Principals of Information Security, Fourth Edition - ….pptVIP

* Transfer Transfer is the control approach that attempts to shift the risk to other assets, other processes, or other organizations. If an organization does not already have quality security management and administration experience, it should hire individuals or firms that provide such expertise. This allows the organization to transfer the risk associated with the management of these complex systems to another organization with established experience in dealing with those risks. * Mitigation Mitigation is the control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation. This approach includes three types of plans: disaster recovery planning (DRP), business continuity planning (BCP), and incident response planning (IRP). Mitigation begins with the early detection that an attack is in progress. The most common of the mitigation procedures is the disaster recovery plan. The DRP includes the entire spectrum of activities to recover from an incident. The DRP can include strategies to limit losses before and during the disaster. DRPs usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the disaster has ended. The actions an organization can and perhaps should take while the incident is in progress should be defined in a document referred to as the incident response plan or IRP. The IRP provides answers to questions victims might pose in the midst of a disaster. It answers the questions: What do I do NOW?! What should the administrators do first? Who should they contact? What should they document? DRP and IRP planning overlap to a degree. In many regards, the DRP is the subsection of the IRP that covers disastrous events. While some DRP and IRP decisions and actions are the same, their urgency and results can differ dramatically. The DRP focuses more on preparations completed before and actions taken