Analysis of Threats & Risks

AI Summary

An AI-generated summary of this video lecture.

This lecture segment focuses on the analysis of threats and risks within information security systems. It begins by defining the relationship between security and risk, stating that security measures must be commensurate with the risk involved. The core of threat and risk assessment is broken down into three steps: identifying applicable threats, recognizing vulnerabilities, and calculating probable loss. The instructor contrasts historical centralized computing systems with modern, dispersed infrastructure, highlighting the increased complexity of managing security today. The lecture then transitions to the importance of a written security policy, detailing key components such as authentication, authorization, information integrity, and detection. Finally, it introduces risk assessment and management, defining it as a proactive process to mitigate monetary losses and reputational harm, distinguishing between quantitative and qualitative approaches.

Chapters

1. 0:00 – 2:00 00:00-02:00

   The video opens with the section title '12.5.1 Analysis of Threats and Risks'. The on-screen text states, 'The security of any system should be commensurate with the risk involved.' The instructor explains that threat and risk assessment involves three main activities: identification of applicable threats to IS infrastructure, recognition of vulnerability, and probable loss calculation. The text emphasizes the necessity of identifying the source of the threat. It provides historical context, noting that organization computer systems were historically centrally located, and management of issues was the responsibility of computer center staff. Security issues were also the responsibility of this staff, whose focus was to make applications available on the centrally located computer as required.

2. 2:00 – 5:00 02:00-05:00

   The instructor begins annotating the text, writing 'Threats -> Risk -> Secure' to illustrate the flow of security thinking. She writes 'Analysis' next to the title. The text contrasts the historical centralized model with today's computing infrastructure, which is described as 'far more diverse and complex to manage' with dispersed business information. A diagram labeled 'Figure 12.1: Information Security Architecture' is shown, featuring boxes for 'Recovery, Strategy, System modification and Legal action' and 'Reserve Measures'. The instructor writes 'Facebook -> High Risk -> Security' as an example of risk assessment. She also writes 'Tools' and 'Recovery' near the diagram, indicating practical applications of these concepts.

3. 5:00 – 10:00 05:00-10:00

   The instructor writes out the three steps of assessment: '1 Identify of Threats -> 2 Recognize Vulnerabilities -> 3 Probable loss'. The text discusses that the source of threats can be either external or internal, noting that historically viruses have been a major potential external security threat. However, with diversification of activity over multiple locations, it is difficult to perceive when an unauthorized intruder may try to hack. The lecture introduces 'Security policy', stating organizations must possess a security policy in writing. It lists four issues to address: Authentication (to see that the person is a bona fide user), Authorization (privileges of the user or who can do what), Information integrity (is it possible that the end user can modify the information), and Detection (once the problem is identified, how it is handled). The instructor writes 'Financial loss, Reputation, Legal issue' next to a question about loss analysis.

4. 10:00 – 12:03 10:00-12:03

   The final section covers 'Risk Assessment and Management'. The text defines a thorough and proactive risk assessment as the first step in establishing a sound security system. It is described as an ongoing process of evaluating threats and vulnerabilities, and establishing an appropriate risk management program to mitigate potential monetary losses and harm to an institution's reputation. The text clarifies that threats have the potential to harm an institution, while vulnerabilities are weaknesses that can be exploited. It concludes by stating that while there are different approaches followed by organizations to analyze risks, ultimately all methods boil down to two types of approaches: quantitative and qualitative.

The lecture progresses logically from defining the fundamental relationship between security and risk to practical assessment methodologies. It starts by establishing that security must match the risk level, breaking down assessment into identifying threats, recognizing vulnerabilities, and calculating loss. The instructor uses annotations to visualize these concepts, such as the 'Threats -> Risk -> Secure' flow and the 'Information Security Architecture' diagram. The discussion then shifts to the evolution of infrastructure from centralized to dispersed, necessitating more complex management. This leads into the formulation of a security policy, which must address authentication, authorization, integrity, and detection. Finally, the lecture introduces risk management as a proactive, ongoing process, categorizing analysis methods into quantitative and qualitative approaches to mitigate both monetary and reputational harm.