Fundamentals of Information Systems and Security
Chapter 4
Information Security and Business Drivers
Project Management Body of Knowledge (PMBOK) A collection of the knowledge and best practices of the project management profession.
Project Mangement Institute (PMI) A nonprofit international organization of project managers that promotes the field of project management.
Risk Methodology A description of how you will manage overall risk. It includes the approach, required information, and techniques to address each risk.
Risk Register A list of identified risks that results from the risk-identification process.
Delphi method An information and opinon collection method that empoloys formal anonymous surveys in multiple rounds.
Qualitative Risk Analysis A risk analysis method that uses mathematical formulas and numbers to assist in ranking risk severity.
Risk Impact- High Very Likely to occur, Average Neither frequent nor rare, Low not very likely to occur, Critical- High Impact requires immediate response, Major- medium impact requires prioritized response, Minor- negligible impact requires an analysis to assess if a response is needed.
Quantitative Risk Analysis uses mathematical formulas and numbers to rank risk severity.
Exposure Factor (EF) The proportion of value of a particular asset is likely to be destroyed by a given risk, expressed as a percentage.
Single loss expectancy (SLE) the loss for a single threat occurence.
Annual Rate of occurance(ARO) The estimated annual probabliity that a stated threat will be realized.
Annual Loss Expectancy(ALE) the annual estimated loss due to a specific realized threat.
Steps Involed in performing a quantitative risk analysis for each item on your risk register
1. Calculate the risk exposure
a. Assign a value to each resource.
b. Determine the percentage of loss for each realized threat. This value is the exposure factor for the threat against a resource.
2. Calculate the loss for a single threat occurence, called the single loss expectancy using the following formula:
SLE = resource value X EF
3. Calculate or determine the annual probability of a loss. The estimated annual probability that a stated threat will be realized is called the annual rate of occurence
4. Calculate the annual estimated loss due to a specific realized threat, called the annual loss expectancy using the following formula
ALE = SLE X ARO
Residual Risk any risk that exists but has a defined response
Risk Response Planning
Negative Risks
Avoid when you avaoid a negative risk
Transfer when you transfer a negative risk
Mitigate when you mitigiate a negative risk
Accept when you accept a negative risk.
Positive Risks
Exploit when you exploit a positive risk
Share when you share a positive risk
Enhance when you enhance a positive risk
Accept when you accept positive risk
Recovery Point Objective (RPO) the amount of data loss that is acceptable
Recovery Time Objective the maximum allowable time to recover the function
Business recovery requirements any business prerequistes for the business functions that must be already in place for the recovery functions to occur
Technical Recovery Requirements any technical prerequistes to supoprt each business business function
Business continity plan is a plan for structured respones to any events that result in an interruption to critical business activities or functions
Disaster Recovery
Ensure everyones safety first
Respond to the disaster before pursing recovery
Follow the DRP, including communicating with all affected parties
Hot site facility with environmental utilities, hardware software and data that closely mirrors the original data center, most expensive, least switchover time
Warm Site facility with environmental utilities and basic computer hardware, less expensive than a hot site but requires more time to load operating systems, software, data, and configurations.
Cold Site facility with basic environmental utilities but no infrastructure components least expensivve option but at the cost of the longest switchover time since all hardware software and data must be loaded at the new site
Mobile Site Trailer with necessary environmental utilities that can operate as a warm site or cold site very flexible fairly short switchover time, and widely varying costs based on size and capacity.
Checklist Test- this is the simplest type of DRP test
Structured walk-through a similiar to a checklist test but DRP team uses role playing to simulate a disaster
Simulation test more realistic uses role playing
Parallel Test evaluates the effectiveness of the DRP by enabling full processing capabilities
Full interruption test this is the only complete test
Sarbanes Oxley Act (SOX) became a law in july 2002 int roduced changes to hwo corporate governance and financial practices are regulated
Health Insurance Portability and Accountability Act (HIPAA) April 14 2006 governs how doctors hospitals and other health care providers handle personal medical information
Federal Information Security Management Act (FISMA) improtance of information security to the national security and econmoic health of the united state