Fundamentals of IT risk analysis
IT risk analysis determines the systems that need protection and helps the IT manager determine which protective actions are most cost effective.
Providers of security and anti-malware products like to spread images of young hackers wearing hoodies as a threat to IT systems. But, more often, employees of a company pose a greater threat to information security. Insiders are responsible for about 70 percent of the incidents; external attackers who exploit security vulnerabilities account for about 30 percent. The ISO/IEC 27005 standard  on IT risk management lists poorly trained or careless employees, disgruntled or malicious employees, and dishonest or recently fired employees as the main hazards.
At the same time, the profile of the external attacker is also changing. The romantic notion of the lonesome hacker sitting in an apartment and stealing data for the joy of being able to do so is far from the norm. Hacking today is usually a business where prices are defined by supply, demand, and ancillary costs (see the box titled "Cost and Benefits for Attackers.")
In this climate, every business needs to be aware of potential security threats, and it helps to have a systematic strategy for quantifying risk and assigning priorities as to which problems are most urgent. The business tool for getting to grips with vulnerability assessment is risk analysis. Risk analysis helps a company identify the risks, calculate the financial impact, identify vulnerabilities, assess threats, and put a value on the damage that would occur if someone were to exploit existing vulnerabilities and conflicts. The goal is not just to find the most glaring vulnerability or the most expensive loss scenario – risk analysis attempts to evaluate the severity of an attack in the context of the likelihood the attack will occur, showing IT managers which prevention measures will give the most protection for the IT dollar.
Buy this article as PDF
According to a report, many potential victims of the Heartbleed attack have patched their systems, but few have cleaned up the crime scene to protect themselves from the effects of a previous intrusion.
DARPA and NICTA release the code for the ultra-secure microkernel system used in aerial drones.
Should you trust an online service to store your online passwords?
New B+ board lets you build cool things without the complication of a powered USB hub.
Redmond rushes in to root out alleged malware haven.
New initiative will bring futuristic virtual reality effects to the web surfing experience.
Dyreza malware launches a man-in-the-middle attack that compromises SSL.
New cloud combines worldwide access with local attention to data security.
A first cousin of the recent Heartbleed attack affects EAP-based wireless and peer-to-peer authentication.
FOSS community acts to protect freedom of choice for laptop devices.