CHAPTER 7 Identifying Assets and Activities to Be Protected
by Darril Gibson,
Andy Igonor
Managing Risk in Information Systems, 3rd Edition
- Cover
- Title Page
- Copyright Page
- Brief Contents
- Contents
- Dedication
- Preface
- Acknowledgments
- About the Authors
- CHAPTER 1 Risk Management Fundamentals
- CHAPTER 2 Managing Risk: Threats, Vulnerabilities, and Exploits
- CHAPTER 3 Understanding and Maintaining Compliance
- U.S. Compliance Laws
- Regulations Related to Compliance
- Organizational Policies for Compliance
- Standards and Guidelines for Compliance
- Payment Card Industry Data Security Standard
- National Institute of Standards and Technology
- Generally Accepted Information Security Principles
- Control Objectives for Information and Related Technology
- International Organization for Standardization
- International Electrotechnical Commission
- Information Technology Infrastructure Library
- Capability Maturity Model Integration
- General Data Protection Regulation
- Department of Defense Information Assurance Certification and Accreditation Process
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 3 ASSESSMENT
- CHAPTER 4 Developing a Risk Management Plan
- Objectives of a Risk Management Plan
- Scope of a Risk Management Plan
- Assigning Responsibilities
- Describing Procedures and Schedules for Accomplishment
- Reporting Requirements
- Plan of Action and Milestones
- Charting the Progress of a Risk Management Plan
- Steps of the NIST Risk Management Framework
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 4 ASSESSMENT
- CHAPTER 5 Defining Risk Assessment Approaches
- CHAPTER 6 Performing a Risk Assessment
- Selecting a Risk Assessment Methodology
- Identifying the Management Structure
- Identifying Assets and Activities Within Risk Assessment Boundaries
- Identifying and Evaluating Relevant Threats
- Identifying and Evaluating Relevant Vulnerabilities
- Identifying and Evaluating Controls
- Selecting a Methodology Based on Assessment Needs
- Developing Mitigating Recommendations
- Presenting Risk Assessment Results
- Best Practices for Performing Risk Assessments
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 6 ASSESSMENT
- CHAPTER 7 Identifying Assets and Activities to Be Protected
- System Access and Availability
- System Functions: Manual and Automated
- Hardware Assets
- Software Assets
- Personnel Assets
- Data and Information Assets
- Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure
- Identifying Facilities and Supplies Needed to Maintain Business Operations
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 7 ASSESSMENT
- CHAPTER 8 Identifying and Analyzing Threats, Vulnerabilities, and Exploits
- Threat Assessments
- Vulnerability Assessments
- Review of Documentation
- Review of System Logs, Audit Trails, and Intrusion Detection and Prevention System Outputs
- Vulnerability Scans and Other Assessment Tools
- Audits and Personnel Interviews
- Process Analysis and Output Analysis
- System Testing
- Best Practices for Performing Vulnerability Assessments Within the Seven Domains of a Typical IT Infrastructure
- Exploit Assessments
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 8 ASSESSMENT
- CHAPTER 9 Identifying and Analyzing Risk Mitigation Security Controls
- CHAPTER 10 Planning Risk Mitigation Throughout an Organization
- Where Should an Organization Start with Risk Mitigation?
- What Is the Scope of Risk Management for an Organization?
- Understanding and Assessing the Impact of Legal and Compliance Issues on an Organization
- Translating Legal and Compliance Implications for an Organization
- Assessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT Infrastructure
- Assessing How Security Countermeasures, Controls, and Safeguards Can Assist With Risk Mitigation
- Understanding the Operational Implications of Legal and Compliance Requirements
- Identifying Risk Mitigation and Risk Reduction Elements for the Entire Organization
- Performing a Cost-Benefit Analysis
- Best Practices for Planning Risk Mitigation Throughout an Organization
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 10 ASSESSMENT
- CHAPTER 11 Turning a Risk Assessment into a Risk Mitigation Plan
- Reviewing the Risk Assessment for the IT Infrastructure
- Translating a Risk Assessment into a Risk Mitigation Plan
- Prioritizing Risk Elements That Require Risk Mitigation
- Verifying Risk Elements and How They Can Be Mitigated
- Performing a Cost-Benefit Analysis on the Identified Risk Elements
- Implementing a Risk Mitigation Plan
- Following Up on the Risk Mitigation Plan
- Best Practices for Enabling a Risk Mitigation Plan from the Risk Assessment
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 11 ASSESSMENT
- CHAPTER 12 Mitigating Risk with a Business Impact Analysis
- What Is a Business Impact Analysis?
- Defining the Scope of the Business Impact Analysis
- Objectives of a Business Impact Analysis
- Steps of a Business Impact Analysis Process
- Identifying Mission-Critical Business Functions and Processes
- Mapping Business Functions and Processes to IT Systems
- Best Practices for Performing a BIA for an Organization
- CHAPTER SUMMARY
- KEY CONCEPTS AND TERMS
- CHAPTER 12 ASSESSMENT
- CHAPTER 13 Mitigating Risk with a Business Continuity Plan
- CHAPTER 14 Mitigating Risk with a Disaster Recovery Plan
- CHAPTER 15 Mitigating Risk with a Computer Incident Response Team Plan
- APPENDIX A Answer Key
- APPENDIX B Standard Acronyms
- Glossary of Key Terms
- References
- Index
© Sai Chan/Shutterstock
Identifying Assets and Activities to Be Protected |
CHAPTER |
AN IMPORTANT FIRST STEP IN RISK MANAGEMENT is identifying valuable assets in the organization. Organizations have a wide variety of assets that need to be protected, which include obvious assets, such as hardware and software; data and personnel; and system functions and processes.
After the organization has identified the important assets, it can take steps to protect them. A business impact analysis helps it identify the impact if one of its services fails, and a disaster recovery plan helps it identify the steps needed to restore a failed system. On a larger scale, the organization can use a business continuity plan to help ensure that mission-critical systems continue to operate even after a disaster.
Chapter 7 Topics
This chapter covers the following topics and concepts:
- What system access and availability are
- What manual and automated system functions are
- What hardware, software, and personnel assets are
- What data and information assets are
- How asset and inventory management are related to the seven domains of a typical information technology (IT) infrastructure
- How to identify facilities and supplies needed to maintain business operations
Chapter 7 Goals
When you complete this chapter, you will be able to:
- Identify the importance of system access and availability
- Differentiate between manual and automated system functions
- Identify hardware assets that need to be protected
- Identify software assets that need to be protected
- Identify personnel assets that need to be protected
- Identify organizational data and information assets
- Identify customer data and information assets
- Identify intellectual property data and information assets
- Identify data warehouse and data mining assets
- Identify asset management and inventory management steps that can be taken for each of the seven domains of an IT infrastructure
- Describe the purpose of identifying mission-critical systems and applications
- Describe the purpose of business impact analysis planning
- Describe the purpose of business continuity planning
- Describe the purpose of disaster recovery planning
- Describe the purpose of business liability insurance planning
- Describe the purpose of asset replacement insurance planning
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.