INFORMATION SECURITY RISK ANALYSIS SECOND EDITION

Using the PARA (Practical Application of Risk Analysis) process, this book examines the qualitative risk analysis process and then provides tested variations on the methodology that will allow any organization to implement risk management techniques that will prove to be cost effective. The PARA process can be used by any organization that needs to determine what direction the organization must take on a specific issue.

The risk management process supports executive decision-making, allowing managers and owners to perform their fiduciary responsibility of protecting the assets of their enterprises. This crucial process should not be a long, drawn-out affair. To be effective, it must be done quickly and efficiently.

Information Security Risk Analysis, Second Edition enables CIOs, CSOs, and MIS managers to understand when, why, and how risk assessments and analyses can be conducted effectively. This book discusses the principle of risk management and its three key elements: risk analysis, risk assessment, and vulnerability assessment. It examines the differences between quantitative and qualitative risk assessment, and details how various types of qualitative risk assessment can be applied to the assessment process. The text offers a thorough discussion of recent changes to FRAAP and the need to develop a pre-screening method for risk assessment and business impact analysis.

Introduction. Risk management. Risk assessment process. Quantitative versus qualitative risk assessment. Other forms of qualitative risk assessment. Facilitated risk analysis and assessment process (FRAAP). Variations on the FRAAP. Mapping controls. Business impact analysis (BIA). Conclusion.