Step 4: Document Internal and External Threats
Risk Assessment Transcript
You receive an email from your boss, Maria Sosa.
The email reads: Hello, great job with the vulnerability assessment last month. This will help fulfill our DoD contract requirements.
For our next project, you will use the information from that vulnerability assessment to begin a risk assessment. This will help us understand the cybersecurity risk to our mission, function, image, and reputation. This formal assessment will be completed in the spring, but I’d like you to start thinking about the process now and prepare an executive summary of your plan by the first of the month.
You should use the information in the vulnerability assessment, including internal and external threats, vulnerability information, likelihoods and impacts, to outline the elements for inclusion in your risk assessment. This is the starting point to establish our long-term risk management strategy.
The final report should focus on two elements. The first element is defining the policies, processes, and technologies used to assess and manage risks across all levels of the organization within budget and other logistical constraints. The second element is identifying software acquisition and installation risk, network access risk, and risks associated with social media.
Please submit the initial report for review. Once we have agreed on the final document, we will communicate the findings to all appropriate stakeholders.
FYI – I will be traveling the rest of this week, but feel free to email me with any questions.
Very Respectfully, Maria
Project 2 Start Here
Organizations must stay up-to-date on their vulnerabilities and protection measures. Once vulnerabilities have been evaluated, the organization uses this information to develop a risk assessment plan. This plan should consider the perspectives of owners, shareholders, employees, policy makers, suppliers, and customers.
In this project, “Risk Assessment,” use the previous findings from Project 1, “Vulnerabilities Assessment Report,” to recommend an action plan for the risk assessment assigned in this project. The final assignment is a five- to seven-page review or summary of the risk assessment. Note that this is not a complete risk management report, but a “what if” report outlining potentials in both attacks and possible responses.
For this particular project, grades are based on the ability to clearly and accurately assess policies, processes, and technologies to identify and assess risk and articulate effective mitigation strategies to achieve the appropriate security needed for the enterprise.
This is the second of four sequential projects. There are 12 steps in this project. Begin below to review the project scenario.
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
2.1: Identify and clearly explain the issue, question, or problem under critical consideration.
2.5: Develop well-reasoned ideas, conclusions or decisions, checking them against relevant criteria and benchmarks.
9.3: Assess policies, processes, and technologies that are used to create a balanced approach to identifying and assessing risks and to manage mitigation strategies that achieve the security needed.
Step 1: Review the Risk Management Framework
As the first step in preparing the risk assessment, review the risk management implementation framework and the risk management technologies that you might use in your assessment.
In the subsequent sections of this project, you will write a risk assessment summary report that can be used in addressing cybersecurity threats through risk management.
When this first step is complete, move to the next step, where you will create a list of vulnerable assets.
Step 2: Document Vulnerable Assets
In the opening step, you considered the risk management implementation framework and the risk management technologies you might use. Now, it’s time to list the organization’s vulnerable assets.
In order to conduct effective information risk management, the vulnerabilities of the system must be understood and documented prior to starting the assessment, regardless of which of the risk risk assessment approaches is used.
Begin by conducting a thorough review of the recently completed Vulnerability Assessment report. During the review, pay particular attention to which security risks to information systems that might be relevant and consider varying types of risk assessment and analysis.
Using the Vulnerable Assets Template, identify and create a list of assets considered vulnerable. This is a simple list, not prioritized, not valued, simply identified, but complete. Pay particular attention to application software in both the acquisition and implementation phases. This list of vulnerable assets will also be used during the next step.
Submit the completed list of vulnerable assets for feedback. In the next step, you will take the vulnerable assets and use them to identify specific internal and external threats.
Step 3: Review the Vulnerable Assets List
In the previous step, a list of vulnerable assets was compiled from the Vulnerability Report in the previous project. Now, incorporate any feedback from the previous step and identify specific cybersecurity threats, including network access risk by devices to those assets.
Again, the Vulnerability Assessment final report is the starting point to fulfill this step in the Risk Assessment. Compiling a complete list of threats and vulnerabilities will act as a comprehensive review of your vulnerability assessment as well as potentially expand the list, now that you have greater input and a second look at your previous results.
Step 4: Document Internal and External Threats
You’ve reviewed the list of vulnerable assets, and in this step, you will document threats. Recall that a threat is any event, action, or factor that has the potential to cause damage to the enterprise. Threats can come from a variety of sources, including people (a hacker stealing employee passwords) and natural events (a power blackout causing data loss).
Use the Internal and External Threats Template to add all threats and vulnerabilities — internal and external to the enterprise, and tie them to the itemized assets that will be impacted. Note that external threats will include a comprehensive review by device type at network access, both direct and indirect, a view of the social media landscape as a threat.
Submit the itemized list of threats for feedback. In the next step, you will conduct research and report on inputs for threats and vulnerabilities.
Collepals.com Plagiarism Free Papers
Are you looking for custom essay writing service or even dissertation writing services? Just request for our write my paper service, and we'll match you with the best essay writer in your subject! With an exceptional team of professional academic experts in a wide range of subjects, we can guarantee you an unrivaled quality of custom-written papers.
Why Hire Collepals.com writers to do your paper?
Quality- We are experienced and have access to ample research materials.
We write plagiarism Free Content
Confidential- We never share or sell your personal information to third parties.
Support-Chat with us today! We are always waiting to answer all your questions.