Information Assurance Process
The information assurance process typically begins with the enumeration and classification of the information assets to be protected. Next, the IA practitioner will perform a risk assessment for those assets. Vulnerabilities in the information assets are determined in order to enumerate the threats capable of exploiting the assets. The assessment then considers both the probability and impact of a threat exploiting a vulnerability in an asset, with impact usually measured in terms of cost to the asset's stakeholders. The sum of the products of the threats' impact and the probability of their occurring is the total risk to the information asset.
With the risk assessment complete, the IA practitioner then develops a risk management plan. This plan proposes countermeasures that involve mitigating, eliminating, accepting, or transferring the risks, and considers prevention, detection, and response to threats. A framework published by a standards organization, such as Risk IT, CobiT, PCI DSS, ISO 17799 or ISO/IEC 27002, may guide development. Countermeasures may include technical tools such as firewalls and anti-virus software, policies and procedures requiring such controls as regular backups and configuration hardening, employee training in security awareness, or organizing personnel into dedicated computer emergency response team (CERT) or computer security incident response team (CSIRT). The cost and benefit of each countermeasure is carefully considered. Thus, the IA practitioner does not seek to eliminate all risks, were that possible, but to manage them in the most cost-effective way.
After the risk management plan is implemented, it is tested and evaluated, often by means of formal audits. The IA process is an iterative one, in that the risk assessment and risk management plan are meant to be periodically revised and improved based on data gathered about their completeness and effectiveness.
Read more about this topic: Information Assurance
Famous quotes containing the words information, assurance and/or process:
“I am the very pattern of a modern Major-Gineral,
I’ve information vegetable, animal, and mineral;
I know the kings of England, and I quote the fights historical,
From Marathon to Waterloo, in order categorical;”
—Sir William Schwenck Gilbert (1836–1911)
“There is no assurance of the great fact in question [namely, immortality]. All the arguments are mere probabilities, analogies, fancies, whims. We believe, or disbelieve, or are in doubt according to our own make-up—to accidents, to education, to environment. For myself, I do not reach either faith or belief ... that I—the conscious person talking to you—will meet you in the world beyond—you being yourself a conscious person—the same person now reading what I say.”
—Rutherford Birchard Hayes (1822–1893)
“Opinions are formed in a process of open discussion and public debate, and where no opportunity for the forming of opinions exists, there may be moods—moods of the masses and moods of individuals, the latter no less fickle and unreliable than the former—but no opinion.”
—Hannah Arendt (1906–1975)