Information Assurance Process
The information assurance process typically begins with the enumeration and classification of the information assets to be protected. Next, the IA practitioner will perform a risk assessment for those assets. Vulnerabilities in the information assets are determined in order to enumerate the threats capable of exploiting the assets. The assessment then considers both the probability and impact of a threat exploiting a vulnerability in an asset, with impact usually measured in terms of cost to the asset's stakeholders. The sum of the products of the threats' impact and the probability of their occurring is the total risk to the information asset.
With the risk assessment complete, the IA practitioner then develops a risk management plan. This plan proposes countermeasures that involve mitigating, eliminating, accepting, or transferring the risks, and considers prevention, detection, and response to threats. A framework published by a standards organization, such as Risk IT, CobiT, PCI DSS, ISO 17799 or ISO/IEC 27002, may guide development. Countermeasures may include technical tools such as firewalls and anti-virus software, policies and procedures requiring such controls as regular backups and configuration hardening, employee training in security awareness, or organizing personnel into dedicated computer emergency response team (CERT) or computer security incident response team (CSIRT). The cost and benefit of each countermeasure is carefully considered. Thus, the IA practitioner does not seek to eliminate all risks, were that possible, but to manage them in the most cost-effective way.
After the risk management plan is implemented, it is tested and evaluated, often by means of formal audits. The IA process is an iterative one, in that the risk assessment and risk management plan are meant to be periodically revised and improved based on data gathered about their completeness and effectiveness.
Read more about this topic: Information Assurance
Famous quotes containing the words information, assurance and/or process:
“Theories of child development and guidelines for parents are not cast in stone. They are constantly changing and adapting to new information and new pressures. There is no “right” way, just as there are no magic incantations that will always painlessly resolve a child’s problems.”
—Lawrence Kutner (20th century)
“The essence of democracy is its assurance that every human being should so respect himself and should be so respected in his own personality that he should have opportunity equal to that of every other human being to “show what he was meant to become.””
—Anna Garlin Spencer (1851–1931)
“The toddler’s wish to please ... is a powerful aid in helping the child to develop a social awareness and, eventually, a moral conscience. The child’s love for the parent is so strong that it causes him to change his behavior: to refrain from hitting and biting, to share toys with a peer, to become toilet trained. This wish for approval is the parent’s most reliable ally in the process of socializing the child.”
—Alicia F. Lieberman (20th century)