Security risk assessment

When developing the technological and procedural requirements for logical security, it is important to consider conducting a security risk assessment for the system. This would typically include the following risk categories ... 

Table 3.3 Comparison Safety and Security Risk Assessment...

Baker, W.H., Rees, L.R (2006). Necessary measures Metric-driven information security risk assessment and decision-making. Communications of the ACM, (forthcoming). 

Landoll, Douglas, The Security Risk Assessment Handbook A Complete Guide for Performing Security Risk Assessments, 2nd ed., CRC Press, Boca Raton, FL, 2011. 

Security management process Security requirements specification Security architecture design Security risk assessment (threat model)... 

American Society for Industrial Security (2003). General Security Risk Assessment Guideline. ASIS International, Alexandria, VA. 

There are many standards on how to conduct risk assessments. Some are very complicated and some very, very simple. When 1 am working with a client, I like to spend time with them to discuss what a risk assessment is and how to pick a method that is useful for them. One of my biggest challenges has been to get people to stop looking at risks from a purely asset focus and move more toward risk scenarios. If I look only at assets and their vulnerabilities (security risk assessments typically do this), then I may not identify aU my risky scenarios. But if 1 start with developing scenarios based on my data, irrespective of the asset viewed in isolation, I am much more likely to more comprehensively identify risky scenarios. 

Paintsil, E. (2012). Taxonomy of security risk assessment approaches for researchers. In 2012 Fourth International Conference on Computatumal Aspects of Social Networks (Cason), pp. 251-262. 

Subpart I of Part 172, using a security risk assessment tool. The plan includes personnel, unauthorized access, and en route secmity elements. The plan itself plus the risk assessment and any other items used in its creation (e.g., photos, video, layouts) must be properly labeled as Sensitive Security Information with the distribution limitation statement (i.e.. Warning). 

Based on the initial risk assessment, it will be obvious that as the exposure (commodity, value and location) increases so must the standard of security that is necessary for the risk. It is also the case, however, that items of comparatively low value will be stolen if they can be easily reached and if their removal does not represent any undue risk to the thief. 

By using risk assessment techniques to determine the exposure of the property, it is possible to determine the appropriate standard of security for a risk. The following simple example will clarify this point. 

Security Vulnerability Assessment A security vulnerability assessment is intended to identify security vulnerabilities from a wide range of threats ranging from vandalism to terrorism. With the recognition of threats, consequences, and vulnerabilities, the risk of security events can be evaluated, and a security management system can be organized that will effectively mitigate those risks. 

SVA Methodologies There are several SVA techniques and methods available to the industry, all of which share common elements. The following is a list of some available SVA methodologies published by various governments, private, and trade andprofessional organizations. Some are merely chapters or sections of documents that address security or risk assessment/risk management in broader terms. Some are SVA or VA publications by themselves. Some of these methods are complete, systematic analytical techniques, and others are mere checklists. 

INTEGRATED RISK ASSESSMENT, A TOOL TO ASSESS THE IMPACT OF ENVIRONMENTAL STRESS ON SECURITY... 

The relationship between environment and security is indirect and multicasual. Therefore it is difficult to assess the risk to security caused by environmental change. Taking into consideration the principle of sustainable development where the environmental, economic and social issues are interdependent and cannot be pursued separately, the integrated risk assessment is particularly useful. 

Analyze each SCADA device to determine whether security features are present. Additionally, factory default security settings (such as in computer network firewalls) are often set to provide maximum usability, but minimal security. Set all security features to provide the maximum level of security. Allow settings below maximum security only after a thorough risk assessment of the consequences of reducing the security level. 

GMP risk assessment Qualified/trained resource System life-cycle validation System environment Current specifications Software quality assurance Formal testing/acceptance Data entry authorization Data plausibility checks Communication diagnostics Access security Batch release authority Formal procedures/contracts Change control Electronic data hardcopy Secure data storage Contingency/recovery plans Maintenance plans/records... 

Pharmacies are affected by these rules in two ways. Pharmacies, by definition, deal with PHI (e.g., a prescription itself is PHI). If the pharmacy uses a computer, the information is then electronic and is known as ePHI (Barlas, 2004). HIPAA protects all individually identifiable health information held or transmitted by a covered entity or its business associate in any form or media, whether electronic, paper, or oral (DHHS, 2003). This covered information includes demographic data, including the individual s physical or mental health (past, present, or future) the health care provided to the individual and payment information and common identifiers (e.g., name, address, birth date, and Social Security Number) that can be used to identify the individual. Pharmacies must have numerous policies and procedures in place to be in compliance with the HIPPA mandates. These include conducting risk assessments, appointing security and privacy officers to ensure compliance, and implementing policies and procedures to detect and prevent security violations. 

---