ISO
27000 defines Risk as “effect of uncertainty on objectives†where effect is a
deviation from the expected – positive or negative and Uncertainty is the
state, even partial, of deficiency of information related to understanding or
knowledge of, an event, its consequence or likelihood. Risk is often
characterized by reference to potential events and consequences, or a
combination of. These, Risk are often expressed in terms of a combination of
the consequences of an event including changes in the circumstances and the
associated likelihood of occurrence. In the context of information security
management systems, information security risks can be expressed as effect of
uncertainty on information security objectives. Information security risk is
associated with the potential that threats will exploit vulnerabilities of an
information asset or group of information assets and thereby cause harm to an
organization. Risk is the potential harm that may arise from some current
process or from some future event. Risk is present in every aspect of our lives
and many different disciplines focus on risk as it applies to them. From the IT
security perspective, risk management is the process of understanding and
responding to factors that may lead to a failure in the confidentiality,
integrity or availability of an information system. IT security risk is the
harm to a process or the related information resulting from some purposeful or
accidental event that negatively impacts the process or the related
information. Risk is a function of the likelihood of a given threat-source’s
exercising a particular potential vulnerability, and the resulting impact of
that adverse event on the organization. According to ISO 27001, Threats can be
defined as “potential cause of an unwanted incident which may result in harm to
a system or organizationâ€. It has also be defined as “The potential for a
threat source to accidentally trigger or intentionally exploit a specific
vulnerability.†Threat source can be defined as “Intent and method targeted at
the intentional exploitation of vulnerability a situation and method that may
accidentally trigger vulnerability. ISO 27001 defines Vulnerability as (weakness
of an asset or control that can be exploited by one or more threats).
Vulnerability can also be defined as a flaw or weakness in system security
procedures, design, implementation, or internal controls that could be
accidentally triggered or intentionally exploited and result in a security
breach or a violation of the system’s security policy. Vulnerability can be a
flaw or weakness in any aspect of the system. Vulnerabilities are not merely
flaws in the technical protections provided by the system.
Categories
© 2013 - 2025 . All Rights Reserved.
User questions & answers