How risk identification supports effective information security management

Risk Identification in Information Security

How does risk identification contribute to effective risk management of information security?

Risk identification plays an essential part in the process of risk management and in dealing with the pressing issue of information security in the modern working and networked environment. Risk identification also plays an important role in the selection and prioritization of various problems in terms of their significance to the organization or institution. Furthermore, risk identification leads to an assessment of the value assets of the company or enterprise. It is imperative that an organization properly identifies all possible risks so that the communities of interest within that organization have a clear picture to construct an assessment of the vulnerabilities to these assets.

The present study is intended to research the ways in which risk identification is useful as an integral and essential part of the process of the risk management of information security. I hope that my research question and paper will help further the understanding of the role that risk identification plays in risk management, and that this research can be instrumental in providing some new insight into risk identification.

Overview of risk identification and IT

The issue of security has become an important if not crucial area of concern for all online companies, ecommerce institutions and Web users. The issue of security, as well as privacy, can be seen in the increasing concern about online shopping and customer confidence in the online payment process. The issue of privacy intrusion has also become central to today's online world, especially in the area of ecommerce. There has in recent years been an increase in the reports of fraud and credit card infringements. This has also resulted in efforts to create and disseminate more effective security measures and methods. All of these aspects have to be taken into account in understanding the problem of risk identification as a necessary prerequisite for good risk management in the information age.

With the advent and increasingly ubiquitous nature of the Internet, online networking and communications technologies, there has on the one hand been an exponential increase in the free flow of information and the growth of online business. The internet as a boon to various industries and commerce has meant not only that information and information sharing have become more accessible and faster, but that various new technologies can be used to increase business and transaction processes. In essence, the Internet has meant that the barriers that existed before between countries and nations, as well as markets, have all but disappeared.

On the other hand this modern phenomenon has also resulted in certain unique and challenging problems and risks to both commercial and private integrity that has become of paramount importance in the modern organization and business. As the internet has progressed in complexity and interactivity, as well as in the exponential increase in the number of online users, so have the threats of privacy invasion and other forms of intrusion and fraud.

The Internet has grown considerably during the past decade, particularly with respect to its use as a tool for communication, entertainment, and marketplace exchange. This rapid growth has been accompanied, however, by concerns regarding the collection and dissemination of consumer information by marketers who participate in online retailing. These concerns pertain to the privacy and security of accumulated consumer data & #8230;and the perceived risks that consumers may experience with respect to these issues

(Miyazaki, and Fernandez, 2001, p. 27)

Risk identification as well as risk assessment is therefore seen as a cardinal issue in today's IT and online environment. As one article on this subject states, "Operational IT planning should identify and assess risk exposure to ensure policies, procedures, and controls remain effective" (Booklet: Management ). Furthermore, it is generally stressed that this risk identification should be thorough and extensive. It should"... identify the location of all confidential customers and corporate information, any foreseeable internal and external threats to the information, the likelihood of the threats, and the sufficiency of policies and procedures to mitigate the threats" (Booklet: Management). As many IT specialists note, it is imperative that management consider the results of the identification and assessment of risks in overseeing all IT operations.

The above points therefore stress the central role that the identification of risk factors play in the security of the company or firm involved. As many experts comment, the reality of modern online and networking interactions and communications in business and other organizational activities is that any system is vulnerable to hacking and other security issues. It should also be noted that the general consensus is that the majority of security breaches occur as a result of common vulnerabilities in the system that could easily have been checked.

However, the identification of risk factors in terms of information security brings a large number of variables and criteria into play. These include not only issues of policy and procedure, but also human factors and issues such as training and human error that have to be taken into account in the assessment of risk.

Definitions

Before discussing the aspect of risk identification in detail and in relation to factors such as risk assessment and management, it is firstly important to clearly define the parameters of the term risk identification. The CISA Review Manual 2006 provides the following definition of risk management:

Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization." (

A number of important aspects need to be identified and unpacked from this definition. The first is that risk identification is on ongoing process which must be continuously repeated and maintained, as the online information environment is constantly changing with many new threats and risks emerging on a daily basis. Therefore, the process of identification must be one that is designed to be maintained over time and should also be flexible enough to adapt to new threats or risks in the online environment.

A second important point is that the measures or counter-measures taken as a result of identification and assessment of risks must be balanced in order to ensure that these measures taken do not impact negatively on aspects such as efficiency and productivity. In other words, risk identification is related to value assessment and counter -- measures instituted to protect the assets of the company or organization should not jeopardize the integrity of the organization.

In essence risk identification can be understood as The "… likelihood that something bad will happen that causes harm to an informational asset (or the loss of the asset)" (SPECIAL REPORT: Security Directives and Compliance). Furthermore, this means that the optimal management of security risks implies the correct and timely identification of possible risk factors that may threaten the company. This in turn refers to an ongoing and detailed awareness of the value of the assets of the company or organization. "… managers need to identify the value of the IT and information assets that might be impacted; then conduct a threat and vulnerability analysis to identify the potential effect and the probability of that occurrence" ( SPECIAL REPORT: Security Directives and Compliance) Therefore, it follows that in order to accomplish adequate risk identification one must take into account the important concept of vulnerability. Vulnerabilities as a central aspect of risk identification will be discussed in more detail in the following section.

Vulnerabilities

Vulnerabilities to the system in information security constitute a risk. These vulnerabilities can mean the loss of integrity and confidentiality and can consequently lead to other losses, such as loss of income. However, the identification of all risks is often an impossible task and the term residual risk is used to describe all remaining risks after the identification and assessment. In this sense, risk assessment follows from the identification of the risk and is usually carried out be a team of experts in the areas of the business affected.

There are many common types of vulnerabilities that need to be acknowledged and included in any strategy of risk identification and management. One of the most pervasive and common risks is identity theft. An article that provides some insightful and relatively contemporary statistics on the extent of ID theft is Internet Commerce Grows 88% by Dollar Volume and 39% by Transaction Volume: Fraud Remains a Concern. For example, the author notes that in recent years the "…. United States remained the top source country for security events generated with an overwhelming 79%, followed by Canada (5.7%), Taiwan (2.6%), Korea (2.5%) and the U.K. (2.4%)" (Internet Commerce Grows 88% by Dollar Volume and 39% by Transaction Volume: Fraud Remains a Concern). Another source that attests to the serious extent of this risk is FraudWatch International (http://www.fraudwatchinternational.com). The identify Theft section to this site is constantly updated with some of the latest information and data and provides a wealth of information on ID theft practices such a phishing as well as possible solutions to these problems.

The process of risk identification

Risk identification is a step in a process which includes asset identification and vulnerability assessments. In the light of the type of threats to information security discussed above, it is obvious that the process of security management would not be possible or effective without the clear identification of the risks posed and the way that these risks effect the particular assets of the company to institution. As one commentary notes;

Asset identification is the first step towards a secure organization. Too many companies are too eager to implement the most expensive technology with strong encryption and state-of-the-art authentication systems, without first thoroughly identifying all their assets. (Security+ TechNotes - Risk Identification)

In other words, the link between risk identification and asset identification is that the company should be very clear about the assets that are at risk in order to implement the most effective counter-measures and security strategies to combat these risks. Risk identification is therefore to a large extent dependent on the evaluation of assets. For example, …a company implements a firewall for their 2 Mbps shared Internet connection, but disregards the backup dial-up connection some distinguished employees have in their office. Also laptops including removable media from remote users, such as frequently traveling sales personnel, are too often 'forgotten' when a formal asset identification is not performed prior to developing the company's security program. (Security+ TechNotes - Risk Identification)

Once the assets are identified, a vulnerability assessment usually follows to determine the most vulnerable areas of security concern. This in turn leads to a threat assessment and to a risk identification. Following the logic of this process, risk identification refers to"…the likeliness of a threat actually leading to an incident" (Security+ TechNotes - Risk Identification).

Risk Identification and its importance

As Frame ( 2003) states, "Risk identification is the first step in the risk assessment process: "Its purpose is to surface risk events as early as possible, thereby reducing or eliminating surprises" (p. 49). The importance of risk identification in the process of security management is mainly to develop a sense of the sources of the security problems and issues. Once the possible impact or effect of the risk to the assets of the company has been established then, "… the risk analysts, working with managers and employees in the enterprise, engage in risk response planning to develop strategies" (Frame, 2003, p. 49). In essence, the important aim and rationale of risk identification is "…to avoid surprises" (Frame, 2003, p. 49).

The importance of the risk identification phase in security management is reiterated in a number of studies. Prybylski, (2008) state that;" Effective risk management is dependent on identification. Many risk stakeholders say, 'It's not the risks that I know about that concern me; it's the ones that we have not identified' " (Prybylski, 2008, p. 56).

The importance of the identification process is also underlined by modern concerns that this process should be 'rethought" and improved in the light of the continuing and developing threat to informstion security.

Institutions must reinvent the process of risk identification. They must eliminate "groupthink" situations in which viewpoints that differ from the majority are dismissed without adequate analysis and be mindful of unfocused debates that can skew the view of risk and create additional, unintended risk exposures. (Prybylski, 2008, p. 56)

The Human Element and Other Problematic Areas

Among the criteria that relates to the topic of risk, certain studies have stressed is the human element as being important in risk identification sand assessment. As Lineberry ( 2007) states: "Few companies properly address the human element of information security " ( p. 44 ) A security consultant, Debra Murphy, also notes that the human element in the identification of risk is often of cardinal importance. "There are times when the human element is the leaky faucet" that spills sensitive information…" (Lineberry, 2007, p. 44).

This also relates to the importance of the e-training gap. E-training refers to the training within the organization that enables staff to identity and deal with possible risks and security threats. As one study on this aspect notes, there is generally a lack of this type of training and that this is a possible internal risk factor that should be taken into account (Lineberry, 2007, p. 45). This applies particularly to risks such as scams and various forms of phishing those results in staff giving out information that may be a security risk. It also applies especially to staff who deal with the public and who are exposed to customer demands. They can easily be taken in by some scam if they do not have the requisite training; for example; "Social engineering scam artists, who use deceptive and manipulative tactics on individuals to gain unauthorized access to information, pounce on that customer-focused mandate" (Lineberry, 2007, p.44).

This issue is an important point of contention in modern analyses of identification risks in the organization. The concern is that too much attention has been given to the technical side of risk identification and that the personal human aspects of risk have to a large extent been ignored. There is according to some expert a "disconnect" between the issue of human error and the more technological aspects of risk identification. " That disconnect, combined with discomfort relating to personal privacy issues, is among the chief reasons that a large percentage of organizations do a poor job managing the human element of information security. "(Lineberry, 2007. P.44)

This important aspect is also discussed by Landoll ( 2005). Landoll in his study entitled Does IT Security Myth the Point? Information Security Programs Often Fail Because They Are Based on Myths and Misconceptions, states that

Technology controls are only part of the solution. Information security, like other aspects of security within the organization, can only be as strong as the weakest protection mechanism. Thus, physical and administrative controls must also be in place. These controls include the identification and protection of critical information assets, the establishment and enforcement of information security policies, and the development and delivery of information security awareness training. An information security program based solely on IT solutions cannot achieve its objective. (Landoll, 2005, p. 110)

Lineberry also notes that "Many critical controls that support information security are non-technical. Observing non-technical controls may reveal much about the strength of an organization's information security" (Lineberry, 2007. P.44). Therefore, the security management policy in any intermediate or large organization should consider the human element as part of the risk identification process. As Lineberry emphasizes;

To foster a culture that is information security aware, company management… should begin by asking the following questions:

* Are employees educated and aware of common information security threats?

* Do they write down or freely share passwords with others?

* Do visitors freely move about facilities without facing barriers to entry, such as a requirement to wear a company-issued badge?

* Is it common to see sensitive information, such as completed employment applications or client documents containing Social Security numbers, accessible in unmonitored or otherwise unsecured areas?

* What is the prevailing employee attitude regarding information security controls? Are enforced information controls viewed primarily as a nuisance or a necessity? (Lineberry, 2007. P.45)

Other areas of concern in the estimation of risk as an integral part of security management include, amongst others, the following issues: the problem of overestimation or underestimation of vulnerabilities and threats as well as complacency and a failure to see the security threat in a connected and holistic way (Minsky).

Conclusion

A common realization in the literature on this topic is that not enough has been done to ensure risk identification and defense in the contemporary information environment. Among the suggestions that have been put forward about improving risk management, the following tend to dominate. The elimination of "groupthink" or exclusive or selective thinking from the risk identification process and the encouragement to include all viewpoints on this issue ( Prybylski, 2008. P.56 ). Prybylski ( 2008) also suggests that security managers should, "Implement multiple views of risk for increased transparency" ( Prybylski, 2008. P.56 ).

Prybylski goes on to clarify this important stance.

Every institution must find better ways to communicate risk across business units. Transparency of risk is a fundamental element of all successful risk programs, but many organizations lost sight of this factor during the run-up to today's credit crisis. By siloing risk within a series of complex risk measurement models, organizations may have created a false sense of precision around risk measures. (Prybylski, 2008. P.56).

In conclusion, the above overview of the place and function of frisk identification in the security management process emphasizes a number of salient points. The first is that risk identification plays a vital role in the security process in a number of ways. Risk identification is in the first instance an essential factor in determining the types of security threats that face a particular organization. However risk identification is also related to the analysis and assesment of value. In other words, these two aspects go together in the assessment of vulnerabilities and are intimately linked to the overall management of risk in the information environment.

What is also clear from the above discussion is that as modern technology advances so the risk and threats become more sophisticated and insidious. Consequently there is a call for a more holistic approach to this issue that will go beyond purely technical considerations and which will possibly include aspects such as more advanced training of personnel.