Newsletters Welcome, Guest Log In | Register

Join the Community

Exchange

Get full access to our community's expertise and resources.

Register Now >

Re: Identifying Security Threats

19 Replies Last post: Nov 14, 2009 10:27 AM by MikeBailey Go to original post 1 2 Previous Next
John.Kimmel   8 posts since
Nov 5, 2009
15. Nov 12, 2009 10:27 PM in response to: Millie
Re: Identifying Security Threats

Millie: I do believe that everyone plays a vital role in risk analysis. Any breakdown in the process can produce inconsistent results. I agree that the process does let everyone express their point of view, however the final Risk Analysis may not reflect their opinions. The process may lead to a sense of team, but the results may have negative consequences on the team. This could occur if their opinions are not deemed valid, or if their department is deemed high risk due to negligence or other factors.



joejuliano   6 posts since
Nov 5, 2009
16. Nov 13, 2009 1:38 PM in response to: Ralph DeFrangesco
Re: Identifying Security Threats

When performing a risk assessment, identifying all reasonable risks should be the goal. An infinite amount of time could be spent documenting every threat or risk. It would be better to establish some boundaries and address those, while trying to avoid spending too much time and money on matters that aren't very probable and of little impact. They can be documented to show that diligence was taken, but that further action was unneccessary. Performing a thorough assessment is worth it in the end, and going a little deeper than the obvious should prove to be beneficial to the business.

joejuliano   6 posts since
Nov 5, 2009
17. Nov 13, 2009 6:34 PM in response to: Dawit
Re: Identifying Security Threats

Identifying the risks early on is definitely beneficial and critical to the success of the risk assessment and management. Moving on too fast to mitigation and possibly passing over or missing threats can hinder progress, possibly resulting in backtracking. Like you said Dawit, some of the risks that you have identified might not be that important in the end and have little value, but those that were left out unintentionally and in error can place the business in jeopardy with impacts to property and business.

MikeBailey   6 posts since
Nov 6, 2009
18. Nov 13, 2009 9:00 PM in response to: Ralph DeFrangesco
Re: Identifying Security Threats

Yes it is worth going through the exercise to identify every threat in an organization.  There are 6 steps to follow when creating a risk assessment with step 2 being to identify threats.  The key is to compose a sensible list of threats that is thorough enough to show that due diligence was performed.  Also the step of identifying threats is should be to simply list them.  The likelihood of these threats occurring should not come into play here and should be saved for step 3 of the Risk assessment process when determining the probability of occurrence of the threats listed.  When creating a list of possible threats a company can use checklists and split threats into categories such as natural, human, and environmental.  They can also take a look back in history at what type of incidents have occurred in the past to help complete their list. 

It’s important to have the team that is responsible of identifying threats to list everything they think of and save the discussion for the probability of occurrence for a later time. 



MikeBailey   6 posts since
Nov 6, 2009
19. Nov 14, 2009 10:27 AM in response to: joejuliano
Re: Identifying Security Threats

I agree that an infinite amount of time can be spent identifying every possible threat and creating boundaries is a nice way to manage time when brainstorming these threats.  I understand that some threats that people may think of have a very unlikely possibiillty of occurring but they can be listed anyway.  This is where risk assumption would come into play when mitigating risk.  The company knows that the particular threat has a very small likelihood of happening and is willing to take the chance of not implementing any controls.

Re: Identifying Security Threats

Go to original post 1 2 Previous Next

Windows 7 Upgrade Project Kit

Moving to Windows 7? The Windows 7 Upgrade Project Kit is the ideal support tool for managing all phases of an organizational upgrade to Windows 7. The tools and templates in this kit will help you develop a strategy and map out the implementation tactics which link your Windows 7 deployment to your company's bottom line.

Learn more >

Janco's 2010 IT Salary Survey

This survey from Janco Associates, Inc., draws on data collected by extensive surveys of businesses throughout the United States and Canada.

Learn more >

Examining Business Resiliency Management Best Practices

Read this white paper and learn to effectively manage people, process, and technology within a business resilience strategy.

2009 Gartner Magic Quadrant Report

In this report, Gartner helps organizations interested in WAN Optimization Controller capabilities truly understand their options.