ITEC 3500 - L2: IT Risk Universe from a Business Perspective

Risk IT Principles

1. Connect to Business Objectives

2. Align IT Risk Management With ERM

3. Balance Cost/Benefit of IT Risk

4. Promote Fair and open Communication

5. Establish Tone at the Top and Accountability

6. Function as Part of Daily Activities

IT Risk Management (ITRM)

1. Risk & Compliance: Responding & Managing Regulatory Requirements

2. Infromation Security: Managing & Mitigating External & Internal Security Threats

3. IT Governance: Aligning IT Delivery with Business Requirements

4. Service Assurance: Enabling Operational Effectiveness & Efficiency

Options to respond to an identified risk

1. Remediate or mitigate the risk
2. Avoid the risk
3. Transfer the risk
4. Accept the risk

Key considerations when selecting an option

A) Cost vs. benefits
B) Only business owners can accept risk
C) Rare to eliminate risk entirely

Risk appetite

Enterprise-level statement defining risk tolerance based on expertise and alignment with business objectives

Risk tolerance

Tolerable deviation from risk appetite level, requiring case-by-case approval

Inherent risk

Risk level without considering management actions

Controls

Technical, administrative, or physical measures to mitigate risks

Control effectiveness

Assessed as highly effective, somewhat effective, or not effective

Residual risk

Remaining risk after risk response implementation, aiming to reduce to an acceptable level

Business Continuity Planning (BCP)

Ensuring business functionality in adverse situations like disasters

Disaster Recovery (DR)

Focused on recovering IT systems to maintain business operations

Business Impact Analysis (BIA)

Examination of business processes to understand recovery objectives

Recovery Time Objective (RTO)

Earliest time to restore a business process after a disaster to avoid consequences

Recovery Point Objective (RPO)

Acceptable data loss measured in time, determining backup frequency

Maximum Tolerable Downtime (MTD)

Total time a business process can be disrupted without causing unacceptable consequences

Full backup

Complete copy of entire data set, time-consuming but simplifies recovery

Incremental backup

Backup method that only backs up data that has changed since the last full or incremental backup.

Differential backup

Backup method that includes all data changed since the last full backup.

Hot site

Recovery site with all necessary equipment and IT systems ready for quick deployment.

Warm site

Recovery site partially equipped with basic resources, requiring longer setup time than a hot site.

Cold site

Basic recovery site with minimal equipment, suitable for low-cost recovery solutions.

Hash function

Function that converts input passwords into fixed-size hashes for security purposes.

Salting

Process of adding random values to hashed output to enhance security, particularly against rainbow table attacks.

Symmetric encryption

Encryption method using a single secret key for both encryption and decryption processes.

Asymmetric encryption

Encryption method using a pair of public and private keys for secure communication.

Digital signature

Electronic validation method ensuring the integrity and authenticity of a message.