconda

of information-age battles. Additionally, it is unclear whether commanders used risk assessment and risk management techniques to determine potential risks for engaging in the operation and how to mitigate the risks. In conclusion, Operation Anaconda remains to be one of the major operations in Operation Enduring Freedom in Afghanistan in 2002. This operation has continued to provide significant insights for military commanders and personnel on how to conduct joint operations. As shown in this discussion, Operation Anaconda was based on mission command concept of conducting unified military operations against an enemy. Mission command is based on six principles, which are… Continue Reading...

Emergency Response Crisis Management and CERT

Crisis Management Crisis management refers to the process of comprehensive risk assessment and strategic planning. A Community Emergency Response Team (CERT) provides proactive strategies for mitigating risk and managing crises through effective mobilization of human, financial, and technological resources, coordination of different support agencies and allies, and the implementation of recovery and response missions. There is no one central crisis management protocol, for each organization or community will have its own specific risks and resources (“Crisis Management and Emergency Response Plans,” n.d.). The CERT team works within the parameters of its community contingencies. Emergency Management Emergency management refers to specific plans… Continue Reading...

The Greatest Ponzi Scheme

this, the auditor must employ a variety of audit tools that includes a review of which audit procedures were used, materiality decisions and risk assessments, and adopted analytical measures as stated initially. These processes help the auditor recognize control risks that may contribute to the observed misstatements in accounting information and balance sheets. To confirm accuracy, the auditor must carefully review key transactions that will help ensure investors are not swindled by investment advisors like Bernie Madoff. Such actions will keep overstatements of the financial health of an investor's money to a minimum and offer integral evidence that will help lead future financial decisions for the investment firm. Other issues like check kitting… Continue Reading...

Sources of Birth Defects in Older Mothers

However, many women avoid or delay this proper due diligence and this is not a new phenomenon. While general risk assessments and non-invasive screening can be useful, there are some other methods that are much more exhaustive and effective (Dunn, 2003). Another dimension that truly exists but is not commonly looked at is who precisely to target when it comes to the screening for birth defects. Rather than simply cast a wide net and try to get as many people as possible with no specificity other than perhaps age, there are many that say that certain groups and cultures should get more scrutiny than others (Zhu et al., 2016).… Continue Reading...

The Local State and Federal Levels of Disaster Management

including strategic planning, intelligence gathering, communication, and coordination. FEMA conducts risk assessments, helps communities build resilience, and helps to protect or recovery essential services. FEMA (2018b) also outlines its five core mission areas, which include prevention, protection, mitigation, response, and recovery. FEMA remains active at each of these stages of emergency management and does not discriminate against any one type of emergency, playing as integral a role in natural disaster management as in technological, cyber, and terrorist-related incidents. Prevention involves strategic planning, information gathering, intelligence sharing, threat detection, and any other activity that would involve stopping a problem before it… Continue Reading...

Managerial Accounting and Business Ethics

in…[…… parts of this paper are missing, click here to view the entire document ]…misstatements or the lack of suitable risk assessment, and disregarding the key issues that are linked to a particular product (Zowie, 2012). When ascertaining and assessing the interests and relationships that may generate a conflict of interest and executing safeguards, when essential, to eradicate or diminish any threat to compliance with key principles to a suitable level, a management accountant in public practice is obligated to act ethically by exercising professional judgment and take into consideration whether a sensible and knowledgeable third party, weighting all the distinct facts and situations available to the professional accountant at… Continue Reading...

sample essay writing service

Cite This Resource:

Latest APA Format (6th edition)

Copy Reference
"Risk Assessment" (2012, December 09) Retrieved May 8, 2024, from
https://www.aceyourpaper.com/essays/risk-assessment-105984

Latest MLA Format (8th edition)

Copy Reference
"Risk Assessment" 09 December 2012. Web.8 May. 2024. <
https://www.aceyourpaper.com/essays/risk-assessment-105984>

Latest Chicago Format (16th edition)

Copy Reference
"Risk Assessment", 09 December 2012, Accessed.8 May. 2024,
https://www.aceyourpaper.com/essays/risk-assessment-105984
   

Open, View, and/or
Download this Document
order custom essay example