Information Technology (IT) Risk and Management of IT Risks (Information Technology Risk Management)

information technology i.t risk and

management of it risks

welcome to the risk management of

everything channel on this channel you

will see videos on risk management and

the application of risk management to

diverse areas and sectors if you are new

here make sure to subscribe to our

channel and press the notification

button so you can be notified when we

upload new videos

thank you

this video discusses information

technology i.t risks and management of

it risk in this video you will

understand the meaning of information

technology i.t risk categories of it

risks impacts of it failure on business

organizations types of it risks i.t

risks management process how to manage

it risks it risk assessment quantitative

it risks assessment qualitative it risks

assessment how to mitigate it risks

incidence response i.t incident

management process i.t incidence

recovery planning it standard it risk

management checklist it risk management

policy and content of it risk management

policy now let us start

the more a business relies on

information technology i.t the more

critical it is to identify and control

its i.t systems risks

threats ranging from equipment failure

to malicious attacks by hackers can

disrupt critical business systems and

excess confidential data

what is information technology i t risk

i.t risk is any threat to a business

data critical systems and business

processes it is the risk associated with

the use ownership operation involvement

influence and adoption of it it risk is

any threat to a business data critical

systems and business processes it risks

can damage business value and often come

from poor management of processes and

events

categories of it risks

i t risk spans a range of business

critical areas such as

1. security for example compromised

business data due to unauthorized access

or use

2. availability such as inability to

access i-t systems needed for business

operations

3. performance such as reduced

productivity due to slow or delayed

access to it systems and

4. compliance such as failure to follow

laws and regulations for example data

protection

i.t risks varies in range and nature it

is essential to be aware of all the

different types of it risk potentially

affecting a business

impacts of information technology

failure on business organizations

for businesses that rely on technology

events or incidents that compromise i.t

can cause many problems for example a

security breach can lead to

one identity fraud and theft

two financial fraud or theft

three damage to reputation

4. damage to brand and

5. damage to a business physical asset

furthermore failure of it systems due to

downtime or outages can result in other

damaging and severe consequences such as

one lost sales and customers two reduced

staff or business productivity three

reduced customer loyalty and

satisfaction and four damaged

relationship with partners and suppliers

if i.t failure affects a firm's ability

to comply with laws and regulations then

it could also lead to one breach of

legal duties two penalties fines and

litigation 3 reputational damage and 4

breach of client confidentiality

types of information technology risks

organizations i.t systems and

information are susceptible to a wide

range of risks if a business relies on

technology for its operations and

activities the managers need to be aware

of it threats threats to a firm's it

systems can be external internal

deliberate and unintentional most i.t

risks affect one or more of the

following

1. business or project goals

2. service continuity

3. bottom line results

fourth business reputation

five security and

six infrastructure

examples of information technology risks

based on the nature of risks it is

possible to differentiate between

1. physical threats these are threats

arising from physical access or damage

to i.t resources such as servers

these could include theft damage from

fire or flood or unauthorized access to

confidential data by an employee or

outsider

2. electronic threats aim at

compromising business information for

example a hacker could get access to the

company's website a computer virus may

infected sighty system or the business

may fall victim to a fraudulent email or

website these are the common types of

electronic threats a business face

3. technical failures include software

bugs computer crashes and complete

failure of a computer component a

technical failure can be catastrophic if

for example a firm cannot retrieve data

on a failed hard drive and no backup

copy is available

4. infrastructure failures these include

loss of internet connection that can

interrupt a business

infrastructure failures can make a

company loss an important purchase order

5. human error is a significant threat

for example someone might accidentally

delete important data or fail to follow

security procedures properly

information technology risk management

process

to manage it risks effectively the

following 6 steps of the risk management

process should be undertaken

1. identify risks determine the nature

of risks and how they relate to a

business

2. assess risks determine how serious

each risk is to the business and

prioritize them

3. mitigate risks put preventive

measures to reduce the likelihood of the

risk occurring and limit its impact

4. develop incident response set out

plans for managing a problem and

recovering the company's operation

5. develop contingency plans ensure that

the company can continue to run after an

incident or a crisis

6. review processes and procedures

continue to assess threats and manage

new risks

how to manage information technology

risks

managing various types of i-t risks

begins with identifying precisely

1. the type of threats affecting the

business

2. the assets that may be at risk and 3

the ways of securing i.t systems

information technology risk assessment

i.t risk assessment is a process of

analyzing potential threats and

vulnerabilities to it systems to

establish their potential loss

its objective is to help achieve optimal

security at a reasonable cost there are

two prevailing methodologies for

assessing the different types of it risk

quantitative and qualitative risk

analysis

now let us now discuss the two types of

it risks assessment methodology

quantitative information technology

risks assessment

quantitative assessment measures risk

using monetary amounts and numeric data

it uses mathematical formulas to give

value in terms of

1 the frequency of risk occurrence

2 the asset value and

3 the probability of associated loss

in an example of server failure a

quantitative assessment would involve

looking at

1. cost of a server or the revenue it

generates

2. how often does the server crash and

3. the estimated loss incurred each time

it crashed

from these values the company can work

out several vital calculations including

1. single loss expectancy refers to the

costs the company would incur if the

incident occurred once

2. the annual rate of occurrence this

refers to how many times a year the

company could expect the risk to occur

and

3.

annual loss expectancy this refers to

the total risk value over a year

these computations can assist the

company in avoiding spending too much

time and money on reducing negligible

risks for example if a threat is

unlikely to happen or costs little or

nothing to remedy it probably presents a

low risk to the business however if a

threat to the company's critical i t

systems is likely to happen and could be

expensive to fix or likely to affect the

business adversely such risk should be

considered as a high risk the risk

information can also be used to conduct

a cost and benefit analysis to determine

what level of investment would make risk

treatment worthwhile a company may not

always have the necessary historical

data to determine the probability of i.t

related risks and estimated costs

meanwhile quantitative measures of risk

are meaningful when there is good data

qualitative information technology risks

assessment

qualitative risk assessment is opinion

based it relies on judgment to

categorize risks based on probability

and impact and uses a rating scale to

describe the risks as

1. low means unlikely to occur or impact

a business

2. medium means possible to occur and

impact and

3. high means likely to occur and impact

the business significantly

for example it is possible to describe a

high probability risk as events that are

likely to happen several times in a year

the same can be done for cost and impact

in practical terms for example

low means that the company would lose up

to half an hour of production

medium means t hat the company would

cause complete shutdown for at least

three days and high means that the

company would cause irreversible loss to

the business

after risk ratings a risk assessment

matrix should be created to categorize

the level of risk of each risk event

this will assist the company in deciding

which risk to mitigate accept or

transfer different types of it risk

assessments can be undertaken often it

may be best to use a mixed approach to

it risks assessments combining elements

of both quantitative and qualitative

analysis the company can also use

quantitative data to assess the value of

assets and loss expectancy this may take

time and effort but it can also result

in a greater understanding of the risks

and better data than each method would

provide alone how to mitigate

information technology risk

if the company cannot remove or reduce

risks to an acceptable level it might

reduce the impact of potential incidents

the company should consider

1. setting procedures for detecting

problems for example a virus might

infect the company's system

2. getting insurance against the costs

of security breaches

as part of risk management a firm should

reduce potential i.t risks that may

impact the business the company should

put establish measures to protect the

company's systems and data from all

known threats the company should also

create contingency plans to minimize the

impacts of unknown threats on the

organization's operations

to mitigate it risks the company should

one regularly review the information it

holds and share ensure that the company

comply with data protection legislation

and think about what needs to be on

public or shared systems where possible

sensitive information should be removed

or secured thoroughly 2. install and

maintain security controls such as

firewalls anti-virus software and

processes that help prevent intrusion

3. implement security policies and

procedures such as internet and email

usage policies and train staff

follow best practices in cyber security

for business

4. use a third-party it provider if it

lacks in-house skills often they can

provide their security expertise

incident response

incident response is a way of managing

the aftermath of an i.t security breach

or failure it is vital to develop a

response plan before the occurrence of

an event or incident to

1. limit the damage caused by the event

and

2. reduce recovery time and costs for

the business

information technology incident response

plan

an id incident response plan is a set of

pre-written instructions to assist an

organization in responding to i.t

threats and potential scenarios such as

1. information data breaches 2. denial

of service attacks

3. firewall intrusion

4. virus or malware infection

5 damage to equipment or premises

6. insider threats and

7. loss of power or other technology

failures

the company's incident response pl on

should be created through robust high

tea risk assessments a firm incident

response plan should identify key people

who will act in an incident and describe

their roles and responsibilities

an i.t incident response plan should

also clearly articulate who is

responsible for testing the plan and

putting it into action a firm incident

response plan should identify key people

who will act in an incident and describe

their roles and responsibilities

information technology incident

management process

the process of managing an i.t incident

typically consists of six steps

one prepare staff and managers on how to

handle potential incidents should they

arise

2. determine if an event is a nighty

failure or a security incident

3. contain the incident and prevent

further damage to systems and equipment

4. find the cause of the incident and

remove the affected systems

5. recover those systems after removing

the threats

6. document and analyze the situation to

update change or improve procedures

an it incident may focus on one or more

it components of a business or be a part

of a broader crisis plan for example

fire flood and natural disaster it is

therefore beneficial to develop an

emergency response plan the company's

emergency response plan should be

integrated into its incident response

strategy

information technology incident recovery

planning

how an organization responds to it

incidents would determine how well its

business recovers from i.t incidents

planning can help to shorten the

recovery period and reduce losses it is

essential to plan thoroughly to protect

staff stakeholders and the organization

from the impact of potential business

from i.t failure and security breaches a

recovery plan could include the

following

1. the recovery period goals

2. strategies to recover the business

activities within the quickest possible

time and

3. a description of resources equipment

and staff required to recover the

company's operations

information technology standard

according to international standards

organization iso a standard is a

document that provides requirements

specifications guidelines and

characteristics that can be used

consistently to ensure that materials

products processes and services are fit

for their purpose

standards allow technology to work

seamlessly and establish trust so that

markets can operate smoothly i.t

standards are beneficial to

organizations because they

one provide a common language to measure

and evaluate performance

2. make information sharing easy through

i.t and computer systems and

3. protect consumers by ensuring safety

durability and market equity

standards and their development frame

guide and normalize almost all areas of

our lives

for example standards in it govern

information sharing between digital

devices platforms and standardized

production machines to ensure uniform

repair and reproduction

standardization in accounting healthcare

or agriculture promotes best industry

practices that emphasize safety and

quality control

standards reflect the shared values

aspirations and responsibilities within

organizations

good knowledge of the most current

standards can drive innovation increase

research and development's market value

and promote international trade and

commerce iso

27001 is an international i.t standard

by the way iso is an abbreviation for

international standard organization

now let us discuss iso 27001

iso

27001 international i.t standard

iso

27001 is an international standard that

describes best practices for information

security management systems it belongs

to a 27 000 family of standards all of

which aim to help keep a business

information assets secure

the standard specifies controls that are

key to maintaining security iso

27001 control amongst others highlight

the following

1. security policy states what an

information security policy is what it

should cover and why a company should

have a security policy

2. organizational security states how an

organization should manage information

security in a business

3. asset classification and control

describe how to audit and manage a

company's information computers software

and services

4. staff security focuses on training

responsibilities vetting procedures and

response to incidents

5. physical and environmental security

entails keeping key locations secure and

physical control of access to

information and equipment

6. communications and operations

management secure operation of

information processing facilities during

day-to-day activities especially

computer networks

7. access control emphasizes the right

to use information and systems based on

business and security needs precisely

controlling who can do what within an

organization's information resources

eight

system development and maintenance if an

organization develops its software the

design should be suitable secure and

maintain information integrity

9. business continuity management

ensures that essential business

activities are maintained during adverse

conditions thereby coping with major

disasters to minor local issues

like other international standard

organizations management system

standards the company can certify the

business to iso 27001

but certification is not mandatory the

company may decide to implement the

standard to benefit from the best

practice it contains or may wish to

certify to reassure customers and

clients that follow information security

management systems best practice

information technology risk management

checklist

risk management can be relatively simple

if its basic principles are understood

and applied here is a checklist to

ensure effective it risk

management 1. think about i.t security

from the start when planning and

updating an i.t system

2. actively look for it risks that could

affect the business and identify why the

likelihood costs and impact of those

risks

3. think about the opportunity

capability and motivation behind

potential attacks

understand the reasons for a cyber

attack

4. assess the seriousness of each it

risk and focus on those that are most

significant

5.

understand the relevant laws legislation

and industry guidelines especially if

the company must comply with the general

data protection regulation gdpr and

other local and international

regulations

6. configure computers servers firewalls

and other technical elements of the

system keep software and hardware

equipment up to date put in place other

standard cyber security measures and

read about securing the company's

wireless network

7. do not rely on just one technical

control for example a password use

two-factor authentication to guarantee

user identity for example something

introduces additional security such as

id card pin and password

eight develop data recovery and backup

processes and consider daily backups to

off-site locations

9. support technical controls with

appropriate policies procedures and

training understand the most common

insider threats in cyber security

10. make sure that the company have a

business continuity plan

this should cover any severe it risk

that cannot be fully controlled the

business continuity plan should be

updated and reviewed regularly

11. establish effective i.t incident

response and recovery measures as well

as a recording and management system

simulate incidents to test and improve

the company's incident planning response

and recovery framework

12. develop and follow specific i.t

policies and procedures such as email

and internet views and ensure that

companies staff know what is acceptable

13. consider certification to the it

security management standards for the

business and its business partners

having highlighted the it risk

management checklist let us proceed to

discuss it risk management policy

i.t risk management policy

i.t policies and procedures explain why

it is essential to manage it risks in

business the company can have i.t

policies and procedures as part of its

risk management plans or business

continuity strategy the company's i.t

policies and procedures should make them

available to its staff and suppliers to

endure adequate understanding of

1. potential risks to the company's it

systems and data

2. procedures that are in place to

mitigate them

3. processes for handling everyday tasks

4. managing changes to ite systems

5. ways to respond to it or data

security incidents and

6. acceptable behaviors about cruciality

issues such as data protection and safe

email use

content of information technology risk

management policy

an it risk management policy should

specify security procedures and

standards that will apply in the company

and any staff policies the company

wishes to enforce

1. i.t security procedures technical

controls such as systems that limit

access to sensitive data and software

installation are essential for it

security systems the company needs

policies and procedures to ensure that

these controls are adequate

2. i.t security standards standards are

essential when developing a secure i.t

environment

for example agreed standards for the

procurement of pcs servers and firewalls

would help to provide consistency

3. its staff policies the company also

needs policies to manage activities that

could pose security threats

establishing an internet usage policy

and an email usage policy is also

necessary to protect the company's

systems conclusion

i.t risks and management of it risks

have been discussed in this video i.t

risk is any threat to a business data

critical systems and business processes

it is the risk associated with the use

ownership operation involvement

influence and adoption of it i.t risk

management entails a process of

identifying monitoring and managing

potential information security or

technology risks to mitigate or minimize

their negative impact

i hope the video is educative and

beneficial to you please post your

comments below in the comments section

if this video has been educative and

beneficial to you then give it a thumbs

up and share it with your friends

thank you for seeing the risk management

of everything videos

we love to hear from you please post

your comments and questions in the

comment section below

if you are new here make sure to

subscribe to our channel risk management

of everything channel and press the

notification button so you can be

notified when we upload new videos

thank you