|
|
səhifə | 4/6 | tarix | 19.12.2023 | ölçüsü | 15,34 Kb. | | #186744 |
| ch14(1)
Threat Sources - threats may be
- should consider human attackers
- motivation
- capability
- resources
- probability of attack
- deterrence
- any previous history of attack on org
- depends on risk assessors experience
- uses variety of sources
Vulnerability Identification - identify exploitable flaws or weaknesses in organization’s IT systems or processes
- hence determine applicability and significance of threat to organization
- need combination of threat and vulnerability to create a risk to an asset
- again can use lists of potential vulnerabilities in standards etc
Analyze Risks - specify likelihood of occurrence of each identified threat to asset given existing controls
- specify consequence should threat occur
- hence derive overall risk rating for each threat
risk = probability threat occurs x cost to organization - in practice very hard to determine exactly
- use qualitative not quantitative, ratings for each
- aim to order resulting risks in order to treat them
Determine Consequence Determine Resultant Risk
Consequences
Likelihood
Doomsday
Catastrophic
Major
Moderate
Dostları ilə paylaş: |
|
|