Luis GutierrezCSC 116 Homework #4 1. What is risk management? Why is the identification of risks, by listing assets and theirvulnerabilities, so important to the risk management process?Risk management is the process of identifying risk, as represented by vulnerabilities, toan organization’s information assets and infrastructure, and taking steps to reduce this risk to an acceptable level3. Who is responsible for risk management in an organization? Which community of interest usually takes the lead in information security risk management?
Each community of interest has a role to play in managing the risks that an organization encounters and the information security community takes the lead in information security risk management.
6. What value does an automated asset inventory system have for the risk identificationprocess? The inventory listing is usually available in a database or can be exported to a database for custom information on security assets. Once stored, the inventory listing must be kept current, often by means of a tool that periodically refreshes the data. When you move to the later steps of risk management, which involve calculations of loss and projections of costs, the case for the use of automated risk management tools for tracking information assets becomes stronger. 9. What
’
s the difference between an asset
’
s ability to generate revenue and its ability togenerate profit?
They both depend on a particular asset however some services may have large revenue clause, but are operating on such thin or nonexistent margins that they do not generate a profit.
10.What are vulnerabilities? How do you identify them? They are specific avenues that threat agents can exploit to attack an information asset. They are chinks in the armor
,
a flaw or weakness in an information asset, security procedure, design, or control that could be