Managing Information Risk: A Director's Guide

Information risk is endemic in any modern organisation. From the potential for losing sensitive information to a full-system crash that incapacitates the company, the consequences can be disastrous. Yet more than half of all companies have no formal risk management practices in place, meaning they are unable to be sure their systems are secure, reliable or resilient. This pocket guide addresses the scope of risks involved in a modern IT system, and outlines strategies for working through the process of putting risk management at the heart of your corporate culture. Given that no two companies are the same, this pocket guide should not be taken as a step-by-step guide, but should provide decision makers with a solid overview of the factors they need to consider and a framework for implementing a regime that suits their needs. It provides a checklist of steps that companies need to take to safeguard against various threats, highlights potential vulnerabilities and lists methodologies for mitigating against the risks. This pocket guide draws on previous works by senior security advisory bodies - in particular the US National Institute of Standards and Technology, which has produced numerous landmark 'Special Publications' on the subject, and various UK government guidelines drawn up in the wake of high-profile data breaches. UK governmental and industry white papers were also consulted during research, including interviews with security analysts and board-level risk management practitioners.

Table of Contents:
Introduction 10 Chapter 1: Managing Risk 13 Reduce/Mitigate/Control 14 Transferring risk 15 Avoid 16 Accept 17 Chapter 2: Information Risk Policy 19 Chapter 3: The Risks 21 Accidental disclosure 21 Theft of hardware or data 22 Acts of nature 22 Alteration of software 22 Redundant media 23 System configuration error 23 Suppliers and partners 23 Critical information is wrongly destroyed 24 Poor data input 24 Critical information is lost 24 Wasted assets 24 Failure to make information available 25 Chapter 4: Risk Management Framework 26 Chapter 5: Risk Assessment 30 System characterisation 30 Identify threats 31 Identify vulnerabilities 33 Control analysis 34 Likelihood determination 34 Impact analysis 35 Risk determination 36 Control recommendations 36 Documentation 37 Chapter 6: Risk Mitigation Strategy 38 Seven-stage plan 39 Chapter 7: Controls 42 Chapter 8: Interacting with Partners and Suppliers 44 Chapter 9: Standards 47 Appendix 1: Checklist for Directors 49 Appendix 2: Establishing an Information Risk Tsar 52 Further Reading 53 ITG Resources 55

About the Author :
Stewart Mitchell has been an IT journalist for more than 10 years, working across a number of publications including The Sunday Times and specialist magazines such as PC Pro, Computer Shopper and PC Advisor. He has run his own internet-based business for the last four years and regularly meets with IT business leaders. Recent work has focused on the work of security professionals and the challenges they face in an ever-evolving digital world. Stewart's other best-selling pocket guides for IT Governance include Managing IT in a Downturn and How to Survive a Data Breach.