Something that represents failure or fragility of someone or something.
"1 Sign of becoming vulnerable. 2 Means by which something becomes susceptible or fragile in a certain situation."
Act of establishing and executing continuous processes of follow up on the risk levels and adopt controls that eliminate vulnerabilities, remove threats and reduce the probability of a threat exploiting a certain vulnerability and impacting confidentiality, integrity and availability of information..
Risk Decision Tree
1. Reject: this option should be considered when the risk is not being considered by the strategy of the business, once the cost of control, or the countermeasure, exceeds the risk or asset being protected.
2. Accept: this option should be considered when the risk is inherent to the nature and model of business, being part of the normal operations and, therefore, having been predicted in the strategy. The choice of this option generates another level of analysis:
a. Avoid: this decision is based on the will and feasibility of totally eliminating the source of a specific risk.
b. Transfer: this decision is based on the cost-benefit perspective and on the feasibility (disposition and financial capacity) of outsourcing, to take on the risk.
c. Exploit: this decision is based on the interest and on the possibility of obtaining competitive advantages by increasing the exposure and level of risk.
d. Retain: this decision is based on the interest of the business, considering cost and tolerance, in guaranteeing the maintenance of exposure and the level of risk.
e. Mitigate: this decision is based on the need of the business, considering cost and tolerance, in diversifying, controlling and reducing risks.
The Tolerance factor is determinant to define investments that are compatible with the asset being protected and mainly, so that the level of the residual risk may be found enclosed in the comfort zone and compatible with the nature of each business. .
Conceptually, we shall reach the adequate maturity in the management of risks when it is not perceptible. When the processes are well defined and documented, offering guidance to the human agents and ready to support common changes to physical, technological and human assets, without this representing a gross and unplanned oscillation in the level of risk.
But, if the processes are interrupted, the users are dissatisfied for having to keep changing their passwords and the CEOs asking themselves why, despite all the investments in security, do they receive more spam than reliable e-mails, then surely there must be something that is wrong.
CONCEPTS
Information Risk Management |
|
|
Present on the Internet supporting education. 1997-2011 |
↘ GUIDELINES
Something that can act voluntarily or involuntarily in prejudice of someone or something.
"1 Act of threatening. 2 Danger. 3 Gesture that expresses the intention to harm or cause damage."
Something that is known and used as foundation when reasoning.
“1 Act or effect of informing. 2 Transmission of news. 3 Instruction, teaching. 4 Transmission of knowledge.” ”
Result provoked by an act of threat on a particular vulnerability.
"1 Loss. 2 Damage. 3 Consequence of an attack. 4 Effect. 5 Obtained result.”
