Enterprise Risk Management: A Comprehensive Introduction to Managing Cyber Security and Information Security Risks by Bettwy Gwen

Author:Bettwy, Gwen
Language: eng
Format: epub
Publisher: Tactical Security Inc.
Published: 2024-06-02T00:00:00+00:00

Identify Vulnerabilities and Predisposing Conditions

Vulnerabilities and predisposing conditions can influence the extent of the likelihood that a threat event can result in negative impacts. The primary purpose of these assessments is for the team to get a feeling for the extent to which the organization (Level 1), mission or business process (Level 2), and information systems (Level 3) may be vulnerable to the relevant threat sources and events.

Predisposing conditions that exist within organizations, like existing business processes, information systems, and the specific operational environment, can contribute to the likelihood of threat events, underpinned by threat sources, having some form of negative impact on the organization, its mission, and systems. Matching the predisposing conditions to threat events will reduce the extent of potential risks to be assessed.

Sub-activities include:

● Identify vulnerability and predisposing condition inputs.

● Identify vulnerabilities using organization-defined information sources.

● Assess the severity of identified vulnerabilities.

● Identify predisposing conditions.

● Assess the pervasiveness of predisposing conditions.

The NIST SP 800-30 again provides a handy citation in this regard:

● some examples of inputs into the task of identifying vulnerability and predisposing conditions.

● an assessment scale for assessing the severity of identified vulnerabilities.

● a taxonomy for identification and characterization of predisposing conditions.

● an assessment scale for assessing the pervasiveness of predisposing conditions.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.