Security in cyberspace relates to the risk of the likelihood of reputational or financial loss that can be measured from zero to medium to high. There are three factors that lead into security risk in cyberspace, they are:
- What is the threat?
- How vulnerable is the system?
- What is the financial damage that can be done?
Step 1
Imagine that office is under cyber-attack and that the risk associated is to compromise a particular operating system which is very easily reachable as it stores information of high value in it. If there is no security then risk is very high. Having a good IT staff who could warn before to these kinds of vulnerabilities can reduce the risk; even though the stored information of high value is still at risk.
In order to assess the risk involved in security in cyberspace which can be defined as to identify, estimate, and prioritize risk to organizational operations, organizational assets, individuals and other organizations and the nation as a whole as a result of the operations and the use of information systems.
127 our experts are availableright now
Step 2
In the assessment process it involves the information of security risk to bring out whether they are valid or not. The following questions are to be taken into consideration:
- What are the organization’s most important technology assets?
- If there is data breach, what is its impact on the organization? Most important which will have the most and less effect i.e malware, cyber-attack, human error
- What are the relevant threats?
- What are the internal and external vulnerabilities?
- What are the level of risk and the likelihood of exploitation?
We also need to consider the common threats for an organization that are as a result of cyberspace security risk. They are unauthorized access, misuse of information by the workers, data leaks, loss of data and service disruption.
Step 3
After gathering the information that needs to be protected we need to have an information risk management in the process of protecting the business needs. After assessing the threats then we need see how they can have impact on the organization. This helps to know whether the reasons are valid or not. The risk percentage of each clarifies the possibility.
Step 4
Then we need to get hold of the vulnerabilities. It is considered as a weakness that can become easy to exploit to breach security, harm the organization or get away with sensitive data. Their validity can be brought about by audit reports and the National Institute for Standards and Technology and the analysis of software security. They can be removed with the help of proper management but physical vulnerabilities that is someone’s access to the organization computing system can be reduced by having keycard access.
Step 5
Next we need to analyze the controls by limiting or eliminating the risk of a threat or vulnerability. This can only be done through technical techniques which are hardware, encryption, intrusion, detection mechanism, two-factor authentication, auto updates, security policies and physical mechanism like locks or keycard access. In order to do this we need to create controls both preventative and detective controls.
Step 6
Then we need to calculate the probability and impact of various scenarios on yearly basis. The information, threats, vulnerabilities and controls are gathered, then the next stage is to know the probability the security in cyberspace can be risked and their impact if it id distracted. This database can be used to calculate each of the identified cyber risks.
Step 7
Lastly, risk level should be used and determine the actions for senior management or other responsible individuals to alleviate the risk. The general guidelines to follow are:
- High risk- corrective measure to be developed as soon as possible
- Medium- correct measures within a reasonable period of time
- Low- decides to accept the risk or alleviate.
All these details need to be properly documented. With the help off this a risk assessment policy is generated which lets the organization should do time to time to monitor its security posture, how it is managed so as to know the next risk assessment process.
In conclusion, whatever the size of the enterprise information risk management is at the heart if cybersecurity. As the security rules improve and we react to the contents of the on going assessments, the cybersecurity score will be improved.
References
- Guo, W. W. (2019). Research on Cyberspcae Security Testing and Evaluation Technology Development Trend. 2019 International Conference on Communications, Information System and Computer Engineering(CISCE) (pp. 363-367). 1EEE .
- Iyer, R. (2019). The political economy of cyberspcae crime and security. Retrieved from academia.edu: https://s3.amazonaws.com/academia.edu.documents/58634559/The_Political_Economy_of_Cyberspace-_Crime_and_Security.pdf?response-content-disposition=inline%3B%20filename%3DThe_Political_Economy_of_Cyberspace_Crim.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Cr
