Information Technology (IT) Risk and Management of IT Risks (Information Technology Risk Management)

Information Technology (IT) Risk and

Management of IT Risks.

Welcome to the Risk Management of

Everything channel. On this channel, you

will see videos on risk management and

the application of risk management to

diverse areas and sectors. If you are new

here, make sure to subscribe to our

channel and press the notification

button so you can be notified when we

upload new videos.

Thank you.

This video discusses Information

Technology (IT) Risks and Management of

IT Risks. In this video, you will

understand the meaning of Information

Technology (IT) risk, categories of IT

risks, impacts of IT failure on business

organizations, types of IT risks, IT

risks management process, how to manage

IT risks, IT risk assessment, quantitative

IT risks assessment, qualitative IT risks

assessment, how to mitigate IT risks,

incident response, IT incident

management process, IT incidence

recovery planning, IT standard, IT risk

management checklist, IT risk management

policy, and content of IT risk management

policy. Now, let us start.

The more a business relies on

Information Technology (IT), the more

critical it is to identify and control

its IT systems' risks.

Threats ranging from equipment failure

to malicious attacks by hackers can

disrupt critical business systems and

access confidential data.

What is Information Technology (IT) Risk?

IT risk is any threat to a business

data, critical systems, and business

processes. It is the risk associated with

the use, ownership, operation, involvement,

influence, and adoption of IT. IT risk is

any threat to a business data, critical

systems, and business processes. IT risks

can damage business value and often come

from poor management of processes and

events.

Categories of IT Risks.

IT risk spans a range of business-critical

areas, such as:

1. Security, for example, compromised

business data due to unauthorized access

or use.

2. Availability, such as inability to

access IT systems needed for business

operations.

3. Performance, such as reduced

productivity due to slow or delayed

access to IT systems; and

4. Compliance, such as failure to follow

laws and regulations (for example, data

protection).

IT risks varies in range and nature. It

is essential to be aware of all the

different types of IT risk potentially

affecting a business.

Impacts of Information Technology

Failure on Business Organizations.

For businesses that rely on technology,

events or incidents that compromise IT

can cause many problems. For example, a

security breach can lead to

(1) identity fraud and theft,

(2) financial fraud or theft,

(3) damage to reputation,

(4) damage to brand; and

(5) damage to a business physical asset.

Furthermore, failure of IT systems due to

downtime or outages can result in other

damaging and severe consequences, such as:

(1) Lost sales and customers, (2) Reduced

staff or business productivity, (3)

Reduced customer loyalty and

satisfaction, and (4) Damaged

relationship with partners and suppliers.

If IT failure affects a firm's ability

to comply with laws and regulations, then

it could also lead to (1) breach of

legal duties, (2) penalties, fines, and

litigation, (3) reputational damage, and (4)

breach of client confidentiality.

Types of Information Technology Risks.

Organizations IT systems and

information are susceptible to a wide

range of risks. If a business relies on

technology for its operations and

activities, the managers need to be aware

of IT threats. Threats to a firm's IT

systems can be external, internal,

deliberate, and unintentional. Most IT

risks affect one or more of the

following:

(1) business or project goals,

(2) service continuity,

(3) bottom-line results,

(4) business reputation,

(5) security, and

(6) infrastructure.

Examples of Information Technology Risks.

Based on the nature of risks, it is

possible to differentiate between:

1. Physical threats: These are threats

arising from physical access or damage

to IT resources such as servers.

These could include theft, damage from

fire or flood, or unauthorized access to

confidential data by an employee or

outsider.

2. Electronic threats: aim at

compromising business information, for

example, a hacker could get access to the

company's website, a computer virus may

infected its IT system, or the business

may fall victim to a fraudulent email or

website. These are the common types of

electronic threats a business face.

3. Technical failures include software

bugs, computer crashes, and complete

failure of a computer component. A

technical failure can be catastrophic if,

for example, a firm cannot retrieve data

on a failed hard drive and no backup

copy is available.

4. Infrastructure failures: These include

loss of internet connection that can

interrupt a business.

Infrastructure failures can make a

company loss an important purchase order.

5. Human error is a significant threat,

for example, someone might accidentally

delete important data or fail to follow

security procedures properly.

Information Technology Risk Management

Process.

To manage IT risks effectively, the

following six steps of the risk management

process should be undertaken:

1. Identify risks: determine the nature

of risks and how they relate to a

business.

2. Assess risks: determine how serious

each risk is to the business and

prioritize them.

3. Mitigate risks: Put preventive

measures to reduce the likelihood of the

risk occurring and limit its impact.

4. Develop incident response: set out

plans for managing a problem and

recovering the company's operation.

5. Develop contingency plans: ensure that

the company can continue to run after an

incident or a crisis.

6. Review processes and procedures:

continue to assess threats and manage

new risks.

How to Manage Information Technology

Risks.

Managing various types of IT risks

begins with identifying precisely:

(1) The type of threats affecting the

business,

(2) The assets that may be at risk, and (3)

The ways of securing IT systems.

Information Technology Risk Assessment.

IT risk assessment is a process of

analyzing potential threats and

vulnerabilities to IT systems to

establish their potential loss.

Its objective is to help achieve optimal

security at a reasonable cost. There are

two prevailing methodologies for

assessing the different types of IT risk:

quantitative and qualitative risk

analysis.

Now, let us now discuss the two types of

IT risks assessment methodology.

Quantitative Information Technology

Risks Assessment.

Quantitative assessment measures risk

using monetary amounts and numeric data.

It uses mathematical formulas to give

value in terms of:

(1) The frequency of risk occurrence,

(2) The asset value, and

(3) The probability of associated loss.

In an example of server failure, a

quantitative assessment would involve

looking at:

(1) Cost of a server or the revenue it

generates,

(2) How often does the server crash, and

(3) The estimated loss incurred each time

it crashed.

From these values, the company can work

out several vital calculations including

(1) single loss expectancy: refers to the

costs the company would incur if the

incident occurred once,

(2) The annual rate of occurrence: This

refers to how many times a year the

company could expect the risk to occur;

and

(3)

Annual loss expectancy: This refers to

the total risk value over a year.

These computations can assist the

company in avoiding spending too much

time and money on reducing negligible

risks. For example, if a threat is

unlikely to happen or costs little or

nothing to remedy, it probably presents a

low risk to the business. However, if a

threat to the company's critical IT

systems is likely to happen and could be

expensive to fix or likely to affect the

business adversely, such risk should be

considered as a high risk. The risk

information can also be used to conduct

a cost and benefit analysis to determine

what level of investment would make risk

treatment worthwhile. A company may not

always have the necessary historical

data to determine the probability of IT-related

risks and estimated costs.

Meanwhile, quantitative measures of risk

are meaningful when there is good data.

Qualitative Information Technology Risks

Assessment.

Qualitative risk assessment is opinion-based.

It relies on judgment to

categorize risks based on probability

and impact and uses a rating scale to

describe the risks as:

1. Low: means unlikely to occur or impact

a business;

2. Medium: means possible to occur and

impact; and

3. High: means likely to occur and impact

the business significantly.

For example, it is possible to describe a

high probability risk as events that are

likely to happen several times in a year.

The same can be done for cost and impact

in practical terms, for example,

Low means that the company would lose up

to half an hour of production,

Medium means that the company would

cause complete shutdown for at least

three days, and High means that the

company would cause irreversible loss to

the business.

After risk ratings, a risk assessment

matrix should be created to categorize

the level of risk of each risk event.

This will assist the company in deciding

which risk to mitigate, accept, or

transfer. Different types of IT risk

assessments can be undertaken. Often, it

may be best to use a mixed approach to

IT risks assessments, combining elements

of both quantitative and qualitative

analysis. The company can also use

quantitative data to assess the value of

assets and loss expectancy. This may take

time and effort, but it can also result

in a greater understanding of the risks

and better data than each method would

provide alone. How to Mitigate

Information Technology Risk.

If the company cannot remove or reduce

risks to an acceptable level, it might

reduce the impact of potential incidents.

The company should consider

(1) setting procedures for detecting

problems, for example, a virus might

infect the company's system, and

(2) getting insurance against the costs

of security breaches.

As part of risk management, a firm should

reduce potential IT risks that may

impact the business. The company should

establish measures to protect the

company's systems and data from all

known threats. The company should also

create contingency plans to minimize the

impacts of unknown threats on the

organization's operations.

To mitigate IT risks, the company should:

1. Regularly review the information it

holds and share. Ensure that the company

comply with data protection legislation

and think about what needs to be on

public or shared systems. Where possible,

sensitive information should be removed

or secured thoroughly. 2. Install and

maintain security controls, such as

firewalls, anti-virus software and

processes that help prevent intrusion.

3. Implement security policies and

procedures, such as internet and email

usage policies and train staff.

Follow best practices in cybersecurity

for business.

4. Use a third-party IT provider if it

lacks in-house skills. Often, they can

provide their security expertise.

Incident Response.

Incident response is a way of managing

the aftermath of an IT security breach

or failure. It is vital to develop a

response plan before the occurrence of

an event or incident to

(1) limit the damage caused by the event;

and

(2) reduce recovery time and costs for

the business.

Information Technology Incident Response

Plan.

An IT incident response plan is a set of

pre-written instructions to assist an

organization in responding to IT

threats and potential scenarios, such as

(1) information data breaches, (2) denial

of service attacks,

(3) firewall intrusion,

(4) virus or malware infection,

(5) damage to equipment or premises,

(6) insider threats, and

(7) loss of power or other technology

failures.

The company's incident response plans

should be created through robust IT

risk assessments. A firm incident

response plan should identify key people

who will act in an incident and describe

their roles and responsibilities.

An IT Incident Response Plan should

also clearly articulate who is

responsible for testing the plan and

putting it into action. A firm incident

response plan should identify key people

who will act in an incident and describe

their roles and responsibilities.

Information Technology Incident

Management Process.

The process of managing an IT incident

typically consists of six steps.

1. Prepare staff and managers on how to

handle potential incidents should they

arise.

2. Determine if an event is an IT

failure or a security incident.

3. Contain the incident and prevent

further damage to systems and equipment.

4. Find the cause of the incident and

remove the affected systems.

5. Recover those systems after removing

the threats.

6. Document and analyze the situation to

update, change or improve procedures.

An IT incident may focus on one or more

IT components of a business or be a part

of a broader crisis plan, for example,

fire, flood, and natural disaster. It is,

therefore, beneficial to develop an

emergency response plan. The company's

emergency response plan should be

integrated into its incident response

strategy.

Information Technology Incident Recovery

Planning.

How an organization responds to IT

incidents would determine how well its

business recovers from IT incidents.

Planning can help to shorten the

recovery period and reduce losses. It is

essential to plan thoroughly to protect

staff, stakeholders, and the organization

from the impact of potential business

from IT failure and security breaches. A

recovery plan could include the

following:

(1) the recovery period goals,

(2) strategies to recover the business

activities within the quickest possible

time, and

(3) a description of resources, equipment,

and staff required to recover the

company's operations.

Information Technology Standard.

According to International Standards

Organization (ISO), a standard is a

document that provides requirements,

specifications, guidelines, and

characteristics that can be used

consistently to ensure that materials,

products, processes, and services are fit

for their purpose.

Standards allow technology to work

seamlessly and establish trust so that

markets can operate smoothly. IT

standards are beneficial to

organizations because they

provide a common language to measure

and evaluate performance,

make information sharing easy through

IT and computer systems, and

protect consumers by ensuring safety,

durability, and market equity.

Standards and their development frame

guide and normalize almost all areas of

our lives.

For example, standards in IT govern

information sharing between digital

devices, platforms, and standardized

production machines to ensure uniform

repair and reproduction.

Standardization in accounting, health care,

or agriculture promotes best industry

practices that emphasize safety and

quality control.

Standards reflect the shared values,

aspirations, and responsibilities within

organizations.

Good knowledge of the most current

standards can drive innovation, increase

research and development's market value,

and promote international trade and

commerce. ISO

27,001 is an international IT standard.

By the way, ISO is an abbreviation for

International Standard Organization.

Now, let us discuss ISO 27,001.

ISO

27,001: International IT Standard.

ISO

27,001 is an international standard that

describes best practices for information

security management systems. It belongs

to a 27,000 family of standards, all of

which aim to help keep a business'

information assets secure.

The standard specifies controls that are

key to maintaining security. ISO

27,001 control, amongst others highlight

the following:

1. Security policy states what an

information security policy is, what it

should cover and why a company should

have a security policy.

2. Organizational security states how an

organization should manage information

security in a business.

3. Asset classification and control

describe how to audit and manage a

company's information, computers, software,

and services.

4. Staff security focuses on training,

responsibilities, vetting procedures, and

response to incidents.

5. Physical and environmental security

entails keeping key locations secure and

physical control of access to

information and equipment.

6. Communications and operations

management secure operation of

information processing facilities during

day-to-day activities, especially

computer networks.

7. Access control emphasizes the right

to use information and systems based on

business and security needs, precisely

controlling who can do what within an

organization's information resources.

8.

System development and maintenance, if an

organization develops its software, the

design should be suitable, secure and

maintain information integrity.

9. Business continuity management

ensures that essential business

activities are maintained during adverse

conditions, thereby coping with major

disasters to minor local issues.

Like other International Standard

Organizations management system

standards, the company can certify the

business to ISO 27,001,

but certification is not mandatory. The

company may decide to implement the

standard to benefit from the best

practice it contains or may wish to

certify to reassure customers and

clients that follow information security

management systems best practice.

Information Technology Risk Management

Checklist.

Risk management can be relatively simple

if its basic principles are understood

and applied. Here is a checklist to

ensure effective IT risk

management: 1. Think about IT security

from the start when planning and

updating an IT system.

2. Actively look for IT risks that could

affect the business; and identify the

likelihood, costs, and impact of those

risks.

3. Think about the opportunity,

capability, and motivation behind

potential attacks.

Understand the reasons for a cyber-attack.

4. Assess the seriousness of each IT

risk and focus on those that are most

significant.

5.

Understand the relevant laws, legislation,

and industry guidelines, especially if

the company must comply with the General

Data Protection Regulation (GDPR) and

other local and international

regulations.

6. Configure computers, servers, firewalls,

and other technical elements of the

system. Keep software and hardware

equipment up to date. Put in place other

standard cybersecurity measures and

read about securing the company's

wireless network.

7. Do not rely on just one technical

control, for example, a password. Use

two-factor authentication to guarantee

user identity, for example, something

introduces additional security such as

ID card, PIN, and password.

8. Develop data recovery and backup

processes and consider daily backups to

off-site locations.

9. Support technical controls with

appropriate policies, procedures, and

training. Understand the most common

insider threats in cybersecurity.

10. Make sure that the company has a

business continuity plan.

This should cover any severe IT risk

that cannot be fully controlled. The

business continuity plan should be

updated and reviewed regularly.

11. Establish effective IT incident

response and recovery measures, as well

as a recording and management system.

Simulate incidents to test and improve

the company's incident planning, response,

and recovery framework.

12. Develop and follow specific IT

policies and procedures, such as email

and internet use, and ensure that

company's staff know what is acceptable.

13. Consider certification to the IT

security management standards for the

business and its business partners.

Having highlighted the IT Risk

Management Checklist, let us proceed to

discuss IT Risk Management Policy.

IT Risk Management Policy.

IT policies and procedures explain why

it is essential to manage IT risks in

business. The company can have IT

policies and procedures as part of its

risk management plans or business

continuity strategy. The company's IT

policies and procedures should make them

available to its staff and suppliers to

endure adequate understanding of:

1. Potential risks to the company's IT

systems and data,

2. Procedures that are in place to

mitigate them,

3. Processes for handling everyday tasks,

4. Managing changes to IT systems,

5. Ways to respond to IT or data

security incidents, and

6. Acceptable behaviors about crucial IT

issues, such as data protection and safe

email use.

Content of Information Technology Risk

Management Policy.

An IT risk management policy should

specify security procedures and

standards that will apply in the company

and any staff policies the company

wishes to enforce.

1. IT Security Procedures: Technical

controls, such as systems that limit

access to sensitive data and software

installation, are essential for IT

security systems. The company needs

policies and procedures to ensure that

these controls are adequate.

2. IT Security Standards: Standards are

essential when developing a secure IT

environment.

For example, agreed standards for the

procurement of PCs, servers, and firewalls

would help to provide consistency.

3. IT Staff Policies: The company also

needs policies to manage activities that

could pose security threats.

Establishing an internet usage policy

and an email usage policy is also

necessary to protect the company's

systems. Conclusion.

IT risks and management of IT risks

have been discussed in this video. IT

risk is any threat to a business data,

critical systems, and business processes.

It is the risk associated with the use,

ownership, operation, involvement,

influence, and adoption of IT. IT risk

management entails a process of

identifying, monitoring, and managing

potential information security or

technology risks to mitigate or minimize

their negative impact.

I hope the video is educative and

beneficial to you. Please post your

comments below in the comment section.

If this video has been educative and

beneficial to you; then, give it a thumbs

up and share it with your friends.

Thank you for seeing the Risk Management

of Everything videos.

We love to hear from you. Please post

your comments and questions in the

comment section below.

If you are new here, make sure to

subscribe to our channel (Risk Management

of Everything channel) and press the

notification button so you can be

notified when we upload new videos.

Thank you.