Case Study Week 5
Eric A Brock
DeVry University

Case Study Week 5

Before I explain how you can apply risk management to our corporate security policy, I want to take a look at the basics of risk management. The risk management process involves answering three simple questions, what assets do you have that are worth protecting, what are the known threats to those assets, what can you do to keep those threats from actually occurring. When it comes to the assets that are worth protecting, your mind probably immediately jumps to your company's hardware inventory. First, it should educate the company's employees as to what is expected of them regarding cybersecurity (prevention). Second, it should be a guide that dictates the appropriate response to a variety of security incidents. To accomplish these two goals, you need to limit your policy to a manageable size. If you're trying to educate users on security strategies, keep the documentation short and simple. Users will usually ignore anything that's over a couple of pages long or that's overly complex. If you want to get technical, the real asset is your data. Since authentication credentials are the gateway to your data, they should also be treated as an asset that needs protecting. Clearly, passwords can be disclosed by users with no malicious intent. The resulting damage, however, can be just as serious as if the security breach were malicious. Therefore, when making your list of known threats against your assets, try to be creative and think of both malicious and casual threats. A risk management security policy focuses on prevention and response.
Because some incidents just can't be prevented, it's crucial to establish a response plan for handling your identified threats. It seems logical that if your goal is to prevent a

Case Study Week 5

security incident,