Fundamentals of IT risk analysis

Risk Wisdom

© Lead Image © lightwise,

© Lead Image © lightwise,

Article from Issue 154/2013
Author(s): , Author(s):

IT risk analysis determines the systems that need protection and helps the IT manager determine which protective actions are most cost effective.

Providers of security and anti-malware products like to spread images of young hackers wearing hoodies as a threat to IT systems. But, more often, employees of a company pose a greater threat to information security. Insiders are responsible for about 70 percent of the incidents; external attackers who exploit security vulnerabilities account for about 30 percent. The ISO/IEC 27005 standard [1] on IT risk management lists poorly trained or careless employees, disgruntled or malicious employees, and dishonest or recently fired employees as the main hazards.

At the same time, the profile of the external attacker is also changing. The romantic notion of the lonesome hacker sitting in an apartment and stealing data for the joy of being able to do so is far from the norm. Hacking today is usually a business where prices are defined by supply, demand, and ancillary costs (see the box titled "Cost and Benefits for Attackers.")

In this climate, every business needs to be aware of potential security threats, and it helps to have a systematic strategy for quantifying risk and assigning priorities as to which problems are most urgent. The business tool for getting to grips with vulnerability assessment is risk analysis. Risk analysis helps a company identify the risks, calculate the financial impact, identify vulnerabilities, assess threats, and put a value on the damage that would occur if someone were to exploit existing vulnerabilities and conflicts. The goal is not just to find the most glaring vulnerability or the most expensive loss scenario – risk analysis attempts to evaluate the severity of an attack in the context of the likelihood the attack will occur, showing IT managers which prevention measures will give the most protection for the IT dollar.


Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Phishing and Pharming

    The pharmers and phishers are after your precious financial infor-mation. We’ll show you how to protect your interests.

  • Password Theft at

    The Typo3 Association is warning users with accounts at of a possible misuse of stored data.

  • FFII: EU Trade Agreement with Korea Endangers Developers

    The Foundation for a Free Information Infrastructure (FFII) perceives the free trade agreement of the EU with Korea as a massive competitive disadvantage to the EU and a danger to software developers, free software projects and small and mid-sized companies.

  • Stopping Drive-By Attacks

    You won't find a perfect solution to the growing problem of drive-by attacks, but many tools are available to help you keep malicious code off your network.

  • Data Recovery Services

    Nothing protects your data like a well-conceived system of backups. However, no one is perfect, and mistakes happen. In most cases, you can recover data you thought was lost by sending your disk to a data recovery service.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95


njobs Europe
Njobs Netherlands Njobs Deutschland Njobs United Kingdom Njobs Italia Njobs France Njobs Espana Njobs Poland
Njobs Austria Njobs Denmark Njobs Belgium Njobs Czech Republic Njobs Mexico Njobs India Njobs Colombia