In the last couple of lectures, we saw about the impact, the threat and the vulnerability, and we
also saw a formula that has the outcome of risk.
So now what exactly is risk?
What is information security risk?
Information security risk is associated with the potential that threats will exploit the vulnerabilities
of an information asset or a group of information assets and thereby can cause harm to an organization.
Now, risk is often expressed in terms of the combination of consequences of an event and the likelihood
of their occurrence.
So another important formula here you need to remember is.
So the formula that I want to actually tell you about is that likelihood that is this term.
Multiplied by the consequence that is likelihood, multiplied by consequence gives what we are looking
right now is risk.
So just remember this term l see are l in to see is equal to so likelihood that is occurrence of an
event, how much it can often occur, how often they even can cause damage into the consequence of that
event, which means the impact of that event is equal to the risk an organization will face.
Now uncertainty of information security objectives is very important.
So here is a friend of you in risk severity matrix.
This is the likelihood of the event and this is the consequence.
So if the event is very rare and if the consequence is not enough, it is very insignificant and the
risk is very low.
For example, a low risk example can be my of the vesicular culprit of this would be struck by a meteor.
Now, that likelihood is extremely rare and the risk of the consequence is low because after that I
cannot recover the things.
So the risk is also very low.
Now, if an event is likely to happen, I mean, if it all happened almost daily here and impact is
also moderate, then the risk matrix sees that the risk is high enough.
For example, DOS attack for a corporate office is a very regular.
There are very high risks of having data attacks, but firewalls are placed in order to, you know,
prevent.
So in corporate world, you will always have to deal with the risk severity, mattress matrix and auditors
also have to look after this crisis in order to assume and determine the risk for an organization.
Now, risk the overall risk of overall process of risk identification, risk analysis and risk evaluation
is nothing but risk risk assessment.
Now, what is a residual risk now?
One to eliminate the entire risk of an organization that is some risk that remains after the risk treatment
process and you have to accept that risk.
And that is the residual risk, which means some information, some risk remains throughout the organization.
So the residual risk is the risk remaining after the risk treatment, nor does risk analysis, not the
risk analysis, is the process to comprehend the nature of risk and determine the level of risk.
What is risk assessment?
Risk assessment is the overall procedure of risk identification, risk analysis and risk evaluation.
And what is risk acceptance now?
One.
As I said, the residual risk that remains after the risk treatment process needs to be accepted.
So even though you cannot completely eliminate a threat or risk, some risks needs to be accepted.
So the decision informed to take a particular risk is that is acceptance.
What is the risk evaluation?
This is important.
So risk evaluation is a process of the results process of comparing the results of risk analysis with
the risk criteria to determine whether the risk is magnitude or whether it is tolerable, whether it
can be mitigated or not.
So this is the complete isomers information security, risk management assessment process that in first
you have to identify the risk, then you have to evaluate the risk, then you have to treat the risk.
Now there are these four options of treating risk treatment process, risk response, which we will
be seeing in upcoming sections of risk management.
So identify the vulnerabilities, threats, acid.
Then you evaluate those risk, whether they have any impact on the policies or whether they have impact
on the management standard, then treat the risk that you can avoid the risk, you can mitigate the
risk, you can share the risk with different applications and standards, or you can simply accept the
risk.
So this is the complete information security risk assessment process.
And right now you don't need to remember this.
We are going to see each and every thing in the next section worth of information security, risk management
in that section.
You'll understand this about the risk management for this lecture.
Just make sure that we have learned the definition of information security risk and make sure that you
remember this formula, which I had told you L.C, that is likelihood into the consequence.
That is the impact resulting to the risk.
I will see you in the next lecture.