The Pratical Guide to Managing Risk管理风险的实用指南.pdf

The Practical Guide To Managing Risks Table of Contents The Practical Guide to Managing Risks 1 Who Are Your Stakeholders? 2 What Are Your Value Drivers? 4 Managing Risks Throughout the Organization4 Defining Vulnerability and Threat 5 Defining Risk 8 Cost-Benefit Analysis 8 Identifying Assets at Risk 9 Identifying Asset Values and Impacts 9 Residual Risk 10 What Is an Information Security Event?11 Determining Probability of an Event 12 Considering the Impacts of an Event 12 Considering Likelihood and Impact13 Common Risk Reduction Models 14 Basel II 14 COSO 14 ISO Guide 73 15 NIST Special Publication 800-30 15 Prioritizing Risks 15 Be Strategic When Managing Risk 16 Building a Risk Management Roadmap 17 Integrating Information Security Risk Management into the Enterprise18 Using Qualitative and Quantitative Measures 18 Identifying Business Drivers18 Identifying Risk Drivers 19 Establishing Metrics19 Providing Training 19 Providing Continuous Communication19 Using Appropriate Tools19 Integrating Risk Management Into The System Development Life Cycle 19 Phase 1: Proj ect Initiation 20 Phase 2: Development or Acquisition20 i Table of Contents Phase 3: Implementation 20 Phase 4: Operation or Maintenance 20 Phase 5: Disposal 2