In our era, information occupies one of the key positions in all spheres of human life. This is due to the gradual transition of society from the industrial era to the post-industrial. Due to the use, possession and transmission of various information, information risks may arise that can affect the entire economy.
Which industries have the fastest growth?
With each passing year, the growth of information flows becomes more and more noticeable, since the expansion of technical innovations makes it imperative to quickly transfer information related to the adaptation of new technologies. Instantly in our time, industries such as industry, trade, education and finance are developing. It is during data transfer that information risks arise in them.
Information becomes one of the most valuable types of products, the total value of which in the near future will exceed the price of all products of production. This will happen because in order to ensure resource-saving creation of all material goods and services, it is necessary to provide a fundamentally new way of transmitting information, eliminating the possibility of information risks.
Definition
Nowadays, there is no unambiguous definition of information risk. Many experts interpret this term as an event that has a direct impact on various information. This can be a violation of confidentiality, distortion and even deletion. For many, the risk zone is limited only to computer systems, which are emphasized.
Often, when studying this topic, many really important aspects are not considered. These include direct processing of information and information risk management. Indeed, the risks associated with data arise, as a rule, at the stage of receipt, since there is a high probability of incorrect perception and processing of information. Often, due attention is not paid to the risks that cause failures in the data processing algorithms, as well as malfunctions in programs used to optimize management.
Many consider the risks associated with the processing of information solely from an economic perspective. For them, this is primarily a risk associated with the improper implementation and use of information technology. This means that information risk management covers such processes as the creation, transmission, storage and use of information, provided that all kinds of media and communications are used.
Analysis and classification of IT risks
What are the risks associated with receiving, processing and transmitting information? What are their differences? There are several groups of qualitative and quantitative assessment of information risks according to the following criteria:
- according to internal and external sources of occurrence;
- intentionally and unintentionally;
- by direct or indirect form;
- by type of information violation: reliability, relevance, completeness, confidentiality of data, etc .;
- according to the method of exposure, the risks are as follows: force majeure and natural disasters, mistakes of specialists, accidents, etc.
Analysis of information risks is a process of universal assessment of the level of protection of information systems with the determination of the quantity (money resources) and quality (low, medium, high risk) of all kinds of risks. The analysis process can be carried out using all kinds of methods and tools to create ways to protect information. Based on the results of such an analysis, it is possible to determine the highest risks that can be an immediate threat and incentive for the immediate adoption of additional measures that contribute to the protection of information resources.
Methodology for determining IT risks
Currently, there is no generally accepted method that reliably identifies specific risks of information technology. This is due to the fact that there is no adequate amount of statistical data that would allow obtaining more specific information about common risks. An important role is also played by the fact that it is difficult to thoroughly determine the value of a specific information resource, because the manufacturer or owner of the enterprise can accurately determine the cost of information media, but it will be difficult to voice the cost of the information on them. That is why, at the moment, the best option for determining the cost of IT risks is a qualitative assessment, thanks to which various risk factors are accurately identified, as well as the spheres of their influence and the consequences for the entire enterprise are identified.
The CRAMM method used in the UK is most effective for quantifying risks. The main goals of this technique include:
- automation of the risk management process;
- optimization of cash management costs;
- productivity of company security systems;
- the pursuit of business continuity.
Expert Risk Analysis Method
Experts take into account the following information security risk analysis factors:
1. The cost of the resource. This value reflects the value of the information resource as such. There is an assessment system of qualitative risk on a scale where 1 is a minimum, 2 is an average value and 3 is a maximum. If we consider the IT resources of the banking environment, then its automated server will have a value of 3, and a separate information terminal - 1.
2. The degree of vulnerability of the resource. It demonstrates the magnitude of the threat and the likelihood of damage to the IT resource. If we talk about a banking organization, the server of the automated banking system will be as accessible as possible, therefore, the biggest threat to it is hacker attacks. There is also a rating scale from 1 to 3, where 1 is a minor impact, 2 is a high probability of resource recovery, 3 is the need for a complete replacement of the resource after neutralizing the danger.
3. Assessment of the possibility of a threat. It determines the probability of a certain threat to be realized for an information resource in a conditional period of time (most often in a year) and, like the previous factors, can be evaluated on a scale of 1 to 3 (low, medium, high).
Information security risk management in the event of their occurrence
There are the following options for solving problems with emerging risks:
- acceptance of risk and liability for losses incurred by him;
- risk reduction, that is, minimization of losses associated with its occurrence;
- transfer, that is, the cost of damages to the insurance company, or transformation using certain mechanisms into risk with the least danger.
Then the risks of information support are distributed by rank in order to identify the primary ones. To manage such risks, they need to be reduced, and sometimes transferred to an insurance company. It is possible to transfer and reduce high and medium level risks under the same conditions, and lower level risks are often accepted and do not participate in further analysis.
It is worth considering the fact that the ranking of risks in information systems is determined based on the calculation and determination of their qualitative value. That is, if the risk ranking interval is in the range from 1 to 18, then the range of low risks is from 1 to 7, medium is from 8 to 13, and high is from 14 to 18. The essence of enterprise information risk management is to reduce the average and high risks to the lowest value so that their adoption is as optimal and possible as possible.
CORAS Risk Reduction Method
CORAS is part of the Information Society Technologies program. Its meaning lies in the adaptation, concretization and combination of effective methods of analysis using examples of information risks.
The CORAS methodology uses the following risk analysis procedures:
- arrangements for the preparation of a search and systematization of information about the object in question;
- providing the client with objective and correct data on the object in question;
- a full description of the upcoming analysis, taking into account all stages;
- analysis of the submitted documents for authenticity and correctness for a more objective analysis;
- carrying out measures to identify possible risks;
- assessment of all the consequences of emerging information threats;
- identification of risks that may be accepted by the company and risks that need to be reduced or redirected as soon as possible;
- measures to eliminate possible threats.
It is important to note that these measures do not require significant efforts and resources for implementation and subsequent implementation. The CORAS technique is quite simple to use and does not require long training to start using it. The only drawback of this toolkit is the lack of periodicity in the assessment.
OCTAVE Method
The OCTAVE risk assessment method implies a certain degree of involvement of the information owner in the analysis. You need to know that with its help there is a quick assessment of critical threats, identification of assets and identification of weaknesses in the information protection system. OCTAVE provides for the creation of a competent security analysis team that includes company employees and information department employees using the system. OCTAVE consists of three stages:
- First, the organization is assessed, that is, the analysis group determines the criteria for assessing damage, and subsequently the risks. The most important resources of the organization are identified, the general state of the process of maintaining IT security in the company is assessed. The final step is to identify safety requirements and establish a list of risks.
- The second stage is a comprehensive analysis of the company's information infrastructure. The emphasis is on fast and coordinated interaction between the employees and the departments responsible for this infrastructure.
- At the third stage, the development of security tactics is carried out, a plan is created to reduce possible risks and protect information resources. It also assesses the possible damage and probability of the implementation of threats, as well as sets criteria for their assessment.
Matrix Risk Analysis
This analysis method combines threats, vulnerabilities, assets and information security controls, and determines their importance for the organization’s respective assets. Organization assets are tangible and intangible objects that are significant in terms of benefits. It is important to know that the matrix method consists of three parts: a threat matrix, a vulnerability matrix, and a control matrix. For risk analysis, the results of all three parts of this methodology are used.
It is worth considering the relationship of all matrices during the analysis. For example, the vulnerability matrix is a relationship of assets and existing vulnerabilities, the threat matrix is a combination of vulnerabilities and threats, and the control matrix connects concepts such as threats and controls. Each cell of the matrix reflects the ratio of the column and the row element. A high, medium, and low rating system is used.
To create a table, you need to create lists of threats, vulnerabilities, controls and assets. Data is added about the interaction of the contents of the matrix column with the contents of the row. Later, the data of the vulnerability matrix are transferred to the threat matrix, and then, according to the same principle, information from the threat matrix is transferred to the control matrix.
Output
The role of data has increased significantly with the transition of several countries to a market economy system. Without the timely receipt of the necessary information, the normal functioning of the company is simply impossible.
Along with the development of information technology, so-called information risks have arisen, which pose a threat to the activities of companies. That is why they need to be identified, analyzed and evaluated for further reduction, transfer or disposal. The formation and implementation of a security policy will be ineffective if existing rules are not used properly due to incompetence or lack of awareness of employees. It is important to develop a complex to comply with information security.
Risk management is a subjective, complex, but at the same time important stage in the company's activities. The greatest emphasis on the security of their data should be made by a company working with large volumes of information, or owning confidential data.
There are a great many effective methods for calculating and analyzing risks associated with information that allow you to quickly inform the company and allow it to comply with the rules of competitiveness in the market, as well as maintain safety and business continuity.