A Report on Information Technology Risk Management

Sweet Spot and Discretionary Area:

For reducing the hazards and their occurrence, organization incorporates an effective information security system. For implementing such an effective security system, it is important for the organizations to take up certain amount of expense. Another fact in this regard is that the extent of efficiency of a security system is in fact directly proportional to expense (Adler, Leonard & Nordgren, 1999). On the other side, enhanced security system refers to the occurring of risk would reduce, which means risk is inversely proportional to the extent of incurred expense. Now, if a two-dimensional area is considered whereby security is to be measured by means of horizontal axis and that of expense by means of vertical axis, then the point of intersection of cost and that of risk curve, whereby both risks and costs are at equilibrium, the point is known as sweet spot.

Also, it is important for every organization requires taking up at least some amount of expense to manage risk, and there are some level of risks that may not be reduced. Thus, if the predefined lowest cost, minimum extent of risk which cannot be reduced and all current practices associated to risk prevention are simultaneously considered, then the space in that dimensional area is called discretionary area.

Security decision located towards the right of Sweet Spot and outside of Discretionary Area:

As per the given figure, we can say that in such particular context, increasing aspects of security refers to some level of costs that has equivalent impacts upon reduction of risk as the level of risk reduced almost equally as that of the enhancement of security concerns.

Discussion:

The reason behind this context is the subsequent to that of Sweet Spot, and the proportional risk reduction rate has become lower than the incremental rate of incurred expense.

3. Arguments are raised that algorithm did not succeed to distinguish amidst the high impact/low frequency threats as well as high frequency/low impact threat. For instance, fire is considered to be low frequency high impact threat as well as misuse of resources is low impact high frequency threat (Yokouchi, 2007). The algorithm ALE could not make proper differentiation amidst the two threats. The cause may be explained along with an example. When an organization emphasizes upon the risk loss estimates, Annualized Loss Expectancy may be estimated. For calculation of this, the formula use is:

Annualized Loss Expectancy = Asset Value * Exposure factor

As per the given formula, it may be identified that on measuring the annualized loss expectancy, generally two factors are considered: asset value as well as exposure factor. On multiplying these two factors, the outcome is single loss exposure. Thus, it just measures the one dimension named risk (Adler, Leonard & Nordgren, 1999). Thus, it does not succeed in identifying the frequency as well as impact or emphasis on the outcome. In matter of low frequency/high impact threat, the outcome magnitude may coincide with the outcome of high frequency/low impact threat. Thus, as a matter of fact it may be stated that oversimplification approach of ALE algorithm may be considered key factor associated with failing of drawing distinct difference amidst low frequency/high impact threat and that of high frequency/low impact threat.

4.

5.

Return on Security investment needs to be calculated for every threat in association with the specific control. As per the given table it has been identified that return upon security investment is greater for IDS as well as Insurance. These controls may be bought to combat issues like information hacking or flood(Yokouchi, 2007).

6. On considering the two tables of answer 4 and 5, one may identify that expense per incident as well as frequency of change occurrence based on control. It has been observed that it is control that considerably impacts upon the expense per incident. An instance may be referred to in this scenario to explain the influence of control within the frequency of incident occurrence (Alhawari, Karadsheh, Nehari Talet & Mansour, 2012). For combating with system virus, the total expense of the aspect was $2000 and that of occurrence frequency of 1 every month. On introducing control antivirus the expense was $1300 as well as occurrence frequency was 1 every fifth month. The cause is that there are various types of anti-viruses to fight the computer viruses. Their policy of license as well as cost may change with the alterations in the cost of incident as well as occurrence frequency.

7. During the year 1999, being a risk manager of a financial institution, I had applied the Window Model of Jacobson to respond to the T2K bug. This bug means the problem within both digital and non-digital data documentation and storage that is the result of the practice of abbreviation of four digit year to two digits. Thus, the year 2000 as well as 1900 cannot be differentiated. Various approaches were introduced to solve the Y2K bug (Vinaja, 2013). Observation suggests that data re-partitioning, data expansion, windowing, etc can be used to solve the issue. Here in this regard, the Window Model of Jacobson may be used. As per this model, risk may be attributed as per its occurrence frequency and that of the outcome of influence of every occurrence. This model of Jacobson had an assumption that suggests that each of the risks has either high or low occurrence frequency (Prado, 2011). Besides, each risk has high or low influence or outcome. It shows that generally two types of classes are responsible to causing such loss of equal magnitude while indicated in terms of annual rate or annualized loss expectancy. I totally agree with the recommendations of this model that reflects high or low risk requires to be addressed by selecting a proper security measure possessing a positive return upon investment based on the link between implementation cost as well as reduction in ALE. The Jacobson’s Window Model suggests that other things remaining constant the security measure must be implemented based on the investment return.

8.

The given table shows the calculation the net present value (NPV). This value refers to an effective mechanism to assess the investment options. It is identified that NPV of this very investment is quite positive. Within this method, all future cash flows are transformed into present value for estimating the potential of investment.

9. The Operating Critical Threat, Asset and Vulnerability Evaluation (OCTAVE) method was normally introduced to assess the risks of bigger organizations with increased number of employees around more than 300. It needs to be noted that size was considered to be the only factor in this regard. It bigger organizations, several layers as hierarchy can be identified. This technique is usually responsible to maintain the computing infrastructure along with the internal capacity to run the assessment of risk measure. Besides, this is beneficial to interpret the outcomes in regard to critical assets (Benaroch, Jeffery, Kauffman & Shah, 2007). This method involves an approach comprising of three phases for scrutinizing the organizational and certain technological aspects by gathering a comprehensive presentation of requirements associated to the organizational information security. This method is comprised of some workshops that may be arranged by the internal analysis team formed by several organizational employees. The approach emphasizes upon the capitalizing information from various organizational levels. Therefore, this focuses on certain critical aspects like identification of key assets, risks, threats, opportunities of the company. Also, this approach focuses on creation of a strategy to provide protection to company. The strategy of protection relies upon the practice, including the plan to mitigate all potential risks for supporting the objectives of the company.

This approach may be applied to assess the potential risks related to the information security. This OCTAVE technique may prove increasingly effective to determine the optimum security in various organizations. This may be backed up by an effective example for explaining the utilization of this approach. In context to health care organizations, these need to maintain large database as well as records of patients (Caron & Salvatori, 2014). It is utterly important to protect the confidentiality of the records or information. Here, application of OCTAVE may be highly beneficial for maintain security of the database within the health care organizations. The approach emphasizes upon the capitalizing information from various organizational levels (Pappas & Panagiotopoulos, 2009). Therefore, this focuses on certain critical aspects like identification of key assets, risks, threats, opportunities of the company. Also, this approach focuses on creation of a strategy to provide protection to company. Enhanced security system refers to the occurring of risk would reduce, which means risk is inversely proportional to the extent of incurred expense. Also, it is important for every organization requires taking up at least some amount of expense to manage risk, and there are some level of risks that may not be reduced(Dey & Kinch, 2008). Thus, if the predefined lowest cost, minimum extent of risk which cannot be reduced and all current practices associated to risk prevention are simultaneously considered, then the space in that dimensional area is called discretionary area.

References

., P., & ., R. (2007). Simulating the Potential Effect of Risk Management on Project Scheduling.Information Technology J., 6(1), 8-13. doi:10.3923/itj.2007.8.13

Adler, T., Leonard, J., & Nordgren, R. (1999). Improving risk management: moving from risk elimination to risk avoidance. Information And Software Technology, 41(1), 29-34. doi:10.1016/s0950-5849(98)00095-0

Alhawari, S., Karadsheh, L., Nehari Talet, A., & Mansour, E. (2012). Knowledge-Based Risk Management framework for Information Technology project. International Journal Of Information Management, 32(1), 50-65. doi:10.1016/j.ijinfomgt.2011.07.002

Benaroch, M., Jeffery, M., Kauffman, R., & Shah, S. (2007). Option-Based Risk Management: A Field Study of Sequential Information Technology Investment Decisions. Journal Of Management Information Systems, 24(2), 103-140. doi:10.2753/mis0742-1222240205

Caron, F., & Salvatori, F. (2014). Managing Information for a Risk Based Approach to Stakeholder Management. International Journal Of Information Technology Project Management, 5(2), 30-43. doi:10.4018/ijitpm.2014040103

Dey, P., & Kinch, J. (2008). Risk management in information technology projects. International Journal Of Risk Assessment And Management, 9(3), 311. doi:10.1504/ijram.2008.019747

Pappas, A., & Panagiotopoulos, P. (2009). Information Technology risk management in e-commerce: classical and catastrophic risk approaches. IJASS, 2(3), 250. doi:10.1504/ijass.2009.027663

Prado, E. (2011). Risk analysis in outsourcing of information technology and communication. JISTEM,8(3), 605-618. doi:10.4301/s1807-17752011000300005

Vinaja, R. (2013). IT Security Risk Management: Perceived IT Security Risks in the Context of Cloud Computing. Journal Of Global Information Technology Management, 16(3), 82-84. doi:10.1080/1097198x.2013.10845644

Yokouchi, A. (2007). Introduction of Weather Risk Management Technology in Farm Management.Agricultural Information Research, 16(4), 226-234. doi:10.3173/air.16.226