Information Security Risk Analysis

Risk is a cost of doing business. The question is, "What are the risks, and what are their costs?" Knowing the vulnerabilities and threats that face your organization's information and systems is the first essential step in risk management. Information Security Risk Analysis shows you how to use cost-effective risk analysis techniques to identify and quantify the threats--both accidental and purposeful--that your organization faces. The book steps you through the qualitative risk analysis process using techniques such as PARA (Practical Application of Risk Analysis) and FRAP (Facilitated Risk Analysis Process) to:oEvaluate tangible and intangible risksoUse the qualitative risk analysis processoIdentify elements that make up a strong Business Impact AnalysisoConduct risk analysis with confidenceManagement looks to you, its information security professional, to provide a process that allows for the systematic review of risk, threats, hazards, and concerns, and to provide cost-effective measures to lower risk to an acceptable level. You can find books that cover risk analysis for financial, environmental, and even software projects, but you will find none that apply risk analysis to information technology and business continuity planning or deal with issues of loss of systems configuration, passwords, information loss, system integrity, CPU cycles, bandwidth, and more. Information Security Risk Analysis shows you how to determine cost effective solutions for your organization's information technology.

Table of Contents:
Effective Risk Analysis Qualitative Risk Analysis Value Analysis Other Qualitative Methods Facilitated Risk Analysis Process (FRAP) Other Uses of Qualitative Risk Analysis Case Study Appendix A: Questionnaire Appendix B: Facilitated Risk Analysis Process Forms Appendix C: Business Impact Analysis Forms Appendix D: Sample of Report Appendix E: Threat Definitions Appendix F: Other Risk Analysis Opinions Index

Review :
"Introduces risk analysis techniques that can be used to identify and quantify both accidental and malicious threats to computer systems within an organization." -Sci Tech Book News, Vol. 25, No. 3, September 2001 "This book has radically influenced my approach to security risk managementFrom the beginning this book grabs your attentionif you purchase this book for the tables and checklists alone you would be getting a bargainIf you perform security risk analysis, or business continuity or disaster recovery planning this book is 'must reading'earns a solid 5 stars and Mr. Peltier earns my gratitude for showing me a better way." --Mike Tarrani, on Amazon.com