Information Risk Management

1
Information Risk Management

• Brittney Berry
• Kris Collum
• Jessica Grant

2
Outline

• Information Risk Management
• Challenges of Information Security
• People Involved
• The Risks Involved
• Threats to Risk Management
• Risk Mitigation Options

3
What is Information Risk Management?

• Definition
• Goal
• Two Main Elements
• Risk Analysis
• Risk Management

4
Why is Information Security so Challenging?

• Adversary vs. Defender
• Ever-changing
• Resources

5
Who is involved in Information Risk Management?

• CISO, CPO, CPSO, CCPO
• Chief Information Risk Officer
• Risk Management Roles and Responsibilities
• BOD
• IT strategy committee
• CEO
• Business executives
• CIO

6
What are the risks?

• Investment or expense risk
• Access or security risk
• Integrity risk
• Relevance risk
• Availability risk
• Infrastructure risk
• Project ownership risk

7
What are the threats to risk management?

• Natural threats
• Human Threats
• Environmental Threats

8
Risk Mitigation Options

• Risk Assumptions
• Risk Avoidance
• Risk Limitation
• Risk Planning
• Risk Transference

9
Sources

• IT Governance Institute. Information Risks
  Whose Business Are They? 2008.
• Pironti, John. Key Elements of an Information
  Risk Management Program Transforming
  Information Security Into Information Risk
  Management. 2008
• National Institute of Standards and Technology.
  Risk Management Guide for Information Technology
  Systems. 2002