Download Risk Management and Data Protection: A Comprehensive Guide for Businesses and more Study notes Security Analysis in PDF only on Docsity!
3 Task 3.1 Procedure for risk management used by EMC Cyber Solutions in order to protect both the company and its customers 3.1.1 Risk Assessment The act of detecting prospective dangers and assessing what could take place in the event that a danger materializes is known as risk assessment. The process of evaluating possible repercussions that might arise as a result of the interruption of time-sensitive or vital business activities is referred to as business impact analysis, abbreviated BIA. (ready.gov, 2021) 3.1.2 Risk Assessment Framework (RAF) A risk assessment framework, often known as an RAF, is a strategy for prioritizing and communicating the many threats to data security that are presented by a company that deals with information technology. The information must to be provided in a manner that both technical and non-technical individuals are able to comprehend in order to be useful. An Organizational Look at the RAF May Help Provide Support in Identifying and Detecting Low- and High-Risk Areas in the System that May Be Vulnerable to Abuse or Attack An company can get assistance from an Organizational Look at the RAF Can Help Provide Assistance in Identify (2017) according to techopedia Frameworks of Different Types for Risk Assessment
- The National Institute of Standards and Technology has published a guide for risk management in information technology systems called the NIST guide.
- Assessment of Operationally Critical Threats, Assets, and Vulnerabilities (OCTAVE) performed by the IT Emergency Preparedness Team.
- Information Systems Audit and Control Association's Control Objectives for Information Technology and Related Information Technology, or COBIT for short. 3.1.3 The five constituents of the RMF When developing a framework for risk management, it is necessary to take into account a minimum of five essential components. Among them are the identifying of risks, the measurement and evaluation of risks, the reduction of risks, the reporting and monitoring of risks, and the management of risks.
- Risk identification The first thing you need to do in order to find out what dangers a firm confronts is to figure out how significant those risks are. A simple enumeration of all the potential dangers constitutes the level of risk. Information technology risk, operational risk, regulatory risk, legal risk, political risk, strategic risk, and credit risk are some examples of other types of risks. After compiling a list of all the potential dangers, the business may next pick the threats to which it is exposed and categorize them as either important or non-essential. The most important risk is the risk that the firm has to face in order to produce results and assure its continued development over the long term. There is often no need to take non-essential risks, and these dangers may usually be mitigated or removed entirely.
- Measuring risk The risk measurement offers details on the frequency of particular exposures or exposures in general, as well as the likelihood of losses brought on by those exposures. When determining an organization's level of vulnerability to a specific risk, it is essential to take into account the effect that risk has on the entire risk profile of the company. While taking some risks might result in several advantages, other risks do not. The capability to accurately assess exposure is yet another significant factor to take into account. It is much simpler to quantify some dangers than others. For the purpose of calculating market risk, for instance, observable market prices may be used; nonetheless, calculating operational risk is often seen as a combination of art and science. The specific risk measure will often have an impact that is predictable on profit and loss ("P/L"), even if there is only a little shift in the level of risk. In addition to this, they are able to provide information on the degree of volatility in the P&L. For instance, the impact of gains and losses on stocks, such as a one- unit shift in the S&P 500 Index or the standard deviation of a single stock, may be used to evaluate the risk associated with investing in stocks. Another way to calculate this risk is to use the volatility of a stock. Value at risk, also known as VaR, return at risk, or EaR, and economic capital are all examples of common comprehensive risk measurements. In addition to these preventative steps, other strategies, such as stress testing and scenario analysis, may also be used.
- The mitigation of danger After the risks have been identified, categorized, and quantified, the organization may choose which risks should be removed or reduced, as well as the number of important risks that should be kept. The
3.1.5 Methods Used in the Risk Assessment Process Core Team Member Obligations and Responsibilities Manager of Projects The tasks that fall within the purview of the project manager might differ from one business to the next. There are occasions when they could even shift in response to the requirements of the project. On the other hand, the majority of the company's project managers are responsible for certain essential tasks. Risk Officer The Risk Officer is responsible for managing all areas of the functions related to enterprise risk management. If you are seeking for a risk manager, many of the highly skilled consultants in our network may begin working in your company within a matter of days, either on-site or remotely, depending on your preference. The following are some of the roles that our Risk Officer has assisted many other businesses with in the past:
- Locate, quantify, control, and report any potential dangers
- Contribute to the formulation of procedures for a more accurate assessment of business risks
- Keep an eye out for significant and essential dangers.
- Carrying out an analysis of risks and regulations to comply with Principal Operating Officer or CEO The Chief Executive Officer (CEO) is accountable for the day-to-day administration of the firm, ensuring that it is run in line with the directives and orders issued by the Board of Directors. The Chief Executive Officer (CEO) is responsible for laying the groundwork for the environment of internal control by providing senior management with direction and guidance, as well as conducting an analysis of the manner in which senior management controls the company. The Chief Executive Officer is accountable
for the risk management process that the organization utilizes, as well as its ongoing development, the distribution of work resources, the examination of risk management policies, and the formulation of operational principles and general procedures. The monthly meeting of the Risk Management Committee is attended by the CEO. It is the responsibility of the chief executive officer, the chief financial officer, the chief financial officer, the department committees, and the department presidents, all of whom work under the direction of the chief executive officer, to manage the risks that could prevent the company from achieving its goals. Project Sponsor The primary duties of a project sponsor are twofold: first, to identify and validate the need for an investment in the project within a strategic domain of the business; and second, to guarantee that the project manager will deliver the anticipated advantages of the endeavor. These objectives are impossible to accomplish without an efficient PRG and competent project risk management. As a result, the sponsor plays an active role in defining the overall risk status of the project portfolio and program group, and it monitors how well risk identification, analysis, and reaction are carried out at the project level. Page 55 The various levels of probability and their explanations Level 1 Low Risk: The information that a company maintains on its clients, employees, and other aspects of its business that is accessible to the public. Level 2 Medium Risk: This level of information generally includes information that is not Personally Identifiable Information (PII), or information that would not harm an organization's customers, employees, or their business. Examples of this level of information include phone numbers, office policies, vendor information, and other similar things. Level 3 High Risk: Sensitive information that is handled or accessed by your company, such as records of customers and employees, personnel files, credit card and debit card numbers and other payment information, financial reports, passwords, personal identification numbers (PIN), and social security numbers, etc.
The completion of successful information technology security audits requires careful preparation that is meticulously managed. You will need to specify not only the roles and duties of the management team and IT system administrators who are tasked with performing audit activities, but also the timeline and the methodology for the process. Determine the tools that will be used by the team for data categorization, reporting, and tracking, as well as any logistical problems that may arise, such as bringing the team offline for review. Before beginning the review, after you have determined on all of the specifics, it is essential that you document and disseminate the strategy in order to guarantee that everyone has a comprehensive comprehension of the procedure.
- Carry out the duties of the audit. Audits need to be carried out by the team working on the project in line with the plans and techniques that were discussed and agreed upon during the planning stage. In most cases, this entails scanning IT resources (such as file sharing services, database servers, and SaaS apps (such as Office 365)) in order to evaluate network security, data access levels, user access rights, and other system settings. In addition, it is advised to carry out a physical check of the data center as part of the review of the disaster recovery plan. This inspection should look for signs of fire, flooding, and power surges. Conduct knowledge tests on staff members who work in departments other than information technology by questioning them throughout the process. Concerns about safety and the fulfillment of the company's safety criteria Policies, in order for any weaknesses in the security processes of your firm to be addressed in the near or distant future. During the course of the audit, you must make sure to note any findings.
- Give an account of the outcomes. Create a formal report out of all audit-related documents so that it may be sent to management stakeholders or regulatory bodies. The report need to comprise a summary of the security dangers and vulnerabilities that were discovered on your system, in addition to the preventative actions that were suggested by the IT staff.
- Proceed with the steps that are required. Lastly, ensure that you are adhering to the criteria that are outlined in the audit report. Some examples of acts that may increase safety include the following:
- Apply the appropriate fixes to particular security flaws or vulnerabilities in line with the remediation processes.
- Employees should get training on safety regulations as well as safety awareness.
- Put in place extra cutting-edge procedures for the management of sensitive data and the detection of indicators of phishing and malware assaults.
- Invest in cutting-edge hardware to improve the efficacy of your current computer systems, and implement routine checks to identify and address any vulnerabilities in your network architecture. (Tierney, 2020) [Footnote]
Different Varieties of IT Security
- Security of the Network The purpose of network security is to prevent users who are not allowed or who are malevolent from accessing your network. This assures that the integrity, usefulness, and dependability of the product are not affected in any way. It is necessary to have this kind of protection in place to prevent a hacker from gaining access to the data that is stored on the network. Additionally, it prohibits them from having a detrimental influence on the ability of your users to access or make use of the network. As businesses move more of their services to the public cloud and increase the number of endpoints in their networks, network security is becoming an increasingly difficult barrier to overcome.
- Security on the Internet Security on the internet encompasses both the protection of information that is transmitted and received in browsers and the protection of networks via the use of online applications. These safeguards are intended to inspect incoming Internet traffic for any signs of malicious software or content that is not wanted. Firewalls, anti-malware software, and spyware protection are all possible forms that this security might take.
- The terminal security post is the very last line of defense, providing protection at the device level. Endpoint security may safeguard a variety of different devices, including mobile phones and tablets, portable and desktop computers, and laptops. Your devices will not be able to get access to dangerous networks thanks to endpoint security, which will protect your company from potential harm. Software that manages devices and provides advanced protection against malware are two examples of endpoint security.
- Cloud Security When apps, data, and identities are moved to the cloud, users connect directly to the Internet and are not secured by a typical security stack. This presents a number of challenges for information security. The use of software as a service (SaaS) and public cloud applications may be protected with the assistance of cloud security. For the purpose of cloud security, several tools such as Cloud Access Security Broker (CASB), Secure Internet Gateway (GIS), and Cloud Unified Threat Management (UTM) may be used.
- Application security Apps are uniquely encrypted at the time of creation due to application security. This ensures that applications are as safe as possible and does not leave them open to the possibility of being attacked. An extra layer of security is added by analyzing the application code and locating any potential flaws that may be present in the program. (cisco, 2021) Page 65- 3.1.7 Organizational Policy
- Makes suggestions on how to make use of information technology in order to keep the organization's operations secure. The degree of security that your company demands must be met by the technology that you make use of. Because of this, the purpose of the IT Security Audit function is to provide assistance to organizations in comprehending how to choose the appropriate security technologies for the firm. Auditors need to be able to determine whether or not it is necessary to centralize security solutions across all devices or employ software that is specifically tailored to each area of risk. Auditor of security systems may also provide advice. If a business is not spending an excessive amount of money on its information technology system, then it will be able to appropriately allocate security devices. They have the ability to stop a company from making an effort to safeguard all of your servers or apps if they believe the amount of risk is not justified.
- Offers an in-depth review of both the internal and external information technology processes and systems. The report on the audit of IT information security comprises a detailed summary of the results of the audit department, complete with an executive report, supporting data, and attachments. Identifies problem areas, offers proposed remedies, and ensures compliance with industry standards and security rules. For instance, one of the sections of the report may include an assessment of the effectiveness of the organization's security audits. Even if a business has safeguards in place to protect sensitive data, such as a firewall deployed on a server, the data might still be compromised if internal controls are inadequate or inaccurate. Keeping a watch on information technology security, where the stakes are high, is another vital necessity for the business of any firm as technology continues to evolve. Auditing a business's system is a tough choice that has to be made for the organization, its partners, and its consumers. This is a realization that comes with it. 3.2 The obligatory data protection regulations and procedures that will be implemented for the data storage solutions offered by EMC Cloud 3.2.1 An Explanation of the Meaning of the Data Protection Act The Data Protection Act is a piece of legislation in the United Kingdom that regulates how personal information may be used and stored. In example, the phrase "data protection law" may apply to a wide variety of distinct laws that are also termed "data protection law." The former version of the DPA is being gradually phased out and gradually replaced, updated, and updated as each new piece of law is adopted. (sumup, 2021) Data Protection Act of 1998, Section 3.2.1.
The Data Protection Act of 1998, sometimes known as the "Law," establishes guidelines for when, how, and why personal information may be obtained, used, and disclosed. Individuals will also have the right to access personal data relating to them, as well as the ability to contest any abuse of such data and seek redress. The Information Commissioner is in charge of carrying out the provisions of this law after it has been passed ("Commissioner"). According to the Act, any person or organization that stores personal information in a computer or in certain manual data systems (or processes such information on a computer) is required to comply with the eight data protection principles and notify the commissioner of the processing that will take place. This obligation is in place to ensure that individuals' and organizations' personal information is safeguarded. It is a criminal offense to fail to provide notification. On the other hand, the Act includes a number of exclusions from the notification obligations for persons and organizations that only use personal data on a limited basis. These exemptions may be found under the definitions of "personal data" and "organization." A self-assessment guide has been produced by the commissioner to assist individuals in determining whether or not notification is necessary. When personal information is misused, people have the right to obtain compensation when they suffer harm, the right to amend or delete erroneous data, and the right to request a commissioner to assess whether or not the organization is in violation of the Act. Data Protection Act (DPA) Principles and Guidelines from 1998 After looking at the differences between the DPA in 1998 and the legislation in 2018, it is important to note that the following seven principles are intended to form the basis for organizations to establish all data protection practices. Having seen these changes, it is important to note that these seven principles are intended to form the basis for all data protection practices. It is the year 2020, and all businesses that handle personal data are required to understand and comply with these principles of data protection, which are becoming more widespread.
- Legal, ethical, and open to public scrutiny This new standard intends to enable users to comprehend the contents of the record while transmitting personal data. In addition to continuing with the data protection standards and principles of legality and fairness, this new standard also strives to continue with the data protection standards. This principle requires organizations to use language that is "clear, clear, and precise" for content that has been agreed upon by stakeholders. This contributes to the protection of legal rights and data rights.
- Utilization restrictions According to this guiding concept, personal information that has been gathered for objectives that have been clearly articulated in the past and cannot be misunderstood shall not be utilized for any other purposes. The General Data Protection Regulation (GDPR) states that this purpose limitation principle does not conflict with processing based on public interest, scientific or statistical purposes, or historical research; however, it limits the scope of an organization's ability to use personal data for "multipurpose" purposes.
The Data Protection Act 2018's Guiding Principles
- Processing that is legal, fair, and open to scrutiny This guideline places an emphasis on maintaining openness about the methods used and the goals of the data collection. In order to comply with the requirements of the GDPR, you are required to identify one of the six acceptable legal grounds for the collection and processing of personal data. During the processing of an order, you are responsible for ensuring that you do not violate any other laws. When dealing with individuals, personal data must be handled fairly, and you must always be honest and transparent regarding the use of their data.
- Goal limitation This concept places an emphasis on the need for businesses to have an obvious comprehension of their processing goals from the very beginning of the process. You are required to have a thorough comprehension of the reasons for the processing, and these reasons have to be documented in accordance with your documentation duties (liability principle). You can no longer gather information that is not essential; you are required to have a purpose. In the event that a new processing purpose presents itself, you are only allowed to use this data if the new purpose is compatible with the original, if you have received consent, or if there is a clear basis in law for doing so.
- Data minimization This concept places an emphasis on the need that businesses reduce the amount of data that they gather. Every piece of information that is gathered need to be doing something particular. This approach was conceived with today's digital world in mind, which is one in which almost every conceivable kind of data may be gathered in some form or another. To ensure they are in compliance with GDPR, enterprises need to save just the barest minimum of the data they use. We have a duty to make certain that the personal information you process:
- Sufficient to enable appropriate accomplishment of the predetermined aim
- Is pertinent: it either links to or refers to the intended destination.
- You have no more than what is required for this reason since you only have what is required of you.
- Processing that is both accurate and quick According to this concept, it is the responsibility of the dispatchers to guarantee that the information they maintain is correct, current, and accurate. Its usage is only sanctioned on the condition that it is kept current and correct at all times. You have an obligation to take all of the practicable precautions to guarantee that the personal information you provide is in no way inaccurate or deceptive. If you discover that any of the personal information you have provided is inaccurate or could lead someone astray, you need to make every effort to correct or delete it as soon as possible.
- Storage constraint This concept places an emphasis on the necessity for organizations to ensure that they do not keep more data than is required. The duration of time that personal data is kept in a format that enables the identification of data subjects is limited to no longer than is required in order to fulfill the objectives that the personal data was collected to achieve. Even if you are able to lawfully gather and utilize information, you are not allowed to store it for any longer than is absolutely necessary. The General Data Protection Regulation does not impose any predetermined time constraints on the various categories of data; this decision is left up to you. However, the retention periods that you select for the various categories of data should be reflected in your data retention policy.
- Honesty and discretion are of the utmost importance (security) The confidentiality, integrity, and availability of data are all safeguarded by this principle, which places specific requirements on companies to do their part to ensure data security. The organizations that are entirely responsible for the collection and processing of data also have the sole responsibility for the data's security, which requires the security measures to be completely appropriate to the kind of data being collected. In order to be compliant, firms need to have stringent data security rules that shield data from any and all risks.
- The idea that one should take responsibility. This principle demonstrates that your company is in compliance with the GDPR and allocates responsibility for GDPR compliance to the organization; you should be liable for the data processing activities that you carry out. Auditing each stage of your GDPR strategy using rules and processes is required in order to guarantee continuing compliance with the regulation. In the event of an inquiry, it is possible to demonstrate that the proper measures were performed, or at the very least, it is possible to demonstrate that the essential actions were taken. These obligations are being fulfilled, but they should be evaluated on a regular basis. (PrivacyHelper, 2021) [privacyhelper] 3.2.2 Act against Unlawful Use of Computers of 1990
bill established the Data Protection Commission as an independent legislative body with the responsibility of enforcing compliance and ensuring that regulations are followed. (data protection,
2012 Personal Data Protection Act Principles and Guidelines The following data protection responsibilities, in connection to an organization's data activities, are imposed on the organization by the PDPA:
- A Legal Obligation to Provide Consent Before collecting, using, or disclosing an individual's personal information for a particular purpose, an organization is required to get that individual's permission (Section 13-17 of the PDPA). An entity is only permitted to collect, use, or disclose personal data for purposes that a reasonable person would consider proper given the conditions under which the data is being collected, used, or disclosed (Section 18 of the PDPA).
- Obligation to Provide Notification At the time of, or prior to, the collection, use, or disclosure of an individual's personal data, an organization is required to provide that individual with notice of the purposes for which it intends to collect, use, or disclose that individual's personal data, and may collect, use, and disclose personal data only for those purposes (Sections 18 and 20 PDPA). Obligation to Access and Correct: The organization is required to, in response to a person's request, provide that person access to and/or the ability to correct any of their personal data that is in their custody or control. A person has the right to request information from the company about how their personal data may have been used or disclosed over the course of the previous year, and the organization is compelled to comply with this request (sections 21 and 22 of the Personal Data Protection Act).
- Dedication to the Accuracy of Results If an organization can use the personal data it collects to make decisions that affect the person concerned, or if it can disclose such personal data to another organization, then the organization is required to make reasonable efforts to ensure that the personal data it collects is accurate and complete. These efforts must be taken. (Article 23 of the PDPA).
- Responsibility to safeguard
An organization has a duty to protect any personally identifiable information in its possession or under its control by implementing reasonable security measures to prevent (a) unauthorized access, collection, use, disclosure, copying, modification, deletion, or other risks of a similar nature, and (b) loss of any medium or device on which personally identifiable information is stored (section 24 of the Personal Data Protection Act). Obligation to Restriction of Retention: As soon as it is reasonable to assume that the storage of such personal data no longer serves a purpose, an entity has an obligation to either stop withholding documents that contain personal data or remove the means by which personal data can be associated with specific individuals. This should take place as soon as it is possible. That it was gathered for, but that it is not required for any longer, either legally or for business purposes (Section 25 of the Personal Data Protection and Human Rights Act).
- Limitation on the Responsibility to Transfer An entity is not allowed to transfer personal data to a country or territory outside of Singapore unless it is required to do so by the Personal Data Protection Act (PDPA) to ensure that the personal data transferred is provided with a protection standard comparable to the standard established by the PDPA (Section 26 of the PDPA)
- Accountability Commitment An organization is required to develop and implement the policies and practices necessary to fulfill your obligations, as well as appoint a PDPA Compliance Officer, also known as a Data Protection Officer (DPO), as well as appoint a Data Protection Officer (DPO). ln compliance with the PDPA, which includes a method for filing complaints. In addition to this, the organization is obligated to inform its staff of these policies and practices and to provide information regarding these policies and practices to anyone who makes a request for it (Sections 11 and 12 of the PDPA).
- Obligation to report data breaches An organization has an obligation to investigate and report any data breaches that have taken place with regard to personal data that is either in its possession or under its control. Furthermore, when certain data breaches (reported data breaches) take place, the organization is required to notify both those affected and the PDPC (Sections 26A - 26E PDPA). (dataguidance, 2021) 3.2.4 Methodology for Risk Management According to ISO 31000 The accomplishment of a company's long-term goals is contingent on a variety of elements, such as the optimization of its operations and the ongoing review and revision of the proposal. When it comes to risk management, they are required to take into account unforeseen circumstances as well, as if that were not enough. Because of this, we decided to establish ISO 31000 as a standard for risk management. In addition to assuring the continuation of company operations, ISO 31000 also gives a degree of trust for the long-term economic viability, professional reputation, environmental performance, and safety of an organization. In a world filled with unpredictability, the international standard ISO 31000 was developed for every business that desires unambiguous direction on risk management. (iso, 2021)
This activity, which was not included in prior definitions of the risk management process, consists of defining the goals of the company, defining the scope of the risk management process, and setting risk assessment criteria. Both internal and external factors, such as the regulatory framework, market circumstances, and the expectations of stakeholders, are considered part of a situation's context (management, culture, organizational norms and rules, opportunities, existing contracts, employee expectations, information systems, etc.).
- Monitoring and Evaluation The purpose of this activity is to determine how successful risk management is by comparing it to a set of indicators, which are then monitored and evaluated on a regular basis to ensure that they continue to be appropriate. It includes checking for deviations from the risk management plan, checking to ensure that the structure, policy, and plan for risk management are appropriate taking into consideration the internal and external context of the organization, reporting risks, and progress in the risk management plan, as well as managing risk and risk management. The degree to which the risk management policy is effective. Monitoring and analysis are being done to determine how effective the risk management system is.
- Communication and consultation Completing this task will assist you in gaining an understanding of the interests and concerns of stakeholders, confirming that the risk management process is concentrating on the appropriate components, and assisting you in explaining the basis for particular risk management decisions and options. The Fundamentals of ISO 31000 The following are some of the fundamental tenets that are required to be validated by risk management:
- Produce value and ensure its preservation
- Is founded on the most reliable available information
- Is an essential component of the operations of the organization
- It may be customized to fit your needs.
- It is a component of the decision-making process
- Observes the ISO 31000 Standards for Risk Management, which take into consideration both human and cultural aspects
- It emphasizes the importance of setting goals before attempting to manage risk and places an emphasis on the role of uncertainty by redefining risk as the effect of uncertainty on an organization's ability to achieve its objectives. • It redefines risk as the effect of uncertainty on an organization's ability to achieve its objectives.
- He presents the idea of an organization's "risk appetite," which may be a contentious subject due to the fact that it refers to the degree of risk that the company is willing to bear in return for the projected benefit.
- Outlines a framework for risk management, including a variety of organizational processes, roles, and duties associated with risk management
- Describes a philosophy of management in which risk management is seen as an essential component of both strategic decision-making and change management.
