Risk Management 2021-22

Academic Year: 2021-22 Programme: BTECH-IT

Year: 4th Semester: VII
Name of Student: Batch :
Roll No: Date of experiment:
Faculty: Signature with Date:

Lab 02 – Risk Management Controls

Aim: Align risks, threats and vulnerabilities to risk management controls
Learning Outcomes:
1. Define Risk Management in an IT infrastructure
2. Describe controls used for IT risk assessment and management
3. Use the controls as guide to define the scope of risk management
4. Apply controls to help plan and organise the identified IT risks, threats and
vulnerabilities
Readings:
Refer to any risk management framework. For e.g. COBIT 09
Procedure:
1. Align risk, threat or vulnerability assessment as per C-I-A primary first and
assess
2. Align risk, threat or vulnerability assessment remediation to Effectiveness,
Efficiency, Compliance and Reliability
3. Assess the risk impact for each threat or vulnerability in the following areas
a. Information – what is the risk impact? How to mitigate? How to
manage?
b. Application - what is the risk impact? How to mitigate? How to
manage?
c. Infrastructure - what is the risk impact? How to mitigate? How to
manage?
d. People - what is the risk impact? How to mitigate? How to manage?
4. Based on the threats and vulnerabilities in the earlier lab complete the rest.
Observations
1. For the threats and vulnerabilities identified in earlier lab
a. Which risk management control objectives are affected
b. Specify whether the threat or vulnerability impacts C-I-A
c. Assess the risk impact or risk factor that it has on your organisation in the
following areas and explain how this risk can be mitigated and managed
a. Threat or Vulnerability #1:

1
Risk Management 2021-22
i. Information
ii. Application
iii. Infrastructure
iv. People
b. Threat or Vulnerability #2:
i. Information
ii. Application
iii. Infrastructure
iv. People
c. Threat or Vulnerability #3:
i. Information
ii. Application
iii. Infrastructure
iv. People
d. Threat or Vulnerability #4:
i. Information
ii. Application
iii. Infrastructure
iv. People
e. Threat or Vulnerability #5:
i. Information
ii. Application
iii. Infrastructure
iv. People
Questions
1. Why is it important to address each identified threat or vulnerability from C-I-A
perspective?
2. How can a data classification standard help one to access the risk impact on
“information” assets?
3. How can one communicate to the end-user community that a security threat or
vulnerability has been identified? How can one prioritize risk remediation tasks?
4. Highlight the difference between effectiveness vs efficiency when assessing risk
and risk management?
Conclusion: [Kindly write down your conclusion regarding this tutorial]