1.On your local computer, create a new document. You will use this document as your Lab Report.
2. On your local computer, open a new web browser window.
Don't use plagiarized sources. Get Your Custom Essay on
Risk Assessment – IT Infrastructure
Just from $13/Page
3. Using your favorite search engine, search for more information on the Napster case.
4. In your Lab Report le, describe the purpose of IT risk assessment.
5. Review the following table for the risks, threats, and vulnerabilities found in a health care IT infrastructure servicing patients with life-threatening conditions:
|
User inserts CDs and USB hard drives with personal photos, music, and videos on organization-owned computers
|
|
Virtual Private Network (VPN) tunneling between remote computer and ingress/egress router is needed
|
|
Wireless Local Area Network (WLAN) access points are needed for LAN connectivity within a warehouse
|
Need to prevent eavesdropping on WLAN due to customer privacy data access
|
Denial of service (DoS)/distributed denial of service (DDoS) attack from the Wide Area Network (WAN)/Internet
|
Hands-On Steps
6. Review the seven domains of a typical IT infrastructure.
Seven Domains
7. In your Lab Report le, using the table from step 5, identify in the table’s Primary Domain Impacted column which of the seven domains of a typical IT infrastructure will be most impacted by each risk, threat, or vulnerability listed.
assigning one of several labels on a scale In this case the scale is provided for you ranging from Critical to Minor
Qualitative Versus Quantitative
The next step requests that you assign a score to each of the risks in the table from step 6. The scoring is done qualitatively, by assigning one of several labels on a scale. In this case, the scale is provided for you, ranging from Critical to Minor.
Using qualitative scores to assess risks is comparatively easy and quick. The alternative is to assess quantitatively, using actual, numerical scores. Using qualitative words such as “critical” or “major” introduces subjective opinion, while citing numbers such as “Damage to be more than $3 million” or “Will cause an outage of under four hours” introduces quantitative objectivity.
Quantitative scoring is more objective, but calculating risk assessment this way can take much more time. This is because it requires you to dig up hard facts. For instance, you can conduct quantitative scoring by referring to your organization’s history or claims records by answering such questions as “How often has this happened to us, or others?” You can also assess risks numerically by researching the costs to recover from losses.
It is possible to assess risks both quantitatively and qualitatively. For example, you could quantitatively score the likelihood and consequences of each risk, for example, “under 10% chance” and “ ‘X’ number of staff lives harmed or lost.” But you could present the nal score qualitatively, for example, “critical” or “needs to be addressed immediately.”
8. In your Lab Report le, using the table from step 6, perform a qualitative risk assessment by assigning a risk impact/risk factor to each of the identied risks, threats, and vulnerabilities throughout the seven domains of a typical IT infrastructure where the risk, threat, or vulnerability resides. Assign each risk, threat, and vulnerability a priority number in the table’s Risk Impact/Factor column, where:
“1” is Critical: A risk, threat, or vulnerability that impacts compliance (that is, privacy law requirement for securing privacy data and implementing proper security controls, and so on) and places the organization in a position of increased liability.
“2” is Major: A risk, threat, or vulnerability that impacts the condentiality, integrity, and availability (C-I-A) of an organization’s intellectual property assets and IT infrastructure.
“3” is Minor: A risk, threat, or vulnerability that can impact user or employee productivity or availability of the IT infrastructure.
Note: Keep the following in mind when working on the next step: When suggesting next steps to executive management, consider your recommendations from their point of view. Be prepared to explain costs, both in implementing the controls and then in maintaining the controls.
Remember that costs come in many forms, not least of which is labor. Be sure accountability is thought
9. In your Lab Report file, write a four paragraph executive summary according to the following outline:
Paragraph #1: Summary of findings (risks, threats, and vulnerabilities found throughout the seven domains of a typical IT infrastructure).
. Paragraph #2: Approach and prioritization of critical major and minor risk assessment elements
Paragraph #3: Risk assessment and risk impact summary of the seven domains of a typical IT infrastructure.
Paragraph #4: Recommendations and next steps for executive management
