1. Lesson 2
Risk Management
Issues

2. Objective 3
At the end of Lesson 2, you will understand and be able to discuss some of the issues surrounding the use of risk management by organizations.

3. Issue Number One
Risk Management allows us to perform the organization’s mission with a reduced impact of harmful acts caused by others or nature.

4. Risk Analysis is Required
OMB Circular A-130
Requires risk-based approach to determine adequate security
Include major factors in risk management:
value of the system to mission
threats
vulnerabilities
effectiveness of current or proposed safeguards
OMB Cir A-130, Appendix III, Security of Federal Automated Information Systems

5. As Never Before -We Operate in A Changing Environment
political
social
economic
technical

6. Risk Management Takes Time and Money -- and should be worth every second and penny

7. More Effective and Efficient than Risk Avoidance
Risk Management

8. Risk management needs data Data needs analysis Analysis needs synthesis
Need for analysis and synthesis of large volume of complex data
Risk
Assessment
Data
Risk
Assessment 1. 2. 3. 4.

9. Enlightenment Through Risk Management
Better understanding of organization
Acceptance of decisions by workforce
Heightened security awareness
Other benefits

10. Better Understanding of the Organization
Mission
Threats
Vulnerabilities
Security
Countermeasures

11. Better Acceptance of Decisions
Countermeasures

12. Heightened Awareness of Security

13. Other Risk Management Benefits
consistency of assessment process
customer involvement
customer satisfaction
improved security services that are:
really needed
really work
really reduce risk

14. Summary Risk Management Issues
Issues affect how the risk management process is conducted and how effective it is
There are many issues
Many issues are not not obvious