ITC596 IT Risk Management For VIC Government Assignment

Accidental threats: It is identified that accidental threats are generally defined as one of the risk factor that can occur with proper motive of gain. It is found that accidental threats mainly cause harm to the entire flow of information that creates issue for the development of various types of hindrances for processing the information that are related with the VIC government (Agaku et al., 2014). The accidental threats that is related with the  implementation of information system generally creates loss of information, programming related errors, technical failures as well as other transmission related errors.

Deliberate threats: The deliberate risks are generally defined as one of the risk factor that creates crucial or significant impact on the various operations of the organization. The deliberate threat mainly occurs for providing benefit either to the attackers or for harming the users (Goettelmann et al., 2014). The deliberate threat that are related with the information implementation within the VIC government mainly includes privacy of software, theft and fraud, piracy of software, denial of service as well as transmission related errors.

Internal and external threats: It is identified that apart from the accidental as well as deliberate threats, the risk as well as threats that are associated with the information system implementation within the VIC government, the risk are also divided into categories of external as well as internal risk (Lee & Chang, 2014). The factors of risk that are mainly associated with the development f information system mainly includes number of factors like information loss, transmission errors, unauthorized errors, industrial action, unauthorized software and more. The various types of external factor helps in defining various types of threats as well as risk that mainly creates impact on the external source as well as information system (Harbach et al., 2014). It is identified that this factors mainly creates impact on the operation development for harming the entire flow of operation. The various types of external factors of risk that are associated with the implementation of information system within the VIC government include website intrusion, denial of service, transmission errors and more. All this factors create very much less impact on the information system of the organization. The various types of internal risk associated with the organization include unauthorized software, piracy of software, theft and more.

Risk Exposure Area

It is identified that after proper identification of various types of risk that are associated with the information system it is analyzed that it is very much important to access the impact of risk on various organization. According to Mayer et al., (2014), risk exposure is defined as one of the quantified potential or result that generally causes damage to the organization system. After proper analysis of risk, the probability of impact on the system as well as organization helps in creating proper risk mitigation procedures or plans. For the VIC government, it is identified that the risks are mainly characterized by various exposure of areas that include medium low, low, high and medium.

Analysis of the deliberate and accidental threats

Comparison between deliberate and accidental threats

Risks that are associated with the information system of VIC government are considered inevitable. The various types of security risk that are mainly associated with the VIC government include deliberate as well as accidental risk (Poolsappasit, Dewri & Ray,2012). It is identified that accidental risk within any organization can occur number of times but deliberate risk does not occur very much frequently. Additionally, the accidental risks create various types of potential impact on the VIC government organization. It is found that various types of accidental security related threats are quite difficult to monitor as well as to prevent. It is found that none of the technology or method that generally helps in preventing the accidental risk within the organization. Accidental related risk generally occurs within the system or organization due to lack of proper consciousness of the employees (Sandberg, Amin & Johansson, 2015). A survey is generally conducted within an organization and it is identified that in the past 12 months, the organization is impacted with 14.4 types of incidents per month due to data loss as well as security breach within the organization due to the negligence of staff as well as employees (Rauter et al., 2016).  The spyware as well as various types of malware attacks creates data loss due to negligence of the security related threats that are generally observed within the organization. The various types of accidental related threats with different categories of errors as well as omission can generally occur within the system. It is identified that in an information system, there number of accidental related cases that can cause crashing of the errors.

 It is identified that deliberate threats can be considered as the procedure of willful manipulation as well as destruction of software, hardware as well as information. The threats that are associated with various types of information security generally arises when any person harm the entire system of the organization with the motivation of creating number of risks. It is identified that various types of deliberate risk generally arises due to both type of external as well as internal sources (Sillaber & Breu, 2015). As the IT management of the organization mainly search for the deliberate risk that are quite easier to monitor as well as locate unlike various types of accidental risks.

Ranking and justification of Threats

 Deliberate Risk (First ranked):  Instead of the frequency of occurrence of various types of accidental risk, it is identified that deliberate risk are viewed as first arranged by significance. The deliberate risks are caused in s framework with the expectation of hurting and giving misfortune to the framework (Von & Van, 2013). The think dangers make major monetary misfortune an association. It is guaranteed that they consider hazards in a framework can possibly affect general society picture and certainty of the association (Wang et al., 2013). Unlawful liabilities and administration understanding break are the significant dangers related with the consider dangers. For instance, the DoS (Denial of Service) totally keep the approved client to get to the assets, frameworks, and system. The DoS assaults do not specifically bring about loss of information however, the unsettling influence in the administrations for a timeframe brings about a colossal money related misfortune.

Accidental risk (Ranked second): The accidental risk, regardless of being the most continuous event of security dangers are positioned second in pertinence to significance. Accidental risk generally happens because of the numbness or losses of the representatives. The accidental risk are not caused with the unimportant expectation of hurting the association, subsequently, can be decreased and constrained by giving preparing and affirmation of the representatives (Soomro & Ahmed, 2012). For instance, inside an association, the PC framework logged and kept unattained by an approved client can be utilized by an unapproved client that outcomes in information robbery and misuse of data. Aside from that, correspondence benefit disappointment in an association brought about constrained access to data and other information inside the framework.

Challenges faced by VIC government

Risk in the VIC Government is distinguished and judged upon the significance. Keeping in mind the end goal to moderate and wipe out the dangers related with the data should be gotten to and disposed of for shielding the Government from potential misfortune (Soomro, and Ahmed, 2012). The VIC government needs to choose whether to outsource or complete the dangers administration in the association. VIC is a Governmental association that arrangements with the improvement of the different lawful help to the client. With a specific end goal to do the dangers administration and relief process in-place of the VIC, the Government needs to utilize a particular IT group for recognizable proof, checking, evaluate and alleviation of the dangers from the data framework (Sawik, 2013).  As a Governmental Institute, the VIC does not have the IT bolster from inner administration. Notwithstanding that, the advancement of the in-house data security organizations framework builds the money related asset for the execution of the "Hazard administration framework," consumption of equipment and dealing with the framework (Wang et al., 2014). Aside from that, the in-house advancement of the security administration essentially expands the workload among the inside representatives with correspondence to the recuperating economy. Notwithstanding that, expanding the cost weight in the association mirrors the outer and inside help for keeping up the hazard in the VIC.

 Jaferian et al., (2014) illustrated that amid the in-house, issues happen when some key work force are nonappearance or left the association. Besides, the nonattendance and loss of work force in the VIC world make a disappointment of security framework and questionable occasions that have a probability of loss of data, process disappointment, and even monetary misfortune (Loske et al., 2014).  In spite of the fact that because of the outsourcing the hazard administration technique at VIC, there is potential hazard that VIC Government needs to consider.

Difference between Uncertainty and risk

Poolsappasit, Dewri, and Ray, (2012) represented dangers and vulnerability concerning the firmly related ideas of web security. For characterizing the dangers in the data framework, dangers are characterized as dangers that are unmistakable in nature and can possibly capital misfortune and disability. The hazard in an association hampers the stream of method and results in the enormous loss of budgetary speculation.On the other hnad, Sawik, (2013) delineated that the dangers are seen with the figuring of the watched recurrence of event. In the data arrangement of the NSW Government, the dangers are acquired and figured in light of the probabilities of the event. In significance to that, the Denial of Service dangers in the data framework is a watched chance that causes lasting monetary misfortune

The vulnerabilities in the data framework happen with different obscure factors. Almorsy, Grundy, and Ibrahim, (2013) clarified vulnerabilities as non-qualifiable occasions that are predictable later on. The vulnerabilities in the data framework might possibly bring about the budgetary loss of the association. Wang et al., (2013) asserted that the vulnerabilities could not be anticipated in context to likelihood of event inside the framework. The irregular event of occasions with negative effect on the association or the data framework is known as vulnerabilities.

Risk Control and Mitigation

The risk mitigation and control strategies include:

Risk assessment phase:  It is identified that management of various types of risk within the VIC government generally needs various types of efficient identification as well as risk management procedure that must be incorporated for minimizing the potential related risk within the information system.

Risk Control phase: After proper identification as well as assessment of potential risk, the risk that are related with the management team of the organization must develop proper plan that assists in eliminating as well as mitigating various types of risk (Ray et al., 2012). The various types o significant objective related with the control phase helps in eliminating as well as reducing the risk.

References

Agaku, I. T., Adisa, A. O., Ayo-Yusuf, O. A., & Connolly, G. N. (2014). Concern about security and privacy, and perceived control over collection and use of health information are related to withholding of health information from healthcare providers. Journal of the American Medical Informatics Association, 21(2), 374-378.

Almorsy, M., Grundy, J., & Ibrahim, A. S. (2013, May). Automated software architecture security risk analysis using formalized signatures. In Proceedings of the 2013 International Conference on Software Engineering(pp. 662-671). IEEE Press.

Feng, N., & Zheng, C. (2014). A cooperative model for IS security risk management in distributed environment. The Scientific World Journal, 2014.

Fenz, S., Heurix, J., Neubauer, T., & Pechstein, F. (2014). Current challenges in information security risk management. Information Management & Computer Security, 22(5), 410-430.

Fruth, J., & Nett, E. (2014, September). Uniform approach of risk communication in distributed IT environments combining safety and security aspects. In International Conference on Computer Safety, Reliability, and Security (pp. 289-300). Springer International Publishing.

Goettelmann, E., Dahman, K., Gateau, B., Dubois, E., & Godart, C. (2014, June). A security risk assessment model for business process deployment in the cloud. In Services Computing (SCC), 2014 IEEE International Conference on (pp. 307-314). IEEE.

Harbach, M., Hettig, M., Weber, S., & Smith, M. (2014, April). Using personal examples to improve risk communication for security & privacy decisions. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2647-2656). ACM.

Jaferian, P., Hawkey, K., Sotirakopoulos, A., Velez-Rojas, M., & Beznosov, K. (2014). Heuristics for evaluating IT security management tools. Human–Computer Interaction, 29(4), 311-350.

Lee, Z. J., & Chang, L. Y. (2014). Apply fuzzy decision tree to information security risk assessment. International Journal of Fuzzy Systems, 16(2), 265-269.

Mayer, N., Grandry, E., Feltus, C., & Goettelmann, E. (2015, June). Towards the ENTRI Framework: Security Risk Management enhanced by the use of Enterprise Architectures. In International Conference on Advanced Information Systems Engineering (pp. 459-469). Springer International Publishing.

Poolsappasit, N., Dewri, R., & Ray, I. (2012). Dynamic security risk management using Bayesian attack graphs. IEEE Transactions on Dependable and Secure Computing, 9(1), 61-74.

Rauter, T., Höller, A., Kajtazovic, N., & Kreiner, C. (2016). Asset-Centric Security Risk Assessment of Software Components. In 2nd International Workshop on MILS: Architecture and Assurance for Secure Systems.

Ray, P. D., Reed, C., Gray, J., Agarwal, A., & Seth, S. (2012). Improving roi on big data through formal security and efficiency risk management for interoperating ot and it systems. In Grid-Interop Forum.

Sandberg, H., Amin, S., & Johansson, K. H. (2015). Cyberphysical security in networked control systems: An introduction to the issue. IEEE Control Systems, 35(1), 20-23.

Sawik, T. (2013). Selection of optimal countermeasure portfolio in IT security planning. Decision Support Systems, 55(1), 156-164.

Sillaber, C., & Breu, R. (2015). Using Business Process Model Awareness to improve Stakeholder Participation in Information Systems Security Risk Management Processes. In Wirtschaftsinformatik (pp. 1177-1190).

Soomro, I., & Ahmed, N. (2012, September). Towards security risk-oriented misuse cases. In International Conference on Business Process Management (pp. 689-700). Springer Berlin Heidelberg.

Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security. computers & security, 38, 97-102.

Wang, L., Jajodia, S., Singhal, A., Cheng, P., & Noel, S. (2014). k-zero day safety: A network security metric for measuring the risk of unknown vulnerabilities. IEEE Transactions on Dependable and Secure Computing, 11(1), 30-44.

Wang, Y., Zheng, J., Sun, C., & Mukkamala, S. (2013, July). Quantitative security risk assessment of android permissions and applications. In IFIP Annual Conference on Data and Applications Security and Privacy (pp. 226-241). Springer Berlin Heidelberg.