Assessing and Managing Security Risk in IT Systems

Table 5.1 Detailed Outline of the Risk Assessment Process

1. Identify business process:

a. The risk methodology determines risk for a particular business process. It is the business processes that are the foundation of the company’s business and therefore risk should be defined in regard to these processes.

b. This methodology will tie the business processes to the assets they rely on, to the architecture that supports the assets, and to the vulnerabilities of the architecture. Together this will lead to a determination of the risks of the business process.

2. Determine operational concerns:

a. There are three operational concerns to be considered:

i. Confidentiality—the privacy and protection of data from unauthorized access or exposure.