Chapter 7 - Information technology risk management

Abstract

Convergence is defined as the process of two entities coming together to a common point. For the purposes of risk management, convergence is defined as the process of traditional risk management and information technology risk management coming together to a common point where methodologies, ideas, and resources will be shared to create a comprehensive low risk environment. The objective of performing risk management is to enable the organization to accomplish its mission: (1) by better securing the information technology systems that store, process, or transmit organizational information; (2) by enabling security decision makers to make well-informed risk-management decisions to justify the expenditures that are part of an information technology budget; and(3) by assisting security decision makers in approving the information technology systems on the basis of the supporting documentation resulting from the performance of risk management. In the initial stages of the risk management process, information technology assets must be identified and classified. Once assets have been identified and categorized, they should be inventoried. Finally, impact analysis aids in determining the potential adverse impact resulting from a successful exploitation of vulnerability from a given threat.