What is risk management? Why is the identification of risks and vulnerabilities to assets so important in risk management?
Ans- Risk management is the process of identifying risk, as represented by vulnerabilities, to an organization’s information assets and infrastructure, and taking steps to reduce this risk to an acceptable level.

As defined, risk management process begins with identifying risks and vulnerabilities to assets and is first most important step in risk management process. It involves examination and documentation of the security posture of an organization’s information technology and the risks it faces. Risk identification is important for information security professionals to classify organizations assets- that is, identify, classify, and prioritize them. Once the organizational assets have been identified, a threat assessment process identifies and quantifies the risks facing each asset.

Identification of risk and vulnerabilities enable organizations ability to sustain long term competitiveness. For organization to make business decisions it is important to know the existing risk and vulnerabilities associated with its assets.

According to Sun Tzu, what two key understandings must you achieve to be successful in battle?
Ans- According to Sun Tzu in order to be victorious, you, a defender, must know yourself and know the enemy.

Know yourself- It is important to identify, examine, and understand the information systems that are in place in an organization. Information systems that use, store, and transmit information must be evaluated and understood as to how they add value to organization. Also it is important to know which vulnerabilities they are prone to. After knowing what we have and what steps are being taken to protect it. Having control mechanism is not the end. Making sure the control mechanism is functional is important.