Risk Analysis

A company conducts a risk analysis to estimate how much money it needs to spend on minimising risk.

Examples

• A large college may invest heavily in their ICT system for administration. The college would have to undertake a risk analysis.
• Many bank customers have online bank accounts. Banks have to undertake a ‘risk analysis’ in order to produce a strategy to protect data.
• A Health Authority could be very dependent on their ICT system for administration. They would undertake a risk analysis to assist them in deciding how to develop, control and minimise the risk to data.

There are a number of factors involved in a risk analysis. These are:-

• Identify potential risks e.g. viruses / fire / natural damage / hacking / systems failure / fraud, etc
• Likelihood of risk occurring - some things such as power cut are inevitable but explosions much less likely - senior managers have to assess the likelihood of each risk occurring and put in the necessary security
• Short and long term consequences of threat - resources (staff, equipment, etc) need to be directed towards recovering the data / may have to pay compensation / financial loss due to loss of business through not being able to sell mortgages, loans, take orders etc. / embarrassment/ prosecution / loss of integrity / bankruptcy / cost of replacing equipment / alternative premises
• How well equipped is the company to deal with the threat (What procedures are in place) - has to be reviewed periodically because of changing needs - disaster recovery programme - backup strategy - cost (how much they are prepared to spend), use of firewalls - use of anti virus
• How much money the college/bank/health authority has - e.g. Most organisations have a corporate information technology security review which looks at the computer processed information with a view to identifying the risks of unavailability, errors and omissions, abuse, unauthorised disclosure and to determining their potential implications. Each risk will need to be examined from the point of view of the security and the loss assessed and its likely occurrence. The aim is to identify those systems crucial to the organisation and to look at the possible consequences of loss of such systems. Organisations will need to look at how well they are equipped to deal with potential threats and how much they are prepared to spend to minimise the risk.

Problem that could arise if steps are not taken to minimise the risk

Staff unaware of who actually is in their building e.g. college (1 mark) this could be very dangerous if there is a fire or looking for an at risk pupil, etc. (2nd mark for more detail)

Strategy to resolve problem

Have a backup system on paper or off site (1 mark) which staff could have emergency access to lookup information. (2nd mark more detail).

Other points: set up a disaster recovery system, employ a RAID system

Hackers getting in – firewalls as prevention.