UNIT3:Risk Identification

• A business process is a set of interrelated activities resulting in the delivery of a product or service to a customer. Inefficient or ineffective business processes can negatively impact an enterprise.

• Infrastructure assets include physical and IT infrastructure, and new and outdated technologies pose risks.

• Financial assets, such as cash, investments, and accounts receivable, are subject to various risks.

• Reputation is an intangible asset impacted by various events and decisions.

• Asset classification determines sensitivity and criticality of IT assets, requiring a complete IT asset inventory and location identification.

• Asset valuation involves understanding the business impact of a breach or loss of an asset.

• Information asset valuation is difficult, especially for intangible assets like personally identifiable information or trade secrets.

• Threats can be external (espionage, theft, sabotage) or internal (human error, negligence) and intentional or unintentional.

• Advanced Persistent Threats (APTs) are sophisticated attackers seeking to establish and extend footholds within targeted organizations.

• Two common risk assessment approaches: systematic (reviewing plans and interviews) and inductive (analyzing processes).

• Interviews can be valuable but have potential pitfalls, requiring thorough preparation and open communication.

• Risk scenarios aid in risk identification and assessment, facilitating communication and understanding of potential risks.

• Top-down and bottom-up approaches to risk scenario development, based on business goals and specific risk events.

• I&T risk scenarios describe potential IT-related events and their business impacts, aiding in risk management and decision analysis.

• Entities should not report on all specific risk scenarios but can use a generic risk structure for reporting.

• Developing relevant and manageable risk scenarios requires expertise, understanding of the business and IT environments, involvement of all parties, a facilitated process, and identification of systemic and contagious risks.

• Scenario analysis is not just an analytical exercise but also a means to gain organizational buy-in.

• Scenarios should not focus only on worst-case events but also on less severe incidents and complex scenarios that show cascading and coincidental impacts.

• Systemic risks refer to events that affect a large group of enterprises within an industry, such as a nationwide air traffic control system failure.

• Contagious risks refer to events that happen to several business partners within a short time frame, such as a clearinghouse being temporarily out of business due to no transactions from providers.

• Detectability of risk scenarios includes visibility and recognition, requiring the enterprise to be able to observe and recognize anything wrong.

• Scenario generation identifies risks to which the enterprise may not have realized it was subject and puts in place countermeasures.

• Risk analysis assesses the frequency and impact of the identified scenarios and raises questions about detectability and the enterprise's ability to react appropriately.

Test your knowledge of I&T-related risk scenarios with this quiz. Explore different threat types and their nature, as well as potential assets/resources that could be affected.