Scribd Logo
Upload

Welcome to Scribd!

  • 17 views

    Information Technology Risk

    Uploaded by

    Dhruvi Ramani
    The document discusses information technology (IT) risk. It provides definitions of IT risk from various organizations as the possibility that threats can exploit vulnerabilities and negatively impact an organization. It also notes that measuring exact IT risk is difficult but approximate risk can be measured using factors like assets, impact, threats, and likelihood. Common strategies for managing IT risk include eliminating it, transferring it, mitigating it, and accepting it. Network security concepts like encryption, authentication, firewalls, and protocols help secure IT systems from risks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Information Technology Risk

    Uploaded by

    Dhruvi Ramani
    17 views15 pages
    The document discusses information technology (IT) risk. It provides definitions of IT risk from various organizations as the possibility that threats can exploit vulnerabilities and negatively impact an organization. It also notes that measuring exact IT risk is difficult but approximate risk can be measured using factors like assets, impact, threats, and likelihood. Common strategies for managing IT risk include eliminating it, transferring it, mitigating it, and accepting it. Network security concepts like encryption, authentication, firewalls, and protocols help secure IT systems from risks.

    Original Description:

    Risks IT

    Original Title

    Information Technology Risk (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses information technology (IT) risk. It provides definitions of IT risk from various organizations as the possibility that threats can exploit vulnerabilities and negatively impact an organization. It also notes that measuring exact IT risk is difficult but approximate risk can be measured using factors like assets, impact, threats, and likelihood. Common strategies for managing IT risk include eliminating it, transferring it, mitigating it, and accepting it. Network security concepts like encryption, authentication, firewalls, and protocols help secure IT systems from risks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    17 views15 pages

    Information Technology Risk

    Uploaded by

    Dhruvi Ramani
    The document discusses information technology (IT) risk. It provides definitions of IT risk from various organizations as the possibility that threats can exploit vulnerabilities and negatively impact an organization. It also notes that measuring exact IT risk is difficult but approximate risk can be measured using factors like assets, impact, threats, and likelihood. Common strategies for managing IT risk include eliminating it, transferring it, mitigating it, and accepting it. Network security concepts like encryption, authentication, firewalls, and protocols help secure IT systems from risks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 15

    Information

    Technology
    Risk
    Here starts the
    lesson!
    Introduction

    Any risk related to IT. Various


    events or incidents that
    compromise IT in some way
    can therefore cause adverse
    impacts on the organization’s
    business
    Definitions

    By Committee on NSS By ISO


    Risk - Possibility that a particular
    The potential that a given
    threat will adversely impact an IS
    by exploiting a particular threat will exploit
    vulnerability vulnerabilities of an asset or
    group of assets and thereby
    cause harm to the
    By Risk Management Insight organization.
    IT risk is the probable
    frequency and probable
    magnitude of future loss
    Measuring IT Risk
    It is very difficult to measure exact risk rather it is impossible to measure exact
    IT risk.

    We can measure approximate risk.

    Four fundamental forces involved in risk management :

    1. Assets
    2. Impact
    3. Threats
    4. Likelihood
    Risk
    R=LXI
    IT Risk
    Management

    Avoid Transfer
    Eliminate the risk by not Share risk with partners or
    taking up or avoiding the transfer to insurance
    specific business process coverage

    Mitigate Accept
    Implement controls Formally acknowledge that
    the risk exists and monitor it
    Network Security

    ● Message Confidentiality

    ● Message Integrity

    ● Message Authentication

    ● Message Non Repudiation

    ● Entity Authentication
    Cryptography
    Encryption
    Transforming plain
    text to cipher text

    Decryption
    Transforming cipher
    text into plain text
    Entity Authentication

    Something Something Something


    Known Possessed Inherent
    ● Password ● Passport ● Signature
    ● One time ● PAN Card ● Fingerprints
    password ● Driver’s ● Voice
    (OTP) License ● Facial Characteristics
    ● PIN ● I- Card ● Retinal Pattern
    ● Credit Card ● Handwriting
    ● Smart Card
    SET SSL
    ● Secure Electronic ● Secure Sockets Layer
    Transaction ● URL changes from http to
    ● Developed by MasterCard https
    and Visa ● It can be used only with
    ● Protocol designed for http messages
    handling credit card ● Encryption is based on
    transactions over Internet session key
    ● Ensures the identities of all ● SSL protocol provides data
    parties involved in the encryption, server
    transaction authentication, optional
    ● Encrypts information before client authentication and
    transmitting message integrity
    Firewall
    ● Helps to keep your
    computer more secure
    ● Can be hardware based
    or software based
    ● A barrier between
    external and internal
    network
    ● Prevents direct
    communication
    ● Prevents unauthorized
    access
    Email
    Encryption
    ● Encryption of email messages to ● By means of some tools, persons
    protect the content from being read other than the designated recipients
    by other entities can read the email contents
    ● It may also include authentication
    ● Email is prone to disclosure of
    information
    ● Most emails are currently transmitted
    in the clear form
    Website Risks
    First party Risks Third party Risks

    ● Physical damage to website ● Contract and consumer law


    operations ● Defamation and falsehoods
    ● Loss of data, programs, software ● Data protection
    ● Virus attacks ● Confidence and privacy
    ● DOS attacks ● Innocent transmissions
    ● Hacking and site penetration ● Discrimination and harassment
    ● Website hijacking ● General regulations and laws
    ● Loyalty and Fraud by employees ● IP and domain name
    ● Credit card fraud and phishing infringements
    ● Jurisdictions of trading
    The Elements of Security
    1. Vulnerability
    (the absence or weakness of a safeguard that could be
    exploited
    2. Threat
    (Any potential danger to information or systems)
    3. Risk
    (The likelihood of a threat agent taking advantage of
    vulnerability and the corresponding business impact)
    4. Exposure
    (An instance of being exposed to losses from a threat agent)
    5. Countermeasure or Safeguard
    (It is an application that mitigates the risk)
    Thank you

    You might also like