Access your Pro+ Content below.
The real information security risk equation
This article is part of the May 2010 issue of Information Security magazine
Risk management is a fundamental requirement of information security. Without it, the safety of the information or system cannot be assured. In information security, risk is a variable that must be understood in order to best create cost-effective solutions to minimize negative risks with minimal impact to usability and cost. Risks are often uncertain, misunderstood, and can change based on circumstances. Risk management provides a way for you to understand and handle risks that are optimal for security, IT, and the business. It creates a common language to identify, assess, and understand potential threats and vulnerabilities while identifying means for mitigating, accepting, or avoiding the risk. However, one of the reasons we have difficulty in translating risks to our users is that many security practitioners maintain an unrealistic view of risk because we use an overly complex risk equation. It typically contains variables for threats, vulnerabilities, and mitigation. This isn't how people naturally think. Security guru ...
Access this Pro+ Content for Free!
Features in this issue
Database activity monitoring can help with security and compliance by tracking everything going on in the database.
Microsoft Windows 7 security aims to improve security without the headaches of Vista.
OWASP Top 10 vulnerabilities list adds risk to methodology used to categorize coding errors.
Criminals are using the Zeus banking Trojan and other malware to hijack online business banking accounts.
Columns in this issue
Having a long-term goal for a career in information security isn't enough. Here are four key steps for planning for a career in information security.
A simplified information security risk equation helps translate information security risk to users.
The Rockefeller-Snowe cybersecurity bill has potential but raises a lot of questions.