DISC InfoSec blogRisk management Archives

Aug 06 2025

IBM’s Five-Pillar Framework for Securing Generative AI: A Lifecycle-Based Approach to Risk Management

Category: AI — disc7 @ 7:39 am

IBM introduces a structured approach to securing generative AI by focusing on protection at each phase of the AI lifecycle. The framework emphasizes securing three critical elements: the data consumed by AI systems, the model itself (during development/training), and the usage environment (live inference). These are supported by robust infrastructure controls and governance mechanisms to oversee fairness, bias, and drift over time.

In the data collection and handling stage, risks include centralized repositories that grant broad access to intellectual property and personally identifiable information (PII). To mitigate threats like data exfiltration or misuse, IBM recommends rigorous access controls, encryption, and continuous risk assessments tailored to specific data types.

Next, during model development and training, the framework warns about threats such as data poisoning and the insertion of malicious code. It advises implementing secure development practices—scanning for vulnerabilities, enforcing access policies, and treating the model build process with the same rigor as secure software development.

When it comes to model inference and live deployment, organizations face risks like prompt‑injection, adversarial attacks, and unauthorized usage. IBM recommends real-time monitoring, anomaly detection, usage policies, and safeguards to validate inputs and outputs in live AI environments.

Beyond securing each phase of the pipeline, the framework emphasizes the importance of securing the underlying infrastructure—infrastructure-as-a-service, compute nodes, storage systems—so that large language models and associated applications operate in hardened, compliant environments.

Crucially, IBM insists on embedding strong AI governance: policies, oversight structures, and continuous monitoring to detect bias, drift, and compliance issues. Governance should integrate with existing regulatory frameworks like the NIST AI Risk Management Framework and adapt alongside evolving regulations such as the EU AI Act.

Additionally, IBM’s broader work—including partnerships with AWS and internal tools like X‑Force Red—surfaced common gaps in security posture: many organizations prioritize innovation over security. Findings indicate that most active generative AI initiatives lack foundational controls across these five pillars: data, model, usage, infrastructure, and governance.

Opinion

IBM’s framework delivers a well-structured, holistic approach to the complex challenge of securing generative AI. By breaking security into discrete but interlinked phases — data, model, usage, infrastructure, governance — it helps organizations methodically build defenses where vulnerabilities are most likely. It’s also valuable that IBM aligns its framework with broader models such as NIST and incorporates continuous governance, which is essential in fast-moving AI environments.

That said, the real test lies in execution. Many enterprises still grapple with “shadow AI” — unsanctioned AI tools used by employees — and IBM’s own recent breach report suggests that only around 3% of organizations studied have adequate AI access controls in place, despite steep average breach costs ($670K extra from shadow AI alone). This gap between framework and reality underscores the need for cultural buy-in, investment in tooling, and staff training alongside technical controls.

All told, IBM’s Framework for Securing Generative AI is a strong starting point—especially when paired with governance, red teaming, infrastructure hardening, and awareness programs. But its impact will vary widely depending on how well organizations integrate its principles into everyday operations and security culture.

Generative AI, Cybersecurity, and Ethics

ISO 42001 Readiness: A 10-Step Guide to Responsible AI Governance

Aligning with ISO 42001:2023 and/or the EU Artificial Intelligence (AI) Act

The Strategic Synergy: ISO 27001 and ISO 42001 – A New Era in Governance

Clause 4 of ISO 42001: Understanding an Organization and Its Context and Why It Is Crucial to Get It Right.

Think Before You Share: The Hidden Privacy Costs of AI Convenience

The AI Readiness Gap: High Usage, Low Security

Mitigate and adapt with AICM (AI Controls Matrix)

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

Tags: Generative AI Security, IBM's Five-Pillar Framework, Risk management

Comments (0)

Aug 05 2025

EU AI Act concerning Risk Management Systems for High-Risk AI

Category: AI,Risk Assessment — disc7 @ 11:10 am

Lifecycle Risk Management
Under the EU AI Act, providers of high-risk AI systems are obligated to establish a formal risk management system that spans the entire lifecycle of the AI system—from design and development to deployment and ongoing use.
Continuous Implementation
This system must be established, implemented, documented, and maintained over time, ensuring that risks are continuously monitored and managed as the AI system evolves.
Risk Identification
The first core step is to identify and analyze all reasonably foreseeable risks the AI system may pose. This includes threats to health, safety, and fundamental rights when used as intended.
Misuse Considerations
Next, providers must assess the risks associated with misuse of the AI system—those that are not intended but are reasonably predictable in real-world contexts.
Post-Market Data Analysis
The system must include regular evaluation of new risks identified through the post-market monitoring process, ensuring real-time adaptability to emerging concerns.
Targeted Risk Measures
Following risk identification, providers must adopt targeted mitigation measures tailored to reduce or eliminate the risks revealed through prior assessments.
Residual Risk Management
If certain risks cannot be fully eliminated, the system must ensure these residual risks are acceptable, using mitigation strategies that bring them to a tolerable level.
System Testing Requirements
High-risk AI systems must undergo extensive testing to verify that the risk management measures are effective and that the system performs reliably and safely in all foreseeable scenarios.
Special Consideration for Vulnerable Groups
The risk management system must account for potential impacts on vulnerable populations, particularly minors (under 18), ensuring their rights and safety are adequately protected.
Ongoing Review and Adjustment
The entire risk management process should be dynamic, regularly reviewed and updated based on feedback from real-world use, incident reports, and changing societal or regulatory expectations.

🔐 Main Requirement Summary:

Providers of high-risk AI systems must implement a comprehensive, documented, and dynamic risk management system that addresses foreseeable and emerging risks throughout the AI lifecycle—ensuring safety, fundamental rights protection, and consideration for vulnerable groups.

The EU AI Act: Answers to Frequently Asked Questions

EU AI ACT 2024

EU publishes General-Purpose AI Code of Practice: Compliance Obligations Begin August 2025

ISO 42001 Readiness: A 10-Step Guide to Responsible AI Governance

Aligning with ISO 42001:2023 and/or the EU Artificial Intelligence (AI) Act

The Strategic Synergy: ISO 27001 and ISO 42001 – A New Era in Governance

Clause 4 of ISO 42001: Understanding an Organization and Its Context and Why It Is Crucial to Get It Right.

Think Before You Share: The Hidden Privacy Costs of AI Convenience

The AI Readiness Gap: High Usage, Low Security

Mitigate and adapt with AICM (AI Controls Matrix)

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

Tags: EU AI Act, Risk management

Comments (2)

Apr 29 2025

ISO 27001:2022 Risk Management Steps

Category: Information Security,ISO 27k,Risk Assessment,Security Risk Assessment — disc7 @ 11:08 am

The document “Step-by-Step Explanation of ISO 27001/ISO 27005 Risk Management” by Advisera Expert Solutions offers a comprehensive guide to implementing effective information security risk management in alignment with ISO 27001 and ISO 27005 standards. It aims to demystify the process, providing practical steps for organizations to identify, assess, and treat information security risks efficiently. Advisera

1. Introduction to Risk Management

Risk management is essential for organizations to maintain competitiveness and achieve objectives. It involves identifying, evaluating, and treating risks, particularly those related to information security. The document emphasizes that while risk management can be complex, it doesn’t have to be unnecessarily complicated. By adopting structured methodologies, organizations can manage risks effectively without excessive complexity.

2. Six Basic Steps of ISO 27001 Risk Assessment and Treatment

The risk management process is broken down into six fundamental steps:

Risk Assessment Methodology: Establishing consistent rules for conducting risk assessments across the organization.
Risk Assessment Implementation: Identifying potential problems, analyzing, and evaluating risks to determine which need treatment.
Risk Treatment Implementation: Developing cost-effective strategies to mitigate identified risks.
ISMS Risk Assessment Report: Documenting all activities undertaken during the risk assessment process.
Statement of Applicability: Summarizing the results of risk treatment and serving as a key document for auditors.
Risk Treatment Plan: Outlining the implementation of controls, including responsibilities, timelines, and budgets.

Management approval is crucial for the Risk Treatment Plan to ensure the necessary resources and commitment for implementation.

3. Crafting the Risk Assessment Methodology

Developing a clear risk assessment methodology is vital. This involves defining how risks will be identified, analyzed, and evaluated. The methodology should ensure consistency and objectivity, allowing for repeatable and comparable assessments. It should also align with the organization’s context, considering its specific needs and risk appetite.

4. Identifying Risks: Assets, Threats, and Vulnerabilities

Effective risk identification requires understanding the organization’s assets, potential threats, and vulnerabilities. This step involves creating an inventory of information assets and analyzing how they could be compromised. By mapping threats and vulnerabilities to assets, organizations can pinpoint specific risks that need to be addressed.

5. Assessing Consequences and Likelihood

Once risks are identified, assessing their potential impact and the likelihood of occurrence is essential. This evaluation helps prioritize risks based on their severity and probability, guiding the organization in focusing its resources on the most significant threats. Both qualitative and quantitative methods can be employed to assess risks effectively.

6. Implementing Risk Treatment Strategies

After assessing risks, organizations must decide on appropriate treatment strategies. Options include avoiding, transferring, mitigating, or accepting risks. Selecting suitable controls from ISO 27001 Annex A and integrating them into the Risk Treatment Plan ensures that identified risks are managed appropriately. The plan should detail the implementation process, including responsible parties and timelines.

7. Importance of Documentation and Continuous Improvement

Documentation plays a critical role in the risk management process. The ISMS Risk Assessment Report and Statement of Applicability provide evidence of the organization’s risk management activities and decisions. These documents are essential for audits and ongoing monitoring. Furthermore, risk management should be a continuous process, with regular reviews and updates to adapt to changing threats and organizational contexts.

By following these structured steps, organizations can establish a robust risk management framework that aligns with ISO 27001 and ISO 27005 standards, enhancing their information security posture and resilience.

Information Security Risk Management for ISO 27001/ISO 27002

How to Continuously Enhance Your ISO 27001 ISMS (Clause 10 Explained)

Continual improvement doesn’t necessarily entail significant expenses. Many enhancements can be achieved through regular internal audits, management reviews, and staff engagement. By fostering a culture of continuous improvement, organizations can maintain an ISMS that effectively addresses current and emerging information security risks, ensuring resilience and compliance with ISO 27001 standards.

ISO 27001 Compliance and Certification

ISMS and ISO 27k training

Security Risk Assessment and ISO 27001 Gap Assessment

At DISC InfoSec, we streamline the entire process—guiding you confidently through complex frameworks such as ISO 27001, and SOC 2.

Here’s how we help:

Conduct gap assessments to identify compliance challenges and control maturity
Deliver straightforward, practical steps for remediation with assigned responsibility
Ensure ongoing guidance to support continued compliance with standard
Confirm your security posture through risk assessments and penetration testing

Let’s set up a quick call to explore how we can make your cybersecurity compliance process easier.

Feel free to get in touch if you have any questions about the ISO 27001 Internal audit or certification process.

Successfully completing your ISO 27001 audit confirms that your Information Security Management System (ISMS) meets the required standards and assures your customers of your commitment to security.

Get in touch with us to begin your ISO 27001 audit today.

ISO 27001:2022 Annex A Controls Explained

Preparing for an ISO Audit: Essential Tips and Best Practices for a Successful Outcome

Is a Risk Assessment required to justify the inclusion of Annex A controls in the Statement of Applicability?

Many companies perceive ISO 27001 as just another compliance expense?

ISO 27001: Guide & key Ingredients for Certification

DISC InfoSec Previous posts on ISO27k

ISO certification training courses.

ISMS and ISO 27k training

Difference Between Internal and External Audit

Tags: iso 27001, iso 27005, Risk Assessment, Risk management

Comments (6)

Mar 07 2025

Is a Risk Assessment required to justify the inclusion of Annex A controls in the Statement of Applicability?

Category: ISO 27k,Risk Assessment,Security controls,Security Risk Assessment — disc7 @ 6:59 am

“The SOA can easily be produced by examining the risk assessment to identify the necessary controls and risk treatment plan to identify those that are planned to be implemented. Only controls identified in the risk assessment can be included in the SOA. Controls cannot be added to the SOA independent of the risk assessment. There should be consistency between the controls necessary to realize selected risk treatment options and the SOA. The SOA can state that the justification for the inclusion of a control is the same for all controls and that they have been identified in the risk assessment as necessary to treat one or more risks to an acceptable level. No further justification for the inclusion of a control is needed for any of the controls.”

This paragraph from ISO 27005 explains the relationship between the Statement of Applicability (SoA) and the risk assessment process in an ISO 27001-based Information Security Management System (ISMS). Here’s a breakdown of the key points:

SoA Derivation from Risk Assessment
- The SoA must be based on the risk assessment and risk treatment plan.
- It should only include controls that were identified as necessary during the risk assessment.
- Organizations cannot arbitrarily add controls to the SoA without a corresponding risk justification.
Consistency with Risk Treatment Plan
- The SoA must align with the selected risk treatment options.
- This ensures that the controls listed in the SoA effectively address the identified risks.
Justification for Controls
- The SoA can state that all controls were chosen because they are necessary for risk treatment.
- No separate or additional justification is needed for each individual control beyond its necessity in treating risks.

Why This Matters:

Ensures a risk-driven approach to control selection.
Prevents the arbitrary inclusion of unnecessary controls, which could lead to inefficiencies.
Helps in audits and compliance by clearly showing the link between risks, treatments, and controls.

Practical Example of SoA and Risk Assessment Linkage

Scenario:

A company conducts a risk assessment as part of its ISO 27001 implementation and identifies the following risk:

Risk: Unauthorized access to sensitive customer data due to weak authentication mechanisms.
Risk Level: High
Risk Treatment Plan: Implement multi-factor authentication (MFA) to reduce the risk to an acceptable level.

How This Affects the SoA:

Control Selection:
- The company refers to Annex A of ISO 27001 and identifies Control A.9.4.1 (Use of Secure Authentication Mechanisms) as necessary to mitigate the risk.
- This control is added to the SoA because the risk assessment identified it as necessary.
Justification in the SoA:
- The SoA will list A.9.4.1 – Secure Authentication Mechanisms as an included control.
- The justification can be:
  “This control has been identified as necessary in the risk assessment to mitigate the risk of unauthorized access to customer data.”
- No additional justification is needed because the link to the risk assessment is sufficient.
What Cannot Be Done:
- The company cannot arbitrarily add a control, such as A.14.2.9 (Protection of Test Data), unless it was identified as necessary in the risk assessment.
- Adding controls without risk justification would violate ISO 27005’s requirement for consistency.

Key Takeaways:

Every control in the SoA must be traceable to a risk.
The SoA cannot contain controls that were not justified in the risk assessment.
Justification for controls can be standardized, reducing documentation overhead.

This approach ensures that the ISMS remains risk-based, justifiable, and auditable.

DISC InfoSec Previous posts on ISO27k

ISO certification training courses.

ISMS and ISO 27k training

Difference Between Internal and External Audit

Tags: #InfoSec, #RiskAssessment, AnnexA, Information Security Management System, isms, iso 27001, Risk management, security controls, SoA

Comments (13)

Feb 04 2022

What Is Information Risk Management? Definition & Explanation

Category: Information Security,Security Risk Assessment — DISC @ 12:54 am

Information risk management is the process of identifying the ways an organisation can be affected by a disruptive incident and how it can limit the damage.

It encompasses any scenario in which the confidentiality, integrity and availability of data is compromised.

As such, it’s not just cyber attacks that you should be worried about. Information risk management also includes threats within your organisation – such as negligent or malicious employees – as well as residual risks.

For example, the framework can help you address misconfigured databases, software vulnerabilities and poor security practices at third parties.

In this blog, we take a closer look at the way information risk management works and how organisations can use its guidance to bolster their security defences.

Why is information risk management important?

In the face of ever-growing cyber threats, it can be difficult for an organisation to protect its information assets.

Last year, the World Economic Forum listed cyber crime alongside COVID-19, climate change and the debt crisis as the biggest threats facing society in the next decade. It’s clear, then, that organisations need a plan for identifying and addressing security risks.

With an information risk management system, organisations gain a better understanding of where their information assets are, how to protect them and how to respond when a breach occurs.

One way it does this is by forcing organisations to not only identify but also assess their risks. This ensures that organisations prioritise scenarios that are most likely to occur or that will cause the most damage, enabling them to make informed decisions in line with their security budget.

How risk management works

To understand how risk management programmes work, we need to take a closer look at what ‘risk’ actually is.

In an information security context, risk can be defined as the combination of a vulnerability and a threat.

As we’ve previous discussed, a vulnerability is a known flaw that can be exploited to compromise sensitive information.

These are often related to software flaws and the ways that criminal hackers can exploit them to perform tasks that they weren’t intended for.

They can also include physical vulnerabilities, such as inherent human weaknesses, such as our susceptibility to phishing scams or the likelihood that we’ll misplace a sensitive file.

This is different from a threat, which is defined as the actions that result in information being compromised.

So, to use the examples above, threats include a criminal hacker exploiting a software flaw or duping an employee with a bogus email.

When a threat meets a vulnerability, you get a risk. In the case of the criminal hacker phishing an employee, the risk is that the attacker will gain access to the employee’s work account and steal sensitive information. This can result in financial losses, loss of privacy, reputational damage and regulatory action.

A risk management system helps organisations identify the ways in which vulnerabilities, threats and risks intertwine. More importantly, it gives organisations the ability to determine which risks must be prioritised and identify which controls are best equipped to mitigate the risk.

Start protecting your business

At the heart of risk management is the risk assessment. This is the process where threats and vulnerabilities are identified. Organisations can use the result of the assessment to plan their next moves.

This process can be labour-intensive, but you can simplify the task with our risk assessment tool vsRisk.

With vsRisk, you’ll receive simple tools that are specifically designed to tackle each part of the risk assessment.

This software package is:

Easy to use. The process is as simple as selecting some options and clicking a few buttons.
Able to generate audit reports. Documents such as the Statement of Applicability and risk treatment plan can be exported, edited and shared across the business and with auditors.
Geared for repeatability. The assessment process is delivered consistently year after year (or whenever circumstances change).
Streamlined and accurate. Drastically reduces the chance of human error.

Risk Management Training

Tags: information risk management, Risk Assessment, Risk management, risk management training

Comments (0)

Feb 18 2014

Comprehensive Cyber Security Risk Management Toolkit

Category: cyber security,Security Risk Assessment — DISC @ 11:30 am

Govern and manage Cyber Security risk with this unique comprehensive toolkit suite

Comprehensive Cyber Security Risk Management Toolkit Suite – Use the Cyber Security Governance & Risk Management Toolkit for a new, fresh implementation of a comprehensive management system that will also be capable of ISO27001 certification, or take advantage of this toolkit’s modular

There are a number of standalone, best practice approaches to managing cyber risk, none of which is on its own completely satisfactory. This toolkit helps you make an enormous leap forward by consolidating five separate approaches into a single, comprehensive, robust framework.

• PAS 555:2013 is the new standard for cyber security risk governance and management; it was created to work with a range of other standards;
• ISO/IEC 27032 is the international guidance standard for managing cyber security risk;
• The Cloud Controls Matrix was developed by the Cloud Security Alliance for cloud service providers;
• Ten Steps to Cyber Security is the methodology developed by the UK’s Business Department to help organizations of all sizes secure their cyber defenses;
• ISO/IEC 27001: 2013 is the internationally recognized standard against which an information security management system can achieve accredited certification.

Use the Cyber Security Governance & Risk Management Toolkit for a new, fresh implementation of a comprehensive management system that will also be capable of ISO27001 certification, or take advantage of this toolkit’s modular construction and control mapping matrix to add its additional controls to an existing ISO27001 management system.

This Cyber Security Governance & Risk Management Toolkit recognizes that mobile device management is a critical component of effective cyber risk control and therefore includes the ITGP BYOD Policy Toolkit as a value-added extra.

Included in this comprehensive toolkit suite is:

Tags: Cloud Security Alliance, ISO/IEC 27001, National Institute of Standards and Technology, Risk management

Comments (1)

Nov 26 2013

New IT-GRC Glossary designed to simplify industry terms

Category: IT Governance — DISC @ 11:29 am

New IT-GRC Glossary from IT Governance designed to simplify industry terms

IT Governance Ltd, the single source provider of IT governance, risk management and compliance (IT-GRC), has just published a glossary on their website.

The IT-GRC glossary is designed to help IT professionals recognize the wide range of acronyms used within the industry to further their understanding and avoid confusion.

Currently there are 70 terms in the glossary and IT Governance is looking to grow this significantly. IT Governance is encouraging readers to contribute to the glossary with new terms or refined definitions so that the glossary continues to develop and become a resource for IT professionals to use worldwide.

The glossary contains a wide range of IT governance terms, including information security, business continuity, quality management, IT service management and IT governance topics. The glossary is arranged alphabetically and provides easy-to-use definitions that drop down when clicked. The definitions have been written and edited by industry experts and link to information pages for further guidance. View the glossary:

Founder and Executive Chairman of IT Governance Ltd, Alan Calder, explains the reasons behind developing the glossary: “The industry within which we operate in contains a huge number of shortened phrases and acronyms which can be somewhat confusing for those starting out in their career. With different associations, institutions, standards, frameworks and certificates to remember, we decided it was important to start documenting these terms so that beginners would have a useful source to refer to.”

This new resource further strengthens the IT Governance mission statement of “approaching IT from a non-technology background and talking to management in their own language”. The glossary reduces industry jargon and simplifies terms for IT professionals.

The glossary has been added to the growing number of resources offered from IT Governance, which includes a wide number of green papers, product demos and case studies – all which are freely available to download.

Tags: Dictionaries, Governance risk management and compliance, GRC, Risk management

Comments (0)

Aug 07 2013

vsRisk – The Cyber Security Risk Assessment Tool

Category: ISO 27k,Security Risk Assessment — DISC @ 9:09 am

vsRisk – The Cyber Security Risk Assessment Tool

httpv://www.youtube.com/watch?v=M8acvay4FmU

It is extremely difficult to carry out a risk assessment that will meet the requirements of ISO27001 without using a specialist information security risk assessment tool. While there are a wide range of products on the market that claim to meet these requirements, the reality is that there are very few.

There’s just one risk assessment tool that IT Governance recommends; the vsRisk™ v1.7 – the Cybersecurity Risk Assessment Tool.

It’s so straightforward, and so quick to use, it can save you a significant amount of the budget you might otherwise spend on consultancy advice at this stage of the project.

5 reasons why vsRisk is the definitive risk assessment tool:

This tool automates and delivers an ISO/IEC 27001-compliant risk assessment
Can uniquely assess confidentiality, integrity & availability (CIA) for each of business, legal and contractual aspects of information assets – as required by ISO27001
Gives comprehensive best-practice alignment
It’s easy and straight-forward to use
Cost-effective route to assessing risks within your business

Download the definite risk assessment tool >>

Tags: Information Security, Information Security Management System, ISO/IEC 27001, Policy, Risk Assessment, Risk management, Security, Standards

Comments (0)

Apr 23 2013

Cyber Security and Risk Assessment

Category: cyber security,Security Risk Assessment — DISC @ 9:19 am

Cyber security is the protection of systems, networks and data in cyber space.

If your system is connected on the internet, you should know and uderstand the risks of cyber space to take appropriate countermeasures.

To understand the risks of cyber security,The first place is to begin with is a risk assessment. By completing a risk assessment you can understand what the risks, threats and vulnerabilities of your networks, systems and data really are and begin to comprehend how to reduce and handle them. The authors of The Information Security Risk Assessment Toolkit provides handy step-by-step guidance on how to undertake a risk assessment. As we said Security Risk Assessment is an important first to assess risks but the second step of mitigating those risks in timely manner is crucial to protect your information assets.

Once you understand what the risks of your business are, you can then decide on how to mitigate those risks based on your organization risk acceptance.

Tools and techniques which work in mitigating cyber risks

The UK’s Cyber-security Framework for Business (published by the Department for Business, Innovation and Skills) is a 10-step framework to stop around 80% of today’s cyber-attacks
1. Board-led Information Risk Management Regime
2. Secure Home and Mobile Working
3. User Education and Awareness
4. User privilege management
5. Removable media controls
6. Activity monitoring
7. Secure Configurations
8. Malware protection
9. Network security
10. Incident Management

Build the resilience in your information security management system (ISMS) to cope with the other 20% of the risk.

The authors of Hacking 7 Exposed cover the latest methods used by third-parties to (logical/physical) access to information assets. They then detail how you can protect your systems, networks and data from unauthorised access.

Cybersecurity standards are an important element in building a strong, resilient information and communications infrastructure. ISO/IEC 27001 is the most significant international best practice standard available to any organisation that wants an intelligently organised and structured framework for tackling its cyber risks

Tags: Computer security, cyberwarfare, Information Security, Information Security Management System, Risk Assessment, Risk management

Comments (0)

Mar 06 2013

Your Cyber Security Project

Category: cyber security — DISC @ 12:04 pm

by James Warren

Internet technologies have revolutionised the way that business is conducted but these innovations expose your business to various cyber security risks.

Inadequate security can lead to the theft of customer data and, in the event of technological failure or a cyberattack, your business could lose its ability to function altogether. An effective risk management strategy is, therefore, vital to your company’s survival.

Cyber Security Risks for Business Professionals: A Management Guide

Cyber Risks for Business Professionals: A Management Guide

A general guide to the origins of cyber security risks and to developing suitable strategies for their management. It provides a breakdown of the main risks involved and shows you how to manage them.

ITG publish books & documentation toolkits and sell the full range of cyber security standards. Saving you the hassle of shopping around;
ITG is responsible for world’s first certificated programme of ISO27001 education, offering delegates the opportunity to help their organisation achieve compliance and best practice and attain an industry-standard qualification;
ITG have created a comprehensive range of staff awareness solutions, an often overlooked element of a well-implemented IT project;
ITG industry-leading software tools, developed with your needs and requirements in mind, make Information Security Risk Management straightforward and affordable for all;
And ITG team of expert consultants are on tap to help you along the way. From an hour of live-online consultancy or a gap analysis to full certification projects, ITG focus on transferring knowledge and skill to you and your people, so that you can continue meeting compliance targets after the initial implementation period ends.

Cyber Security Risks for Business Professionals: A Management Guide >> ITG | eBay | Amazon

Tags: Computer security, cyber security, Information Security, ISO/IEC 27001, Risk management

Comments (1)

Jan 29 2013

Impact of an Effective Risk Assessment to ISO 27001

Category: Security Risk Assessment — DISC @ 11:08 pm

First to start with a definition of risk – Risk is a function of the probability that an identified threat will occur and then impact the mission or business objectives of an organization.

The kind of risks we deal with information assets are mostly those risks from which only loss can occur, which may be one of the reason why it’s hard for the security professionals to justify ROI for security controls. Comparatively business risks are attributed with either a profit or a loss. As we know, business folks make decision on risks on daily basis; it’s easier to make a decision for profit sake rather than on a loss. So increase risk to information asset will decrease the value of an asset or will harm the organization bottom line in some way.

To minimize the loss to an information asset, organization may decide to treat the higher risk assets which are above accepted risk threshold with following four ways:

1. Eliminate the risks
2. Reduce the risk to acceptable level
3. Accept the risk and live with it
4. Transfer by means of insurance

Risk Assessment Basic Steps for ISO 27001:

o Determine risk methodology and level of acceptable (residual) risk
o Identify assets and who owns them
o Identify the value of each asset
o Identify threats to each assets
o Identify vulnerabilities that each threat may exploit
o Estimate Likelihood of the threat exploiting vulnerability
o Finally determine risk the security of individual assets by combining impacts and likelihoods

Risk Assessment Titles from eBay | Risk Assessment Titles from DISC InfoSec Store

Tags: Corporate governance of information technology, Information Security Management System, ISO/IEC 27001, Risk Assessment, Risk management

Comments (2)

Nov 19 2012

PCI view of Risk Assessment

Category: pci dss,Security Risk Assessment — DISC @ 11:02 pm

Organizations that need to comply with PCI-DSS need to create their own risk assessment methodology that works for their specific business needs, according to a new report by the Payment Card Industry Security Standards Council (PCI SSC).

PCI Risk Assessment Special Interest Group says When developing their own risk assessment methodology, organizations may consider adapting an industry-standard methodology that is most appropriate for their particular culture and business climate.

Key recommendations include:

• A continuous risk assessment process enables ongoing discovery of emerging threats and vulnerabilities, allowing an organization to mitigate such threats and vulnerabilities in a proactive and timely manner

• Risk assessments must not be used as a means of avoiding or bypassing applicable PCI DSS requirements (or related compensating controls)

• Organizations should implement a formalized risk assessment methodology that best suits the culture and requirements of the organization

PCI view of things:

The announcement
https://www.pcisecuritystandards.org/pdfs/pr_121116_risk_sig.pdf

And the V1 document (also attached)
https://www.pcisecuritystandards.org/documents/PCI_DSS_Risk_Assmt_Guidelines_v1.pdf

Below is my post on Risk management from prespective of ISO 27001 which has an Expert guidance on planning and implementing a risk assessment and protecting your business information

Information Security Risk Management for ISO 27001

Tags: International Organization for Standardization, ISO/IEC 27001, Methodology, Payment card industry, Payment Card Industry Data Security Standard, Risk Assessment, Risk management

Comments (0)

Jul 05 2010

Risky business

Category: hipaa — DISC @ 11:02 pm

: Image by purpleslog via Flickr

By Mary Mosquera

Last year’s HITECH Act toughened the rules and enforcement penalties health information handlers must follow to protect patient privacy.

Under the new policy regime, providers will have to pay more attention to the confidentiality and safety of patient information as they move more of their operations toward electronic health record-keeping.

Without sound security policies and practices, privacy “will be just a principle,” said Sue McAndrew, deputy director for privacy in the Office of Civil Rights, the Health and Human Services Department office that was given responsibility for health privacy and security policy under the new law.

OCR-draft-guidelines-for-security-risk-analysis

“We want it to be a reality for consumers,” she said at a recent privacy and security conference sponsored by OCR and the National Institute for Standards and Technology.

One of the most basic requirements is that providers must now perform a security assessment, a first step in understanding systems and electronic data over which they are temporary stewards.

OCR recently drafted guidance to help providers and payers figure out what is expected of them in doing a risk assessment. While it might sound onerous, a risk assessment might not be as difficult or costly as some providers might believe, even for small practices, privacy.

“When you say, ‘do a security risk assessment’, people’s eyes glaze over,” said Lisa Gallagher, security director of privacy and security for the Healthcare Information and Management Systems Society. “But really, it’s asking, ‘what are the risk areas?’, ‘how could someone get to it?’ and ‘what controls can you put in place to protect it.’”

In its guidance, OCR said organizations should identify and categorize their data collections, document threats to information that might lead to a disclosure of protected data and check to see if their current security measures are adequate.

“For a small organization, it sounds overwhelming and time-consuming, but in a lot of ways, it’s things that they already do,” said Pat Toth, a computer scientist in NIST’s computer security division.

“What small providers need to do is get an understanding of the framework and break down each step,” she said. “It is something that’s going to be living in their organization, so if they do their categorization and get that right, it will set the correct tone for the rest of the process.”

NIST has developed a quick-start guide, a “Cliff’s Notes” of its security publications detailing its risk management framework and risk assessment, in addition to frequently asked questions, to help providers, especially small practices.

For large organizations, risk management starts in the planning and architecture of systems across the enterprise and system life cycle, Toth said.

Besides a risk assessment, OCR is planning stricter reporting of disclosures of health information when electronic health records are used, even when the disclosure is for treatment and billing purposes. Providers will also have to give the reason for the disclosure. In May, OCR published a request for comments on its rulemaking.

The most effective method of accounting for disclosures is by using automated logging features in electronic health records and other computer systems, according to Mac McMillan, chief executive officer of Cynergistek Inc., an IT security consulting firm.

System logs are used to document and maintain a permanent record of all authorized and unauthorized access to and disclosure of confidential information so providers can recover evidence of that access.

“A lot of the difficulty to get accounting of disclosures in place is because of a lack of industry auditing capabilities,” he said at the OCR and NIST conference. “Most systems don’t have the functionality.” Moreover, IT security folks he works with have logging activated, “but they are still manually digesting them,” McMillan said, adding that manual audits are a time-consuming and imprecise process.

Even so, such practices must now be the order of the day under the new privacy and security framework. “The security rule says wherever you have electronic health information, you need to protect it,” said HIMSS’s Gallagher. “You may not even apply for meaningful use incentives. But if you’re keeping data in electronic form, you have to comply with the security rule.”

hitech-act-increases-hipaa-security-requirements

healthcare-organizations-may-not-be-prepared-for-hitech-and-other-security-challenges

NIST Releases Revised Assesment Guide Targeting Federal Information Security Controls (infosecurity.us)
OCR draft guidelines for security risk analysis (deurainfosec.com)
Ben Rothke – Effective Data Destruction Practices (slideshare.net)
HHS publishes new guidance on conducting risk analysis (securityarchitecture.com)

Tags: arra and hitech, Civil and political rights, Computer security, Consultants, Electronic health record, General and Freelance, hipaa security, hitech, National Institute of Standards and Technology, Risk management, Security

Comments (0)

Dec 10 2009

What is a risk assessment framework

Category: Information Security,Risk Assessment — DISC @ 5:46 pm

: Image by Adam Melancon via Flickr

The Security Risk Assessment Handbook: A Complete Guide for Performing Security Risk Assessments

Definition – A risk assessment framework (RAF) is a strategy for prioritizing and sharing information about the security risks to an information technology (IT) infrastructure.

A good RAF organizes and presents information in a way that both technical and non-technical personnel can understand. It has three important components: a shared vocabulary, consistent assessment methods and a reporting system.

The common view an RAF provides helps an organization see which of its systems are at low risk for abuse or attack and which are at high risk. The data an RAF provides is useful for addressing potential threats pro-actively, planning budgets and creating a culture in which the value of data is understood and appreciated.

There are several risk assessment frameworks that are accepted as industry standards including:

Risk Management Guide for Information Technology Systems (NIST guide) from the National Institute of Standards.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) from the Computer Emergency Readiness Team.

Control Objectives for Information and related Technology (COBIT) from the Information Systems Audit and Control Association.

To create a risk management framework, an organization can use or modify the NIST guide, OCTAVE or COBIT or create a framework inhouse that fits the organization’s business requirements. However the framework is built, it should:

1. Inventory and categorize all IT assets.
Assets include hardware, software, data, processes and interfaces to external systems.

2. Identify threats.
Natural disasters or power outages should be considered in addition to threats such as malicious access to systems or malware attacks.

3. Identify corresponding vulnerabilities.
Data about vulnerabilities can be obtained from security testing and system scans. Anecdotal information about known software and/or vendor issues should also be considered.

4. Prioritize potential risks.
Prioritization has three sub-phases: evaluating existing security controls, determining the likelihood and impact of a breach based on those controls, and assigning risk levels.

5. Document risks and determine action.
This is an on-going process, with a pre-determined schedule for issuing reports. The report should document the risk level for all IT assests, define what level of risk an organization is willing to tolerate and accept and identify procedures at each risk level for implementing and maintaining security controls.

Audit of security control and scoping (deurainfosec.com)
Control selection and cost savings (deurainfosec.com)

Tags: Business, COBIT, Computer security, Data, Fire and Security, Information Technology, iso 27001, iso 27002, National Institute of Standards and Technology, NIST, OCTAVE, Risk management, Security, security controls, Technology

Comments (0)

Aug 18 2009

Control selection and cost savings

Category: Security Risk Assessment — DISC @ 3:53 pm

Information Security Risk Analysis

In risk management, risk treatment process begins after completion of a comprehensive risk assessment.
Once risks have been assessed, risk manager utilize the following techniques to manage the risks

• Avoidance (eliminate)
• Reduction (mitigate)
• Transfer (outsource or insure)
• Retention (accept and budget)

Now the question is how to select an appropriate control to avoid or reduce risk. While selecting appropriate control to mitigate and avoid risk we need to consider compensating control to cut cost and supplemental control to increase protection for sensitive or classified assets.

Compensating control is a safeguard or countermeasure is employed by an organization in lieu of recommended security control from standards such as ISO 27002 or NIST 800-53. Compensating control provides an equivalent or comparable protection for information system to the original control requirement form standard. For example, even though most standards recommend separation of duties, but for a small operation it might be an unacceptable cost to separate the duties of system administration and system auditing. In that case system owner can utilize compensating control such as strengthening the audit and personnel security.

On the other hand with supplemental control, the system owner may decide to supplement the control to achieve more protection for sensitive and classified assets. If there is high likelihood or magnitude of impact is high should a threat exploit a given vulnerability you might want to consider a supplemental control because overall risk is high. For example you might want to utilize defense in depth method to safeguard your crown jewel.

Implementing and monitoring security control can be expensive, system owner are pressured by management to look for cost savings without any reduction in the security posture of an organization. The system owner can either inherit the common controls or segment the system exposure to reduce cost and risks.
Common controls are the security controls which have been implemented by another information system that your system can utilize. Basically working with another system owner who has utilized some of the security controls need to be implemented in your system. For example utilize the corporate office base line hardening configuration for Windows and Unix system instead of developing your own. This will significantly reduce the cost of developing, testing and maintaining a secure baseline configuration.

Best and cheapest method of cost reduction is to segment the information system into multiple systems which will add different layers and levels of security into each system. Basically you put your crown jewel in multiple layers of security if one control breaks there is another control in place to monitor and protect your assets. This will allow the system owner to focus implementing higher security controls to the segment with most sensitive or classified information instead of entire system

Tags: common control, iso 27002, iso assessment, ISO audit, NIST 800-53, NIST audit, risk analysis, Risk Assessment, Risk management

Comments (2)

Aug 10 2009

Managing Risks and NIST 800-53

Category: Security Risk Assessment — DISC @ 5:48 pm

: Image via Wikipedia

FISMA Certification & Accreditation Handbook

The organizations need to establish security program to manage their day to day risks. Before selecting the controls from standards such as (NIST 800-53 or ISO 27002), organizations need to have complete inventory of the assets involved in the scope. Assets involved in the scope would require a comprehensive risk assessment to determine the sensitivity/criticality of these assets. Depending on the categorization of these assets will determine an appropriate control from standard to mitigate relevant risk. In some cases supplemental controls may be required.

Management of risks involves the risks to the organization with the operation of an information system or information security management system. Risk management is an effective frame work for selecting appropriate security controls for an information system and assist in selecting of appropriate security controls to protect assets.

Both ISO and NIST standards follow the similar path in control selections. NIST 800-53 has 163 high level controls and 154 medium level controls which have around 95% mapping with ISO 27002 which has 133 controls. While NIST SP 800-53 is required for federal (unclassified) information system, NIST encourages its use in commercial space. Commercial organizations can utilize the NIST standard to create their security program, which will provide a road map to their security strategy and assist in making informed decisions for securing their information assets.

The management of day to day risks is a key element in an organization’s information security program and both NIST and ISO provide an effective framework for selecting and managing the appropriate security controls for information system. ISO utilize PDCA (Plan, Do Check, and Act) Deming model for selecting the appropriate security controls and managing its information security management system. NIST on the other hand utilize the similar framework for selecting and managing appropriate controls for information system and is called risk management framework security life cycle. Copy of the NIST risk management framework security life cycle is available to see an eerie resemblance with PDCA model.

nist_rmf1

Around 80% of critical infrastructure resides in private sectors which required to be protected by various regulations. Both NIST and ISO can be utilized to protect assets, however in some cases one standard might fit better in your environment then the other or perhaps you are able to manage one standard better then the other. Both standards required their information system to be audited or reviewed by authorized organizations to achieve apporpriate certifications.

Cloud Security: NIST Releases Guide to Enterprise IT Security (elasticvapor.com)
Rise of cybercrime and management responsibility (deurainfosec.com)
Security controls and ISO 27002 (deurainfosec.com)

Tags: iso 27001, iso 27002, NIST 800-53, PDCA, Risk management

Comments (36)

Mar 17 2009

Congressional data mining and security

Category: Information Security — DISC @ 12:42 am

: Image by moonhouse via Flickr

“By slipping a simple, three-sentence provision into the gargantuan spending bill passed by the House of Representatives last week, a congressman from Silicon Valley is trying to nudge Congress into the 21st Century. Rep. Mike Honda (D-Calif.) placed a measure in the bill directing Congress and its affiliated organs — including the Library of Congress and the Government Printing Office — to make its data available to the public in raw form. This will enable members of the public and watchdog groups to craft websites and databases showcasing government data that are more user-friendly than the government’s own.”

Would be great if this passes BUT, Government would have to have security provisions so hackers could not manipulate databases in this case raw data. Without proper controls, databases can be easily modified and stolen, so before making the raw data available to public, Congress might need a comprehensive legislation to protect the confidentiality, integrity and availability of the data.

Security principles and controls which should be considered in database legislation?
• Principles of least privilege
• Separation of duties
• Defense in depth at every level
• Strong auditing and monitoring controls
• Security risk assessment to assess risks based on ISO 27002 and NIST 800-53
• Comprehensive risk management program to manage risks

Congressional Data Mining: Coming Soon? (Mother Jones)

Bulk Data Downloads: A Breakthrough in Government Transparency (radar.oreilly.com)

httpv://www.youtube.com/watch?v=wqpMyQMi0to

Tags: Business, Data mining, database, defense in depth, iso 27002, Mike Honda, National Institute of Standards and Technology, Risk Assessment, Risk management, Security, separation of duities, Silicon Valley

Comments (2)

Mar 04 2009

HIPAA accountability and security program

Category: hipaa,Security Risk Assessment — DISC @ 7:34 pm

Last year the department of Health and Human Services (HHS) started penalizing healthcare organizations for security breaches and lack of security program. Healthcare stimulus bill says that HHS will post a breach of healthcare organization on their website. In both cases the intent is clear that HHS want to hold healthcare organizations accountable for security lapses.

World Privacy Forum (WPF) states in recent report that medical identity theft is on the rise and it leaves false information in medical records that can torment victims’ medical lives for years. Medical identity theft mostly carried out by insiders with legitimate access to medical and insurance billing. Patient medical files, and addresses can be changed to reflect phony medical care, and insurance payments are forwarded to different address.

HHS has given ample warning and time to healthcare organization to get their house in order. Healthcare stimulus bill which require digitizing healthcare records will demand even more stringent security program from healthcare organizations. Time is of the essence for healthcare organizations to start their security strategy planing now to implement their security program before HHS come knocking at their door.

Risk Management Process:

Like other compliance initiatives, HIPAA also require organizations to build a security risk management program to manage their daily risks. The process of risk management consists of risk assessment (analyzing the risks), design/select control, implement control, test control, maintain/ monitor control. At high level, risk management is accomplished by balancing risk exposure against mitigation costs and implementing appropriate countermeasures and controls.

Risk assessment states the security posture of an organization at a given point in time. Therefore organization should conduct risk assessment of their assets on a regular basis. Risk assessment looks at the impact and likelihood of threat/ vulnerability pair to assess the risk. What is the likelihood of a threat to exploit a given vulnerability and what will be the impact of the threat if the given vulnerability is exploited. If either likelihood/impact is low, the overall risk is low.

Performing vulnerability assessment of critical assets on monthly basis is highly recommend to find out new vulnerabilities and making sure the hardened systems configuration have not changed. Also any changes introduced to a system will require checking the necessary system configurations are intact.

A Five-step Roadmap to HIPAA Security Compliance

Related videos by youtube
httpv://www.youtube.com/watch?v=3Srhrow67f8

Tags: Health care, Health Insurance Portability and Accountability Act, Identity Theft, Risk management, Security, Security Risk Assessment, United States Department of Health and Human Services

Comments (2)

Feb 25 2009

Small business and assessment of IT risks

Category: Security Risk Assessment — DISC @ 5:02 pm

According to a study released by European Union ENISA, Small-to-Medium-Sized (SME) enterprises require extra guidance in assessment of IT security risks of their assets.

Agency also established that in the first implementation it is improbable that SME can utilize a risk assessment & risk management approach without external assistance and simplified information security approach was extremely useful for security awareness on the part of business to improve their information security management approach. One of the main drivers that have pushed ENISA towards a simplified Risk Assessment and Management approach was the idea that SMEs need simple, flexible, efficient and cost-effective security solutions.

Regarding the entire process applied for the life-cycle of the simplified approach, ENISA has applied the Plan-Do-Check-Act model:
o PLAN: creation of a simplified Risk Assessment & Risk Management approach for SMEs
o DO: run pilots in different contexts inside EU
o CHECK: get feedback from pilots and aggregate and analyze it
o ACT: review and improve the simplified approach starting from the feedback
It is expected that through repetitions of the above life-cycle a proper maturity of the simplified ENISA method will be achieved.
ra-process
Diagram: Overview of the phases of the ENISA simplified approach
ENISA simplified and standardized approach for risk assessment for SMEs is designed for untrained users and organization with small IT infrastructure. Security of SMEs is crucial for European economy, since they represent 99% of all enterprises in EU and around 65 million jobs, said ENISA said.

ENISA report and findings

As economic slowdown is looming ahead in US economy, it makes sense to adopt a lifecycle approach which is simplified, standardized in managing and securing the SMEs data. SME is the core engine of US economy as well; taking a standard based approach for data protection will not only serve to increase awareness and secure businesses but will also satisfy various compliance needs. Complexity is an enemy of security and SME most of the time don’t have inside expertise to tackle organizations information security needs. The main idea is to build a simple, flexible and cost efficient risk assessment and risk management program for non-expert users and management with relatively less complex IT infrastructure which fits the needs of all SME. This program will serve as an IT risk assessment tool; fulfill the needs of several regulations and serves as a great security awareness tool as well. As business needs change, risk assessment and risk management process can be improved utilizing Deming PDCA model. Start with a base model program and improve the process to tailor your business needs down the road.

Another methodology which is worth mentioning here for simplified risk assessment approach for SME is Facilitated Risk Analysis and Assessment Process (FRAAP) created by Tom Peltier which can be utilized to identify and quantify threats to IT infrastructure. Tom also teaches a class how to complete a risk assessment in 5 days or less utilizing FRAAP and his book on “Information security risk analysis” where he explains his FRAAP methodology.

Survey reveals SME security priorities (strivepr.com)

Computer Security
httpv://www.youtube.com/watch?v=MUQzEJ82TrQ

Tags: Business, Computer security, Consultants, European Network and Information Security Agency, European Union, information security risk analysis, Risk management, Security, Security Risk Assessment, Small and medium enterprises, SME

Comments (0)

Feb 18 2009

Economic turmoil and BCP

Category: BCP,Information Security — DISC @ 6:42 pm

Due to economic insecurity all the warning signs are pointing that this year is going to top the record for information security and privacy incidents. Organizations may not be in a position to take business limiting risk and bypass security fundamental like Business Continuity Planning (BCP). During this economic uncertainty organizations have to pay more attention to liability, regulatory penalties and negative PR which might cause an irrecoverable damage to business in today’s market.

“BCP is the creation and validation of a practiced logistical plan for how organization will recover and restore partially or completely interrupted critical functions within a predetermine time after a disaster or extended disruption”

The first step in business continuity process is to consider the potential impact of each disaster or disruption. Next step is to determine the likelihood of the disruption or how likely this disruption will occur within a year and how many times. Both impact and likelihood will determine the risk to the organization critical asset in a sense if impact of the disruption is high the risk is high or if likelihood of the incident is high the risk is high. High risk disruption will attract more attention during planning process.

Risk Analysis:
• Understand the function of probabilities and risk reduction
• Identify potential risks to the organization
• Identify outside expertise required
• Identify vulnerabilities / threats / exposures
• Identify risk reduction / mitigation alternatives
• Identify credible information sources
• Interface with management to determine acceptable risk levels
• Document and present findings

BCP Plan:
• Understand clear objectives, available alternatives, their advantages, disadvantages, and cost ranges, including mitigation as a recovery strategy
• Identify viable recovery strategies with business functional areas
• Consolidate strategies
• Identify off-site storage requirements and alternative facilities
• Develop business unit consensus
• Present strategies to management to obtain commitment

Assessing the Effectiveness of a BCP Plan for an Individual Business Unit:
Business unit contingency planning was never more important than now. The success of BCP planning depends upon the feasibility and appropriateness of the plan. However, only comprehensive TESTING of the contingency plans could validate that and everyone hates testing. It is important that the Contingency Plan clearly identify those responsible for declaring a disaster and executing the plan. BS 25999-2:2007 is the specification for implementing, establishing, and improving a business continuity management system (BCMS) within an organization.

The requirements in the standard are generic and are intended to be applicable to all organizations, regardless of type, size and nature of business. The extent of application of these requirements depends on the organization’s operating environment and complexity. BS 25999-2 can be used by internal and external parties, including certification bodies, to assess an organization’s ability to meet its own business continuity needs, as well as any customer, legal or regulatory needs.

Purchase BS25999-2:2007 online today and prove business resilience to customers and partners.

[TABLE=16]

BSI – What is Business Continuity Management?
httpv://www.youtube.com/watch?v=DkQsmSg1PFU&NR=1

Tags: Business, Business continuity planning, Business Services, Contingency plan, Emergency Management, Fire and Security, Information Security, Risk management

Comments (2)

Opinion

🔐 Main Requirement Summary:

ISO certification training courses.

Why This Matters:

Practical Example of SoA and Risk Assessment Linkage

Scenario:

How This Affects the SoA:

Key Takeaways:

ISO certification training courses.

Why is information risk management important?

How risk management works

Start protecting your business

Risk Management Training

Govern and manage Cyber Security risk with this unique comprehensive toolkit suite

Comprehensive Cyber Security Risk Management Toolkit Suite – Use the Cyber Security Governance & Risk Management Toolkit for a new, fresh implementation of a comprehensive management system that will also be capable of ISO27001 certification, or take advantage of this toolkit’s modular

Related articles

New IT-GRC Glossary from IT Governance designed to simplify industry terms

Related articles

Related articles

Cyber security is the protection of systems, networks and data in cyber space.

Tools and techniques which work in mitigating cyber risks

Build the resilience in your information security management system (ISMS) to cope with the other 20% of the risk.

Related articles

Internet technologies have revolutionised the way that business is conducted but these innovations expose your business to various cyber security risks.

A general guide to the origins of cyber security risks and to developing suitable strategies for their management. It provides a breakdown of the main risks involved and shows you how to manage them.

Related articles

Related articles

Related articles

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

What is Data Mining?

Related articles by Zemanta

Get new posts by email:

vCISO as a service