Process analysis of IT risks
The risk analysis process usually generates a document to which it is known as risk matrix. This document identified elements are shown, how they relate and calculations. This risk analysis is essential for proper risk management. Risk management refers to the management of organizational resources. There are different types of risks as total residual risk and risk as well as risk treatment, risk assessment and risk management among others. The formula for determining the total risk is:
RT (total risk) = Probability x Impact Average From this formula we will determine their treatment and after applying the controls we can obtain the residual risk.
As described in ISO / IEC 27001 BS: 2005, the risk assessment includes the following activities and actions:
Identification of assets.
Identification of legal and business requirements that are relevant to the identification of assets.
Valuation of assets identified.
Given the identified legal requirements of business and the impact of loss of confidentiality, integrity and availability.
Identification of threats and vulnerabilities for important assets identified.
Risk assessment of threats and vulnerabilities to occur.
Calculation of risk.
Risk assessment against a predetermined risk level.
After performing the analysis we must determine what actions to take regarding the residual risks that were identified. The actions include:
RISK ENVIRONMENTS.- control Strengthen existing controls and / or add new controls.
RISK ENVIRONMENTS.- Delete Delete the related asset and thus the risk is eliminated.
You share the RISK ENVIRONMENTS.- through contractual agreements of the risk is transferred to a third party.
RISK ENVIRONMENTS.- accept is determined that the exposure level is appropriate and therefore accepts.
Considerations
Do not forget that in business security begins inside. Training staff, creating rules based on standards, analyzing gaps and blind spots in the logical security and the security of information systems.
It is essential to create conflict scenarios continuously participating company management together with a security auditor, based on these scenarios achievable measures to prevent security events.
Related items
Active. It is an object or resource value used in a business or organization Threat. It is an event that can cause a security incident in a company or organization producing potential loss or damage to their assets. Vulnerability. It is a weakness that can be exploited with the materialization of one or more threats to an asset. Risk. It is the probability of occurrence of an event that can cause potential services, resources or systems of a company harm. Analysis. Browse or break a whole detailing each of the elements that make up the order to finish the relationship between their principles and elements. Control. It is a safety mechanism for preventing and correcting employee to reduce vulnerabilities
This risk management process is an ongoing process because it is necessary to evaluate the risks encountered periodically and if they have an impairment, to do calculations at different stages of risk. The mechanics that as many organizations is reversed today is the effort of the day. That’s why perform risk analysis of the project based on the project and the future impact on the risk structure of the organization.
Support tools
There are several tools on the market with which one can support the assessment of risks, mainly in the process of evaluating them. Once this process must document all information collected for further analysis. The tool that we select must contain at least one module of data collection, analysis of these and other reports. The importance of good analysis and good presentation of the data analyzed will lead to an effective interpretation of the current risk situation and hence the selection of controls that we implement will be the most successful in the selection process, saving product costs and operating costs in addition to saving time.















