BISM3205: Business Information Security

Week 04 & 05: Risk Management (Ch. 5)

Semester 2, 2023
Our learning objectives
Upon completion of this material, you should be able to:
• Define risk management, risk identification, and risk control
- Imagine your next professional interview – you have a business degree – the committee asks you: “How would
you approach risk management?”

• Describe how risk is identified and assessed

• Assess risk based on probability of occurrence and likely impact
• Explain the fundamental aspects of documenting risk via the process of risk assessment
• Describe the various risk mitigation strategy options
• Identify the categories that can be used to classify controls
• Discuss ‘quantitative’ AND ‘qualitative’ risk approaches

2
Introduction – overview (1)
• Organizations must design and create safe environments in which business processes and
procedures can function
• Risk management: process of identifying and controlling risks facing an organization – comprises
three major undertakings:

1. Risk identification: process of examining an organization’s current information technology

security situation
2. Risk assessment: determining the extent to which the assets are exposed or at risk
3. Risk control: applying controls to reduce risks to an organization’s data and information systems

3
Introduction – overview (2)
• Know yourself: identify, examine, and understand the information and systems currently in place
• Know the ‘threats’: identify, examine, and understand the threats facing the organization
• Responsibility of each community of interest within an organization to manage the risks that are
encountered

4
Risk management discussion point!
• Organization must define level of risk it can live with (most probably it will never be zero) – Why?
• Risk appetite (aka risk tolerance) : defines quantity and nature of risk that organizations are willing to
accept as trade-offs between perfect security and unlimited accessibility
• Residual risk: risk that has not been completely removed, shifted, or planned for

Can be a vulnerability reducing

control of a threat reducing
control – or both

5
Risk identification (we now discuss the overall process)
• Risk management involves identifying, classifying, and prioritizing an organization’s
assets
• Comprehensive and mutually exclusive
• A threat assessment process identifies and quantifies the risks facing each asset
• Components of risk identification
- People
- Procedures
- Data
- Software
- Hardware

6
Risk identification – a ‘project management’ approach

• First step in the Risk Identification process is to follow your project management principles
• Begin by organizing a team with representation across all affected groups
• The process must then be planned out
– Periodic deliverables
– Reviews Project controls
– Presentations to management
• Tasks laid out, assignments made and timetables discussed
• Iterative process!
7
Asset identification and inventory
• Iterative process; begins with identification of assets, including all elements of an organization’s system
• Assets are then classified and categorized
Traditional system components Information asset components Risk management system components

People Internal personal Trusted employees and other staff

External personnel People at trusted organizations
strangers and visitors
Procedures Procedures IT and business standard
IT and business-sensitive procedures
Data Data/information Transmission
Processing
Storage
Software Software Applications
Operating system
Security components
Hardware Hardware Systems and peripherals
Security devices
Networking Networking components Intranet components
Internet or DMZ components
8
People, procedures, and data asset identification
• Human resources, documentation, and data information assets are more difficult to
identify
• Important asset attributes:
– People: position name/number/ID; supervisor; security clearance level; special skills
– Procedures: description; intended purpose; what elements it is tied to; storage location for
reference; storage location for update
– Data: classification; owner/creator/ manager; data structure size; data structure used;
online/offline; location; backup procedures employed

9
Hardware, software, and network asset identification
• What information attributes to track depends on:
– Needs of organization/risk management efforts
– Preferences/needs of the security and information technology communities
• Asset attributes to be considered are: name; IP address; element type; serial number;
manufacturer name; model/part number; software version; physical or logical location;
controlling entity
• Automated tools can identify system elements for hardware, software, and network
components

10
Information asset valuation
• Questions below (and others) help develop
criteria for asset valuation
Which information asset:
– Is most critical to organization’s success?
– Generates the most revenue/profitability?
– Would be most expensive to replace or
protect?
– Would be the most embarrassing or
cause greatest liability if revealed?

11
Information asset valuation (cont’d)
• Information asset prioritization (most likely to have multiple valuation criteria – why? Who makes these
criteria?)
– Create weighting for each category based on the answers to questions
– Calculate relative importance of each asset using weighted factor analysis
– List the assets in order of importance using a weighted factor analysis worksheet
Criterion 1: Criterion 2: Criterion 3:
Weighted
Information Asset Impact to Impact to Impact to public
score
Revenue Profitability image

Criteria weights must total 100 30 40 30 100

EDI document set 1-logistics BOL to

0.8 0.9 0.5 75
outsourcer (outbound)
EDI document set 2-Supplier orders
0.8 0.9 0.6 78
(outbound)
EDI document set 2-Supplier
0.4 0.5 0.3 41
Fulfillment advice (inbound)
Customer order via SSL (inbound) 1.0 1.0 1.0 100
Customer service request via e- mail
0.4 0.4 0.9 55
(inbound) 12
Identifying and prioritising threats
• Realistic threats need investigation; unimportant threats are set aside

• Threat assessment:
– Which threats present danger to assets?
– Which threats represent the most danger to information?
– How much would it cost to recover from attack?
– Which threat requires greatest expenditure to prevent?

Threat Examples
Compromises to intellectual property Software piracy or other copyright infringement
Deviation in quality of service from service provides Fluctuations in power, data, and other services
Espionage or trespass Unauthorized access and/or data collection
Forces of nature Fire, food, earthquake, lightning, etc.
Human error of failure Accidents, employee mistakes, failure to follow policy
Information extortion Blackmail threat of information disclosure
Sabotage or vandalism Damage to or destruction of system or information

Software attacks Malware: viruses, worms, macros, denial of services, or script injections
13
Vulnerability analysis
• Vulnerabilities: specific avenues threat agents can exploit to attack an information asset.
• Examine how each threat could be perpetrated and list organization’s assets and
vulnerabilities.
• Process works best when people with diverse backgrounds within organization work
iteratively in a series of brainstorming sessions.
• How can we prioritise vulnerabilites?

14
Prioritising vulnerabilities (#1)
• The Common Vulnerability Scoring System (CVSS) is a free, open industry standard for assessing
the severity of computer system security vulnerabilities.
• CVSS aims to assign severity scores to vulnerabilities, allowing flexibility for responders to prioritize
responses and resources according to threat.
• Scores are calculated based on a formula that depends on several metrics that approximate ease of
exploit and the impact of exploit.
• Scores range from 0 to 10, with 10 being the most severe.
• Some of the metrics are described in overview below:

• The CVSS describes 6 base metrics: attack vector (how exploited), attack complexity (easy or difficult),
authentication (the levels of authentication for the exploit), confidentiality (impact on confidentiality of
data), integrity (of system), availability (of system).

• These six metrics are then used to produce a CVSS vector for the vulnerability.

15
Identifying and prioritising threats (#2)

16
CVSS Website

Common Vulnerability Scoring System (CVSS)

17
TVA worksheet (a simple summary)
• At end of risk identification process, Most important assets towards the left
there should be two lists:

Most important threats towards the top

• list of assets and their
vulnerabilities.
• List of threats facing the
organization

• Combination of these two lists into a

‘threats‐vulnerabilities‐assets (TVA)
worksheet’

18
Risk assessment
• Risk assessment evaluates the relative risk for
each vulnerability
• Assigns a risk rating or score to each information asset
(a ‘relative’ meaning – not absolute)
• We must be CONSISTENT whichever approach we
use!
• The goal at this point: create a method for evaluating
the relative risk of each listed vulnerability
• We shall consider several approaches: (text book,
NIST, one selected from industry)

19
Risk calculation – a ‘project’ approach (flow, feedback, control)
For the purpose of a simplistic relative risk assessment, risk equals:
• Loss frequency TIMES loss magnitude
• PLUS an element of uncertainty

20
Calculating risk (text book approach – page 283)
For the purpose of relative risk assessment: Risk is calculated as follows:

The Probability of a Successful Attack on the Organization

Step 1
(Loss Frequency = Likelihood * Attack Success Probability)

MULTIPLIED BY
Step 2 The Expected Loss from a Successful Attack
(Loss Magnitude = Asset Value * Probable Loss)

PLUS
Step 3 The Uncertainty of estimates of all stated values

21
Step 1: Loss frequency
First, we need to determine how probable it is that an attack is successful.

Loss frequency describes an assessment of the likelihood of an attack combined with expected
probability of success given the current level of controls in place
• Likelihood: Use external references for values that have been reviewed/adjusted for your circumstances AND ‘risk
actuals’ of your organization; value subject to uncertainty
- Assign numeric value to likelihood, typically annual value
- Targeted by hackers once every five years – annualized likelihood of attack: 1/5, 20 percent
- Web defacement two times each year – annualized likelihood of attack 200 percent

- See next slide also

• Success probability: Estimate a quantitative value (e.g., 10 percent) for the likelihood of a successful attack; value
subject to uncertainty. This also involves consideration of the current level of protection – this further complicates the
calculation.

22
Likelihood (part of step 1)
• The probability that a specific vulnerability will be the object of a successful attack

• NIST SP 800‐30: Assign numeric value: number between 0.1 (low) and 1.0 (high), or a number
between 1 and 100
• Zero not used since vulnerabilities with zero likelihood are removed from asset/vulnerability list

• Use selected rating model (whichever is selected) consistently

• Use external references for values that have been reviewed/adjusted for your circumstances –
remember our reference to ‘risk actuals’

23
Step 2: Loss magnitude
We need to determine how much of an information asset could be lost in a successful attack

Loss magnitude (sometimes asset exposure)

Combines two components: (1) the value of information asset with (2) the percentage of asset lost in the
event of a successful attack

Difficulties involve:
• Valuing an information asset
• Estimating the percentage of information asset lost during best‐case, worst‐case, and most likely scenarios

Clearly this step is also subject to possible error/uncertainty

Set text: page 286 24

Example (1) – text book (page 287)

Information asset A is on online e‐commerce database. 10% chance of attack this year (1 attack every 10
years). 50% chance of success based on current asset vulnerabilities and protection mechanisms. Asset
value is 50 (how is this derived) and 100% of the asset would be compromised by a successful attack.
Assumption: data 90% accurate.
Risk is: (10% * 50%) * ( 50 * 100%) + 10% of risk calculation

Asset A risk is: 2.75

RISK is
The Probability of a Successful Attack on the Organization
(Loss [event] Frequency = Likelihood * Attack Success Probability)
Multiplied by
The Expected Loss from a Successful Attack
([Event] Loss Magnitude = Asset Value * Probable Loss)
Plus
The Uncertainty of estimates of all stated values
25
Example (2) – text book (page 287)

Information asset B is an internal personnel database behind a firewall. 1% chance of attack this year. 10%
chance of success based on current asset vulnerabilities and protection mechanisms. Asset value is 25 on a
scale of 1 to 100 and 50% of the asset would be compromised by a successful attack. Assumption: data 90%
accurate.

Risk is: (1% * 10%) * ( 25 * 50%) + 10% of risk calculation

Asset B risk is: 0.01375
Which has the higher level of risk – what would you do?

RISK is
The Probability of a Successful Attack on the Organization
(Loss [event] Frequency = Likelihood * Attack Success Probability)
Multiplied by
The Expected Loss from a Successful Attack
([Event] Loss Magnitude = Asset Value * Probable Loss=
Plus
The Uncertainty of estimates of all stated values
26
Risk assessment (2) - NIST
– NIST SP (Special Publication) 800‐30 r1 (on Blackboard)
– Definitive document for RISK ASSESSMENT
– RISK = LIKELIHOOD * LEVEL OF IMPACT (appendix I)

– SP800‐30 contains qualitative and quantitative strategies

– SP800‐30 is on Blackboard (week 4 material)

– How can risk be ‘so simply’ described (in contrast with the text book)?

27
 Formula for
Risk assessment (3) – another approach Question 4 of

• For the purpose of relative risk assessment: Assignment 1

Risk = Asset Value * Likelihod of vulnerability occurence %

Risk Controlled = Risk * Current Control Effectiveness %
Risk Uncertain = Risk * (1 - Certain of Risk Assumptions %)

Relative Risk = Risk – Risk Controlled + Risk Uncertain

As an example of applying the above formula, consider the following: An information asset has a value of 50.
The asset has a single vulnerability with a likelihood of occurring of 0.5. The asset has no current controls.
Your risk assumptions areestimated to be 90% accurate. Consequently the relative risk for the asset is:

28
Identify possible controls
• For each threat and associated vulnerabilities that have residual risk, create preliminary list of
control ideas
• Residual risk is risk that remains to information asset even after existing control has been
applied
• There are three general categories of controls:
– Policies
– Programs
– Technologies

29
Documenting the results of the risk assessment
• Final summary comprised in ranked vulnerability risk worksheet
• Worksheet details asset, asset impact, vulnerability, vulnerability likelihood, and risk‐rating factor.
Loss
Asset relative Loss
Asset Vulnerability frequency
value magnitude
Customer service request via email
(inbound) 55 E-mail disruption due to hardware failure 0.2 11
Customer order secured (inbound)
100 Lost orders due to web server hardware failure 0.1 10
Customer order via secured (inbound)
100 Lost orders due to web server or ISP service failure 0.1 10
Customer service request via e-mail
(inbound) 55 E-mail disruption due to SMTP mail relay attack 0.1 5.5
Customer service request via e-mail
(inbound) 55 E-mail disruption due to ISP service failure 0.1 5.5
Customer order via secured (inbound) Lost orders due to web server denial-of-service attack
100 0.025 2.5
Customer order via secured (inbound)
100 Lost orders due to web server software failure 0.01 1

• What is the relative risk of an E-Mail disruption due to hardware failure of a ‘Customer service request (email)’?
• Explain the asset values.
30
Risk control strategies (5 of these)
Once ranked vulnerability risk worksheet complete, must choose one of five strategies to control each
risk:

1. Defend

• Attempts to prevent exploitation of the vulnerability

• Preferred approach
• Accomplished through countering threats, removing asset vulnerabilities, limiting asset access, and
adding protective safeguards
• Three common methods:
– Application of policy
– Training and education
– Applying technology

31
Risk control strategies (cont’d)
2. Transfer
• Control approach that attempts to shift risk to other assets, processes, or organizations
• If lacking, organization should hire individuals/firms that provide security management and administration
expertise
• Organization may then transfer risk associated with management of complex systems to another organization
experienced in dealing with those risks

3. Mitigate

• Attempts to reduce impact of vulnerability exploitation through planning and preparation

• Approach includes three types of plans
– Incident response plan (IRP): define the actions to take while incident is in progress
– Disaster recovery plan (DRP): most common mitigation procedure
– Business continuity plan (BCP): encompasses continuation of business activities if catastrophic
event occurs

32
Risk control strategies (cont’d)
4. Accept
• Doing nothing to protect a vulnerability and accepting the outcome of its exploitation
• Valid only when the particular function, service, information, or asset does not justify cost of
protection

5. Terminate

• Directs the organization to avoid those business activities that introduce uncontrollable risks
• May seek an alternate mechanism to meet customer needs

33
Summary of risk control strategies (cont’d)

Risk control Categories used Categories used by Others

strategy by NIST SP 800-30, ISACA and ISO/IEC
Rev. 1 27001
Defense Research and Treat Self-protection
acknowledgement
Transference Risk transference Transfer Risk transfer
Mitigation Risk limitation and Tolerate (partial) Self-insurance
risk planning (partial)
Acceptance Risk assumption Tolerate (partial) Self-insurance
(partial)
Termination Risk avoidance Terminate Avoidance

34
Selecting a risk control strategy
• Level of threat and value of asset play major role in selection of strategy
• Rules of thumb on strategy selection can be applied:
– When a vulnerability exists
– When a vulnerability can be exploited
– When attacker’s cost is less than potential gain
– When potential loss is substantial

35
Justifying controls
• Before implementing one of the control strategies for a specific vulnerability,
the organization must explore all consequences of vulnerability to information
asset.
• There are several ways to determine the advantages/disadvantages of a
specific control:

36
Cost Benefit Analysis (1 of 3)
• Sums the benefits of an action THEN subtracts the costs of that action
• Formal process to document this is called cost benefit analysis or economic feasibility study
• Items that affect cost of a control or safeguard include: cost of development or acquisition;
training fees; implementation cost; service costs; cost of maintenance
• Benefit: value an organization realizes using controls to prevent losses from a vulnerability
• Asset valuation: process of assigning financial value or worth to each information asset

• Once asset valuation is performed, an organization can begin to estimate the potential loss that could
occur from an exploited vulnerability or threat occurrence.

37
Cost Benefit Analysis (2 of 3)
Several questions must be asked:
• What damage would occur from an exploited vulnerability or threat occurrence
• What would it cost to recover from the attack – as well as the financial damage
• What is the single loss expectancy (SLE) for each risk?
- SLE = asset value × exposure factor (EF)
- Example: if a Web site has an estimated value of $1 million, and a hacker defacement could damage 10%
of the Web site, the SLE is $1 million * 0.10.

Once asset valuation is completed, we can calculate how much loss is expected from a single attack and how
often these attacks occur. We can use the annualized loss expectancy (ALE) for this:

ALE = single loss expectancy (SLE) × annualized rate of occurrence (ARO)

In our previous Web site example, the ARO could be 0.50 ( how often is this?). This gives us ALE = $100000 *
0.50 = $50000

Consequently, this business can expect to lose $50000 every year – this gives us a basis for expenditure
38
Cost Benefit Analysis (3 of 3)
• CBA determines if alternative being evaluated is worth cost incurred to control vulnerability
– CBA most easily calculated using ALE from earlier assessments, before implementation of
proposed control:

CBA = ALE(prior) – ALE(post) – ACS

– ALE(prior) is annualized loss expectancy of

risk before implementation of control
– ALE(post) is estimated ALE based on control
being in place for a period of time
– ACS is the annualized cost of the safeguard

39
Evaluation, assessment, and maintenance of risk controls
• Selection and implementation of control strategy is not end of process
• Strategy and accompanying controls must be monitored/reevaluated on ongoing basis to determine
effectiveness and to calculate more accurately the estimated residual risk
• Process continues as long as organization continues to function

40
Qualitative versus quantitative risk control practices
• Performing the previous steps using actual values or estimates is known as
quantitative assessment

• Possible to complete steps using evaluation process based on characteristics using

non‐numerical measures; called qualitative assessment (low, medium, high, very high)

• Utilizing scales rather than specific estimates relieves organization from difficulty of
determining exact values

41
Qualitative versus quantitative: NIST SP 800-30

42
Quantitative methods: Example
FAIR (Factor Analysis of Information Risks) (www.fairinstitute.org)

43
[Entity Name]

[Presentation Title] | [Date] https://risklens.wistia.com/medias/ic0ph1zqdw 44

Summary (1)
• Risk identification: formal process of examining/documenting risk in information systems
• Risk control: process of taking carefully reasoned steps to ensure the confidentiality, integrity,
and availability of components of an information system
• Risk identification
– A risk management strategy enables identification, classification, and prioritization of
organization’s information assets
– Residual risk: risk remaining to the information asset even after the existing control is applied
• Risk control: five strategies are used to control risks that result from vulnerabilities:
– Defend
– Transfer
– Mitigate
– Accept
– Terminate

45
Summary (2)
• Selecting a risk control strategy
– Cost Benefit Analysis
– Feasibility Study
• Qualitative versus Quantitative Risk Control
– Best Practices and Benchmarks
• Risk Appetite: organizational risk tolerance
• Residual risk: risk remaining after application of risk controls
• Risk actuals: we can consider this the business memory of security process
• Convince budget authorities to spend up to value of asset to protect from identified threat
• Final control choice may be balance of controls providing greatest value to as many
asset‐threat pairs as possible

46
Supplemental Material
An overview of threat and risk assessment – As per SANS Institute (www.sans.org)
An overview of threat and risk assessment (1) – As per SANS Institute (www.sans.org)
• Many different methodologies – all try to answer:
a) What needs to be protected?
b) Who/what are the threats and vulnerabilities?
c) What are the implications if they were damaged or lost?
d) What is the value to the organization?
e) What can be done to minimize exposure to the loss or damage

• Outcome: to provide recommendations that maximize the protection of (fundamentally)

confidentiality, integrity and availability whilst still providing functionality and usability.

• By whom: internal or external resources (not having a vested interest in the organisation
and be free from personal and external constraints which may impair independence.

48
An overview of threat and risk assessment (2) – As per SANS Institute (www.sans.org)

• Core areas:
a) Scope
b) Data collection
c) Analysis of policies and procedures
d) Threat analysis
e) Vulnerability analysis
f) Correlation and assessment of risk acceptability

49
An overview of threat and risk assessment (3) – As per SANS Institute (www.sans.org)
Scope
• Identifying the scope is one of the most important step in the process. The scope provides the analyst
with what is covered and what is not covered in the assessment.

• Scope identifies what needs to be protected, the sensitivity of what is being protected and to what level
and detail.

• The scope will also identify what systems and applications are included in the assessment.

• The analyst must keep in mind the intended audience of the final recommendations (i.e. senior
management, IT department or certifying authority).

• Finally, the scope should indicate the perspective from which the analysis will take place, whether it is
from an internal or external perspective or both. The level of detail is directly related to the intended
recipient of the final analysis.

50
An overview of threat and risk assessment (4) – As per SANS Institute (www.sans.org)
Collecting data
• We must collect all policies and procedures currently in place and identifying those that are missing or
undocumented.
• Interviews with key personnel can be conducted using questionnaires or surveys to assist in identifying
assets and missing or out‐of‐date documentation.
• The systems or applications identified in the scope are enumerated and all relevant information
gathered on the current state of those systems.

Service pack levels Port scanning

Services running Wireless leakage
Operating system type Intrusion detection testing
Network applications running Phone systems testing
Physical location of the systems Firewall testing
Access control permissions Network surveying

51
An overview of threat and risk assessment (4) – As per SANS Institute (www.sans.org)
Collecting data (cont’d)
Information on vulnerabilities and threats against the specific systems and services identified can be
obtained from several resources:
a) Security Focus (www.securityfocus.com) – searchable databases of vulnerabilities and relevant news
groups
b) Incidents.org (www.incidents.org) – information on current threats
c) Packet Storm (packetstromsecurity.org)
d) SANS (www.sans.org)

52
An overview of threat and risk assessment (5) – As per SANS Institute (www.sans.org)
Analyse the polices and procedures

• The review and analysis of the existing policies and procedures is done to gauge the compliance level
within the organization. An example of sources for policy compliance that can be used as a base line
are:

– ISO 27001/27002 (considered in some detail later in this course)

• It is important to identify the portions that are deemed not to be in compliance with respect to the
specific industry and organization. Care must be taken not to determine non‐compliance when it is not
necessary for the specific organization/region or application.

• Because so many security standards exist, it is often difficult to determine which best applies to the
organization. Generic standards offer the most comprehensive view, but these often require security
measures that are inappropriate in one or another industry. They fail to take into account the context.

53
An overview of threat and risk assessment (6) – As per SANS Institute (www.sans.org)
Vulnerability analysis (1)

• The purpose of vulnerability analysis is to take what was identified in the gathering of information and
test to determine the current exposure, whether current safe guards are sufficient in terms of
confidentiality, integrity or availability. It will also give an indication as to whether the proposed safe
guards will be sufficient. Various tools can be used to identify specific vulnerabilities in systems: Nessus,
SAINT, Whisker, Sara
• The problem faced within many organizations is the ability to effectively filter out the false positives
inherent in assessment applications. The result of the various tools must be verified in order to
accurately determine the reliability of the tools in use and to avoid protecting an area that in reality does
not exist. False positive results can be mitigated by ensuring that the assessment applications are
up to date with the latest stable signatures and patches

54
An overview of threat and risk assessment (6) – As per SANS Institute (www.sans.org)
Vulnerability analysis (2)
• The specific vulnerabilities can be graded according to the level of risk that they pose to the
organization, both internally and externally. A low rating can be applied to those vulnerabilities that are
low in severity and low in exposure. Vulnerabilities would receive a high rating if the severity was high
and the exposure was high.

55
An overview of threat and risk assessment (7) – As per SANS Institute (www.sans.org)
Threat analysis

• Threats are described as anything that would contribute to the tampering, destruction or interruption of
any service or item of value. The analysis will look at every element of risk that could conceivably
happen. These threats can be split into Human and Nonhuman elements.

• Threats that are identified must be looked at in relation to the business environment and what affect
they will have on the organization. Threats go hand in hand with vulnerabilities and can be graded in a
similar manner, measured in terms of motivation and capability. For example, the internal
non‐technical staff may have low motivation to do something malicious; however, they have a high level
of capability due to their level of access on certain systems. A hacker, on the other hand, would have a
high motivation for malicious intent and could have a high level of capability to damage or interrupt the
business. Of course, motivation does not play a part in natural occurring phenomena. A low rating can
be given where the threat has little or no capability or motivation. A high rating can be given for those
threats that are highly capable and highly motivated.

56
An overview of threat and risk assessment (8) – As per SANS Institute (www.sans.org)
Conclusion
• In summary the threat and risk assessment process is not a means to an end. It is a continual process
that once started should be reviewed regularly to ensure that the protection mechanisms currently in
place still meet the required objectives. The assessment should adequately address the security
requirements of the organization in terms of integrity, availability and confidentiality. The threat and risk
assessment should be an integral part of the overall life cycle of the infrastructure.

• Organizations that do not perform a threat and risk analysis are leaving themselves open to situations
that could disrupt, damage or destroy their ability to conduct business. Therefore the importance of
performing a threat and risk analysis must be realized by management, by the staff supporting the
infrastructure, and those that rely upon it for their business.

57