Information Risk Management

Brittney Berry
Kris Collum
Jessica Grant
 Outline

• Information Risk Management

• Challenges of Information Security
• People Involved
• The Risks Involved
• Threats to Risk Management
• Risk Mitigation Options
What is Information Risk Management?
• Definition

• Goal

• Two Main Elements

▫ Risk Analysis
▫ Risk Management
 Why is Information Security so
Challenging?

• Adversary vs. Defender

• Ever-changing

• Resources
 Who is involved in Information Risk
Management?
• CISO, CPO, CPSO, CCPO
• Chief Information Risk Officer
• Risk Management Roles and Responsibilities
▫ BOD
▫ IT strategy committee
▫ CEO
▫ Business executives
▫ CIO
 What are the risks?
• Investment or expense risk
• Access or security risk
• Integrity risk
• Relevance risk
• Availability risk
• Infrastructure risk
• Project ownership risk
What are the threats to risk management?

• Natural threats

• Human Threats

• Environmental Threats
 Risk Mitigation Options
• Risk Assumptions

• Risk Avoidance

• Risk Limitation

• Risk Planning

• Risk Transference
 Sources
• IT Governance Institute. Information Risks: Whose Business Are
They? 2008.

• Pironti, John. Key Elements of an Information Risk Management

Program: Transforming Information Security Into Information
Risk Management. 2008

• National Institute of Standards and Technology. Risk Management

Guide for Information Technology Systems. 2002