Prjm 6003 Project Risk Management-Security Assessment Answers

Provide detailed explanation of the diagram and identify the areas of: high, medium, medium-low, and low risk exposure.Carry out comparative analysis of the Deliberate and Accidental Threats and rank those threats in order of importance. Justify your rankings not only on the basis of the case study but also by the means of doing further research and drawing upon other relevant case studies (e.g. Security guidelines for other private and public organizations) that you can identify.

Inside Threats: The inner risks or risks are those risks that can be controlled or moderated by the inward expert of the administration or the association (Willcocks, 2013). These risks can be sub ordered into a few risks. The interior risks of VIC Government are as per the following:

1. a) Malicious Attacks: This type of attack in an aim to take advantage of a framework through social building or PC infections. An inner individual, who knows nearly everything of the arrangement of an association, for the most part does this kind of assault.
2. b) Financial Risk: VIC Government has put away the majority of their data in their data framework. This data is profoundly secret. There can be different potential risks, which are identified with ICT. Any kind of issue can cause real harm of losing monetary information, which can be unsafe to the whole government.
3. c) Employee Security Risk: VIC Government is controlled by different representatives. The data identified with the workers is to a great degree secret. In the event that the data is lost, the legitimacy is lost also. This sort of risk is extremely unsafe for the legislature (Van De Walle, Turoff & Hiltz, 2014). Assurance is imperative for such risks. Worker security risk is in charge of misusing and hurting data of representative in an association.
4. d) Information Security Risk: Information is the most essential asset of any association. Abuse or loss of touchy data can even lead enormous inconvenience. The staffs or representatives of association do this sort of misfortune. Spillage of such data is unlawful and can even prompt jail. This kind of data contains data about the advantages, forms and in addition the specialized data.

Risk Assessment and Management: This is the most imperative framework in any association. The risks are first assessed to discover the level of risk. In view of their presentation, the risks are decreased utilizing different specialized and administrative strategies (Peltier, 2013). The risks are at first perceived and situated on the premise of their harm. There is a particular risk administration group introduce, who are unpredictable in doing a wide range of choices that are identified with the risks and their avoidance and diminishment process.

Identification of areas of risk exposure 

High Risk Exposure: It is obvious that the outer risks are not under the control of the administration. Along these lines, any sort of outside risks falls under the class of high risk presentation. The VIC government can attempt to dodge such risks yet they can't expel such risks. The administration can't track any kind of hacking at first. Any sort of phishing is additionally not under the control of the legislature.

Medium Risk Exposure: The medium risk presentation regions are any kind of money related risk or malevolent assault that can be identified and wiped out in the wake of getting perceived (Peltier, 2016). For instance, assume there is a circumstance, a worker is working in the association, and he has spread a noxious code. In this circumstance, the risk is medium since that wrong information can prompt wrong activity yet after that it can be amended by entering the right information.

Medium Low Risk Exposure: Any sort of unimportant movement can be thought to be a risk of medium low introduction (Kott & Arnold, 2015). These risks can be effectively avoided.

Low risk Exposure: The kind of risk, which happens on account of client produced blunders can be subcategorized under okay presentation. These are the sorts of risks, which don't make issue for the association in a serious way. Their level of irresistible is low.

Comparative analysis of the Deliberate and Accidental Threats

Deliberate Threats: These sorts of risks happen as a result or some likeness thereof of noxious acts. These risks are made deliberately. The demonstration of hacking can be ordered under the demonstration of consider risk. The programmer has a wrong expectation to get to this data in an unapproved way (Bojanc & Jerman-Blazic, 2013). Infections, Trojan stallions, malware these fall under the class of consider risks. Electronic burglary likewise falls under the classification of consider risk. Pernicious programming called malware can make hurt the framework.

Accidental Threats: These sorts of risks happen in view of errors of the workers and staffs. This sort of mistake happens incidentally or by human blunders and is totally accidental. The reason of coincidental risks is the absence of preparing, wrong suspicions and freshness nature of the workers. The workers can evacuate or embed undesired data that prompts issue (Agrawal, Campoe & Pierce, 2014). Every one of these sorts of risks can be effectively amended. These coincidental risks can be ceased with appropriate preparing.

Ranking of threats 

Rank 1: The examples of deliberate threats are Phishing, hacking, malicious software attacks, virus.

Reason for Rank 1: Deliberate threats happen because of unmistakable thought processes to harm the data arrangement of the administration. VIC government will get influenced through any sort of consider assaults and the issue caused can be of serious that won't not be corrected at any cost.

Rank 2: The examples of accidental threats are deletion of important data by mistake, erroneous data entry.

Reason for Rank 2: Accidental threats happen because of the thoughtlessness of the representatives. There is no wrong or particular thought process behind this demonstration. This sort of risk can be alleviated effortlessly after its acknowledgment.

Security or Risk Management Challenges of VIC Government

VIC government will confront different issues in deciding the strategy for controlling the risks and securities, which are confronted by the administration. The risk can be overseen by two ways. They are as per the following:

External Security Management: External experts do this sort of security administration. They have essential thought regarding the instruments and methods of the administration and a few security issues. These advisors can encourage the VIC government to control the risks with progress and therefore decrease the risks (Shedden et al., 2016). There are different confinements in embracing this technique too. The legislature should invest more cash and energy behind the outer advisors. There can be particular issues like misconstruing between the advisors and government. This kind of circumstance prompts more issue. The outer advisors won't not comprehend the issue in points of interest and there can be circumstances where the specialists won't not be reliable.

Internal Security Management: This security administration is the most effortless choice accessible to the legislature. Here the workers of the association will assume the part of guides. There are sure preferences of this administration technique. The workers are the piece of the association and they know point by point data with the goal that the legislature won't need to pay additional time and assets not at all like on account of outer counselors. There are sure impediments of this strategy moreover (Kott & Arnold, 2015). The inside experts can be affected by a few chiefs and get befuddled. This strategy can prompt inward friction of the administration due to various recommendations.

VIC government in having issues in picking their security administration. Be that as it may, an immaculate and legitimate risk administration can help them to tackle their security issues. Outside and inner security administration, both are useful for the legislature.

Difference of Risk and Uncertainty

The primary distinction between the risk and uncertainty is that risk is an impromptu occasion and event of risk may impact the targets of administration. It might either influence the task decidedly or contrarily subsequently risk can both be a positive risk and in addition a negative risk (Fenz et al., 2014). The fundamental target is to limit the negative methodology effect of risks and to boost the positive risk reaction is the odds of happening positive risks. Risks have been distinguished amid the risk recognizing process. The Unknown risks are those risks which can't be recognized amid the risk distinguishing proof procedures.

Absence of sureness is known as the uncertainty. The result of any occasion is said to be totally obscure in uncertainty, and it cannot be speculated or measured in this manner we do not get any foundation data on certain occasion. In uncertainty, one totally does not have the data of the occasion despite the fact that it has been distinguished before (Ghazouani et al., 2014). If there should arise an occurrence of such obscure risks, in spite of the fact that having the data foundation, individuals essentially overlooks it amid the recognize risks process.

The accompanying are a couple of contrasts amongst risk and uncertainty:

• The probability of future result cannot be anticipated while being in uncertainty
• Uncertainty is wild however risk can in any case be overseen
• Uncertainty cannot be measured and evaluated while risk can be
• One can relegate the likelihood of risk occasions yet with uncertainty one cannot

In the considered contextual investigation of VIC government the risk and uncertainty are administration and the part of market approach separately. Risk can be characterized as the circumstance, which has a serious likelihood of risk in up and coming future. Risks are of two sorts, inside and outer risks. The security risks in the VIC government will be considered as critical (Chockalingam et al., 2017). Here the administration knows the odds of the results. Risks are controllable. The administration can deal with the risks. It will not be disposed of but rather it can be limited.

Vulnerability can be effectively characterized as capriciousness. It can characterized as any circumstance where the future happenings are not known. The VIC government would not know the result without bounds occasions and it can prompt risk. Not at all like risk, vulnerability is not under the control of the legislature and it cannot be lessened.

Approaches available to VIC Government for risk control and mitigation 

Risk administration approach can incorporate the arranging of risk, at that point surveying the risk took after by taking care of and observing the risks. VIC government can control and relieve chances in a few ways.

1. a) The VIC government should choose the opportune individuals for the correct sort of occupations keeping in mind the end goal to complete the things effectively. Access to private information must be given to trustable individuals (Qing, Qingsheng & Shaobo, 2016).
2. b) The administration should utilize such individuals who can gain from their past oversights.
3. c) Employees who are working in the legislature must fortify their esteems and morals with a specific end goal to alleviate and control any kind of extortion.
4. d) Effective isolation of errand can limit any risks that are identified with misrepresentation. Errand isolation will help the administration to diminish the risk rate.
5. e) Proper and customary checking of the framework by the specialist must be done to control the risk.
6. f) Risks can be decreased by expelling the few complexities that are available in the business.
7. g) VIC government can alleviate their risks by the procedure of constant learning.

Recognizing the risk is the fundamental assignment and if this progression is completed appropriately then this can prompt legitimate diminishment of risk (Latif et al., 2014).

Examination Approach: In this kind of approach the best option is chosen among the rest.

System Approach: This approach relies upon the kind of methodologies to moderate diverse level of risks.

Examination Approach: This is a sort of approach where an appropriate succession of examinations is done so as to discover the risk and control it.

Conclusion

A successful administration of risk offers ascend to some huge change in operational gainfulness and operational viability. A way to deal with chance administration is required in every area of industry for the better security administration and wellbeing process sooner rather than later. This gives security against information ruptures and cybercrimes event. The utilization of a coordinated risk administration data framework is very critical for the way to deal with security. The risk exposures in potential business are an estimation against the risk that includes huge needs. The Victorian Protective Data Security Standards (VPDSS) grew abnormal state compulsory necessities with the end goal that to secure people in general division information and to give the administration over the spaces like ICT, physical security, work force and data. The standard as examined is strong and henceforth adopts the risk administration strategy enabling the administration business to work wellbeing, security and viability. It additionally empowers the basic leadership of the association and proritiz4e the security exertion.

References

Agrawal, M., Campoe, A., & Pierce, E. (2014). Information security and IT risk management. Wiley Publishing.

Anikin, I. V. (2015, May). Information security risk assessment and management method in computer networks. In Control and Communications (SIBCON), 2015 International Siberian Conference on (pp. 1-5). IEEE.

Ayatollahi, H., & Shagerdi, G. (2017). Information security risk assessment in hospitals. The Open Medical Informatics Journal, 11(1).

Bojanc, R., & Jerman-Blaži?, B. (2013). A quantitative model for information-security risk management. Engineering Management Journal, 25(2), 25-37.

Chockalingam, S., Hadziosmanovic, D., Pieters, W., Teixeira, A., & van Gelder, P. (2017). Integrated Safety and Security Risk Assessment Methods: A Survey of Key Characteristics and Applications. arXiv preprint arXiv:1707.02140.

Fenz, S., Heurix, J., Neubauer, T., & Pechstein, F. (2014). Current challenges in information security risk management. Information Management & Computer Security, 22(5), 410-430.

Galliers, R. D., & Leidner, D. E. (Eds.). (2014). Strategic information management: challenges and strategies in managing information systems. Routledge.

Ghazouani, M., Faris, S., Medromi, H., & Sayouti, A. (2014). Information Security Risk Assessment--A Practical Approach with a Mathematical Formulation of Risk. International Journal of Computer Applications, 103(8).

Kott, A., & Arnold, C. (2015). Towards Approaches to Continuous Assessment of Cyber Risk in Security of Computer Networks. arXiv preprint arXiv:1512.07937.

Kott, A., & Arnold, C. (2015). Towards Approaches to Continuous Assessment of Cyber Risk in Security of Computer Networks. arXiv preprint arXiv:1512.07937.

Latif, R., Abbas, H., Assar, S., & Ali, Q. (2014). Cloud computing risk assessment: a systematic literature review. In Future Information Technology(pp. 285-295). Springer, Berlin, Heidelberg.

Naudet, Y., Mayer, N. and Feltus, C., 2016, August. Towards a Systemic Approach for Information Security Risk Management. In Availability, Reliability and Security (ARES), 2016 11th International Conference on (pp. 177-186). IEEE.

Olson, D. L., & Wu, D. D. (2017). Information Systems Security Risk. In Enterprise Risk Management Models (pp. 145-160). Springer Berlin Heidelberg.

Peltier, T. R. (2013). Information security fundamentals. CRC Press.

Peltier, T. R. (2016). Information Security Policies, Procedures, and Standards: guidelines for effective information security management. CRC Press.

Qing, H., Qingsheng, X., & Shaobo, L. (2016). The model of information security risk assessment based on advanced evidence theory. International Journal of System Assurance Engineering and Management, 1-6.

Shedden, P., Ahmad, A., Smith, W., Tscherning, H., & Scheepers, R. (2016). Asset Identification in Information Security Risk Assessment: A Business Practice Approach. CAIS, 39, 15.

Van De Walle, B., Turoff, M., & Hiltz, S. R. (2014). Information systems for emergency management. Routledge.

Webb, J., Ahmad, A., Maynard, S. B., & Shanks, G. (2014). A situation awareness model for information security risk management. Computers & security, 44, 1-15.

Willcocks, L. (2013). Information management: the evaluation of information systems investments. Springer.