Highlighted text? Practice this concept. Highlighted passages and figures open related questions.
Practice related questions (2)Progress & bookmarks
Current section
1-3-2 Risk Management
p. 378
Practice this section 2 linked exam questions with default filters
Progress
Not marked complete
Related questions in this lesson 3
Risk frequency and impact analysis1Risk avoidance1Risk remaining after treatment1p. 378
1-3-2 Risk Management
ISO 31000:2009 defines risk management as “coordinated activities to direct and control an organization with regard to risk.” Risk is defined as “the effect of uncertainties on objectives” in ISO 31000:2009. Here, an effect is a positive or negative deviation from what is expected. As an example, companies perform business activities to obtain targeted profits through a variety of capital investments, such as investment in land or stocks, or development of new products. A certain type of risk makes more profits than expected, or conversely, causes losses. (Such type of risk that occurs under the control of the managing entity is called a speculative risk). In contrast, there is also another type of risk such as natural disaster, man-made disaster, and theft that result only in negative effect. (The type of risk that occurs outside of the control of the managing entity is called a pure risk). Risk management determines and manages organizational responses to these risks (especially speculative risks) in advance. Risk management is also implemented as part of ISMS.
p. 379
![Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: [Risk management procedure] (1) Confirmation of the organization’s status Identify the information assets that are subject to risk analysis, and classify those assets in consideration of the importance of each asset from aspects of confidentiality, integrity, and availability. On the basis of the results, determine criteria (i.e., the required information security standards) for protection of information assets. (2) Implementation of risk assessment 1) Risk identification Identify risks on the basis of threats to information assets, vulnerabilities, etc. 2) Risk analysis Analyze the frequency of occurrence of risks, the scale of impacts (damage, losses) made when the risks are exposed, or such other factor. Risk analysis focuses on perils (i.e., causes of loss) and hazards (i.e., dangerous conditions). Perils are factors that lead to risk, but no risk is likely to occur so readily without any hazards. As an example, even in the event of an earthquake (a peril), a building will not collapse readily if it is not in deteriorated condition (a hazard). (Threats can be thought of as perils, and vulnerabilities as hazards). It is also necessary to be cautious of moral hazards that are conditions where the sense of danger is decreased due to compensations, such as insurance against risks, and as a result, risks are increased. 3) Risk evaluation On the basis of the results of risk analysis, evaluate whether each risk is acceptable or allowable. (3) Treatment for risk Taking into account both an evaluated risk and the required level of information security, determine and implement treatment measures for that risk.](/private-assets/fe-v1/ch06/risk/original-region-389-45-23f4dc915d8d.webp)
(1) Types of risks
Risk identification distinguishes risks for each information asset. Each targeted information asset has the different types of risks, such as failure, breakage, or theft for hardware and other physical assets, and errors or malfunctions for software assets, so it is necessary to check for missing assets. In addition, risk analysis may classify risks according to the types of losses caused by the risks. Losses caused by risks include the following types. Note that risk analysis targets not
p. 380
only pure risks that cause only losses but also speculative risks that can cause both profits and losses.
(2) Measures against risks
Measures to be considered for implementation as risk treatment include the following types.
p. 381
necessary to fully investigate the status of damages from the risk and confirm that there is no problem. Moreover, it is also necessary to determine the priority of risk treatment in preparation for the simultaneous occurrence of multiple risks.
Section progress
Original chapter exercises
Original chapter exercises →New FE Textbook Vol.1 · IT Fundamentals · First Edition, April 2015