94%(17)16 out of 17 people found this document helpful
This preview shows page 3 - 5 out of 12 pages.
risk assessment personnel to collect useful information about the IT system. On-site visits also allow risk assessment personnel to observe and gather information about the physical, environmental, and operational security of the IT system. Reviewing documents like policy documents, system documentation, and security-related documentation can provide good information about the security controls used by and planned for the IT system. Using an automated scanning tool provides proactive technical methods that can be used to collect system information efficiently (Gary, Goguen, & Feringa, 2002).The second step is threat identification. A threat is the potential for a threat-source to successfully exercise a particular vulnerability. The goal of this step is to identify the potential threat-sources and compile a threat statement listing potential threat-sources that are applicable to the IT system being evaluated. The common threat sources can be natural, human, or environmental. Humans can be threat-sources through intentional acts, such as deliberate attacks by malicious persons or disgruntled employees, or unintentional acts, such as negligence and
BRIEFING PROJECT4errors. A deliberate attack can be either a malicious attempt to gain unauthorized access to an IT system in order to compromise system and data integrity, availability, or confidentiality or a benign, but nonetheless purposeful, attempt to circumvent system security (Gary, Goguen, & Feringa, 2002).The third step is vulnerability identification. The analysis of the threat to an IT system must include an analysis of the vulnerabilities associated with the system environment. The goalof this step is to develop a list of system vulnerabilities (flaws or weaknesses) that could be exploited by the potential threat-sources (Gary, Goguen, & Feringa, 2002).The fourth step is control analysis. The goal of this step is to analyze the controls that have been implemented, or are planned for implementation, by the organization to minimize or eliminate the likelihood (or probability) of a threat’s exercising a system vulnerability. Security controls encompass the use of technical and nontechnical methods. Technical controls are safeguards that are incorporated into computer hardware, software, or firmware. Nontechnical controls are management and operational controls, such as security policies; operational procedures; and personnel, physical, and environmental security. The control categories for both technical and nontechnical control methods can be further classified as either preventive or detective. Preventive controls inhibit attempts to violate security policy and include such controls as access control enforcement, encryption, and authentication. Detective controls warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums (Gary, Goguen, & Feringa, 2002).