W006_S2_2020 (2020_11_17 14_25_03 UTC).pdf - 9/7/20...

9/7/20
1
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
INF30020 ISRS
Information Systems Risk & Security
Workshop 6, 2020
Risk assessment and the TSF Case:
Qualitative Risk Assessment
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
Workshop 6
1. INF30020 announcements and reminders
2. Group assignment available end of this week
3. This week’s workshop is designed to continue your focus on
qualitative risk assessment commenced and individual assignment
work.
4. In the activity you will continue to work with your assignment case
study to consider, apply and evaluate
• The connection between theory and practice in risk assessment
• Best approaches to the description of likelihood and impact
• Based on a consideration of Cloud AND Mobile risks in the
TSF case
2
Qualitative Risk assessment & the TSF Case

9/7/20
2
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
Readings in support of Qualitative Risk Assessment
Unit texts:
1. Gibson, Darril, Chapter 5 Defining Risk Assessment Approaches. Managing
Risk in Information Systems . 2015.
2. Whitman, Michael E. annd Mattord, Herbert J. Chapter 6 Risk Management,
Risk Assessment. Management of information security . Sixth Edition.,
Stamford, Conn. : Cengage Learning, 2019.
Suggestions from additional reading list
1. Schmittling, R. & Munns, A. Performing a Security Risk Assessment, ISACA
Journal, 2010, Volume 1,
-
1/Pages/Performing-a-Security-Risk-Assessment1.aspx
2. Thomas R. Peltier (2004) Risk Analysis and Risk Management, Information
Systems Security, 13:4, 44-56,Swinburne Library link:
px?direct=true&db=a9h&AN=14451647&site=ehost-live&scope=site (Links
to an external site.)Links to an external site.
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
SCIENCE | TECHNOLOGY | INNOVATION | BUSINESS | DESIGN
Case Report Part A: is all about identifying & assessing
Take a step wise approach & use these steps to model your assignment:
You are an external auditor hired by VGB to complete and report on an overall
security risk assessment for the organisation:
ü Propose a target risk appetite and risk tolerance level for the TSF (week 3),
ü Identify the key roles and responsibilities of individuals and departments within
the organization as they pertain to risk assessment (week 4),
ü Carefully audit the case evidence, undertake an inventory and identify