Risk management: Data organization and impact analysis |
 |
| 30 Aug 2006 | SearchSecurity.com |
|
|
Start the process of implementing insider threat controls in your organization by classifying critical information by
confidentiality, integrity and availability with associated impact ratings. NIST SP 800-60 provides sample information categories and
impact definitions.
| Data Type |
Confidentiality |
Integrity |
Availability |
| Trade
Secrets |
High |
High |
Medium |
| Human
Resources |
High |
Medium |
Low |
| Financial |
High |
High |
Medium |
Now that your data has been defined and classified by CIA
rating, identify system boundaries. Boundaries should include systems, data
flow, networks, people and hard copy printouts.
INSIDER THREAT MANAGEMENT GUIDE
 Introduction: Insider threat management guide
Data organization and impact analysis
Baseline management and control
Implementation of baseline control
Risk management audit
Risk management references
|
|
|
|
