IAA Lab4 HuynhMinhHa

1. Was the student able to define the purpose and objectives of an IT risk assessment?
– [20%]
The ultimate purpose of IT risk assessment is to mitigate risks to prevent security incidents and
compliance failures
The primary goal of risk assessment is to identify the steps that must be taken by the organization in
order to adhere to the applicable health and safety legislation and, as a result, reduce the incidence of
occupational injuries and illness. Identification of risks and estimation of potential losses due to those
risks are the goals of risk assessment. These are a few of the goals of risk assessment:
 To provide a framework for the organization to make decisions about how to deal with risks
associated with its activities.
 To ensure that risks are identified, analyzed, and responded to in a consistent manner.
 To communicate the results of the risk assessment process to stakeholders.
 To provide a basis for monitoring and review of the risk management process.
 To ensure that risks are continually reassessed and managed in a proactive manner.
 To provide input into the decision-making process regarding the allocation of resources.
 To support the organization in achieving its objectives.
2. Was the student able to align identified risks, threats, and vulnerabilities to an IT risk assessment
that encompasses the seven domains of a typical IT infrastructure? – [20%]
3. Was the student able to classify identified risks, threats, and vulnerabilities according to a
qualitative risk assessment template? – [20%]
To classify identified risks, threats, and vulnerabilities according to a qualitative risk assessment
template, we using the opinions of experts to determine two primary data points:
• Probability—This is the likelihood that the risk will occur. we can express it in words, such as Low,
Medium, or High. We can also express it in a percentage, such as 10 percent, 50 percent, or 100 percent.
• Impact—This identifies the magnitude of the loss if the risk occurs. We can express it in words, such as
Low, Medium, or High. We can also express it as a number in a range, such as 1 to 10 or 1 to 100.
4. Was the student able to prioritize classified risks, threats, and vulnerabilities according to the
defined qualitative risk assessment scale? – [20%]
We assess risks, threats and vulnerabilities through probability, prioritize the most likely risks, and then
assess the risks to see which risks cause great damage to the organization. From there, offer solutions to
deal with, store information, prioritize important information for backup, and avoid great damage to the
organization.
5. Was the student able to craft an executive summary that addresses the risk assessment findings,
risk assessment impact, and recommendations to remediate areas of non-compliance? – [20%]
After assessing the risk, we collect information related to that risk, the impact of the risk to come up
with countermeasures and submit it to superiors for approval. Risk management receives information,
reviews and implements measures
“1” Critical – a risk, threat, or vulnerability that impacts compliance (i.e., privacy law requirement
for securing privacy data and implementing proper security controls, etc.) and places the
organization in a position of increased liability.
“2”Major – a risk, threat, or vulnerability that impacts the C-I-A of an organization’s intellectual
property assets and IT infrastructure.
“3”Minor – a risk, threat, or vulnerability that can impact user or employee productivity or
availability of the IT infrastructure.
Risk - Threat - Vulnerability Primary Domain Risk

Impacted Impact/Factor
Unauthorized access from pubic Internet Remote Access Domain 1
User destroys data in application and deletes Systems/Application 3
all files Domain
Hacker penetrates your IT infrastructure LAN-to-WAN Domain 1
and gains access to your internal network
Intra-office employee romance gone bad User Domain 3
Fire destroys primary data center Systems/Application 1
Domain
Service provider SLA is not achieved WAN Domain 3
Workstation OS has a known software Workstation Domain 2
vulnerability
Unauthorized access to organization owned Workstation Domain 1
workstations
Loss of production data WAN Domain 3
Denial of service attack on organization LAN-to-WAN Domain 1
DMZ and e-mail server
Remote communications from home office Remote Access Domain 2
LAN server OS has a known software LAN Domain 2
vulnerability
User downloads and clicks on an unknown User Domain 1
Workstation browser has software vulnerability Workstation Domain 3
Mobile employee needs secure browser access Remote Access Domain 3
to sales order entry system
Service provider has a major network outage WAN Domain 2
Weak ingress/egress traffic filtering LAN-to-WAN Domain 3
degrades performance
User inserts CDs and USB hard drives User Domain 2
with personal photos, music, and videos on
organization owned computers
VPN tunneling between remote computer LAN-to-WAN Domain 2
and ingress/egress router is needed
WLAN access points are needed for LAN LAN Domain 3
connectivity within a warehouse
Need to prevent eavesdropping on WLAN LAN Domain 1
due to customer privacy data access
DoS/DDoS attack from the WAN/Internet WAN Domain 1
Lab Assessment Questions

1. What is the goal or objective of an IT risk assessment?
The overall goal or objective of an IT risk assessment is to assist organizations in identifying
risks and impacts/risk factors in each of the seven areas so that optimal solutions can be devised
priority and risk.
2. Why is it difficult to conduct a qualitative risk assessment for an IT infrastructure?

Organizations will perform a quantitative risk assessment to assess the risk impact and risk factor
of identified threats and vulnerabilities, but gathering precise cost factors and Contingent debt is
difficult to determine.
3. What was your rationale in assigning “1” risk impact/ risk factor value of “Critical” for an
identified risk, threat, or vulnerability?
Anything that has the potential to impact an organization's legal compliance and liabilities from
customers for non-compliance is the greatest risk to an organization.
4. When you assembled all of the “1” and “2” and “3” risk impact/risk factor values to the identified
risks, threats, and vulnerabilities, how did you prioritize the “1”, “2”, and “3” risk elements?
What would you say to executive management in regards to your final recommended
prioritization?
Prioritized Impacts/Risk Factors: 1. Compliance 2. Asset C-I-A (intellectual property) 3.
Employee Productivity Ask about appropriate sequencing or prioritization of risk impact/risk
factor and use this as a means of measurement for future assessments. Perhaps this will
eventually become a standard for how future assessments should be conducted.
5. Identify a risk mitigation solution for each of the following risk factors:
User downloads and clicks on an unknown e-mail attachment – Attachments are a significant
security risk associated with email. Effective email attachment filtering and restrictions reduce the
chance of malicious content entering the network.
Workstation OS has a known software vulnerability – Define a workstation operating system
vulnerability window policy definition. Start periodic workstation domain vulnerability tests to find
all vulnerabilities.
Need to prevent eavesdropping on WLAN due to customer privacy data access – Using WLAN keys
requires a password for wireless access. WAP broadcast in turn, requires second level authentication
before granting WLAN access.
Weak ingress/egress traffic filtering degrades performance – Apply data compression and WAN
optimization solutions when accessing remote systems; applications and data. The EnableAccess
Control (ACL) list on the router's WAN interfaces follows the policy.
DoS/DDoS attack from the WAN/Internet – Apply filter on exterior IP stateful firewalls an IP router
WAN interfaces to block TCP SYN and ICMP (ping). Alert your ISP provider to put the proper filters
on its IP router WAN interfaces in accordance with CERT Advisory CA- 1996-21.
Remote access from home office – Apply first- and second-level security for remote access to
sensitive systems, applications, and data.
Production server corrupts database – Perform daily data backup and off-site data archiving for
monthly data storage. Define data recovery procedure based on defined RTO.

IAA Lab4 HuynhMinhHa

Uploaded by

Copyright:

Available Formats

IAA Lab4 HuynhMinhHa

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IAA Lab4 HuynhMinhHa

Uploaded by

Copyright:

Available Formats

1. Was the student able to define the purpose and objectives of an IT risk assessment?

Risk - Threat - Vulnerability Primary Domain Risk

Lab Assessment Questions

2. Why is it difficult to conduct a qualitative risk assessment for an IT infrastructure?

You might also like