Security Risk Management

Chapter 14

Building a Program from Scratch

Information in this Chapter

• Designing a Risk Program

• Prerequisites for a Risk Management Program

• Risk at the Enterprise Level

• Linking the Program Components

• Program Roadmap

Introduction

Knowing how to assess a risk is clearly an essential skill for risk managers and analysts, but this knowledge in no way guarantees that you will be successful at building a security program around risk activities. Traditionally, guidelines for security leaders have focused on such aspects of a security program as awareness or budgeting, but how can any of this be properly prioritized without first establishing a basic risk profile for your organization? Sure, you can publish some basic security policies, ...