A Risk Analysis for Information Security and Infrastructure Protection

Special Topics in Criminology and Criminal Justice

Columbia Southern University

January 03, 2012

A Risk Analysis for Information Security and Infrastructure Protection

OBJECTIVE

The sole purpose for performing a risk analysis for IT systems is to ensure businesses and or organizations, whether small or large to accomplish its missions by better securing the IT systems that store, process, or transmit organizational information. The primary function of risk analysis is to identify and correct the vulnerabilities and threats of an IT system. It enables management to make well-informed risk management decisions and justify the spending that is part of an IT budget. This also assists management in authorizing or accrediting the IT systems based on the performance results of a risk analysis.

TARGET AUDIENCE

Risk analysis will encompass a basic guide for experienced and inexperienced, technical and non-technical personnel who support or use risk analysis for their IT systems. This will included a detail listing and job description of personnel based on the National Institute of Standards and Technology (NIST) research: Senior management and mission owners make decisions about the IT security budget, and they ensure the implementation of risk management for agency systems and the security provided for the IT systems. The Designated Approving Authority (DAA) is responsible for the final decision on whether to allow operation of an IT system (NIST, 2002). IT security program manager will implement a security program and the Information system security officers (ISSO) will be responsible for IT security. Additionally, IT target audience must include owners and vendors of software and hardware that is used to support IT functions. NIST researchers goes