Acknowledgments |
|
xi | |
About the Author |
|
xiii | |
Introduction |
|
xv | |
|
1 The Facilitated Risk Analysis and Assessment Process (FRAAP) |
|
|
1 | (56) |
|
|
1 | (1) |
|
|
2 | (1) |
|
|
3 | (2) |
|
1.4 Introducing the FRAAP |
|
|
5 | (3) |
|
|
6 | (2) |
|
1.5 The Pre-FRAAP Meeting |
|
|
8 | (10) |
|
1.5.1 Pre-FRAAP Meeting Checklist |
|
|
13 | (5) |
|
1.5.2 Pre-FRAAP Meeting Summary |
|
|
18 | (1) |
|
|
18 | (20) |
|
|
18 | (1) |
|
1.6.2 FRAAP Session Introduction |
|
|
19 | (1) |
|
1.6.3 FRAAP Session Talking Points |
|
|
20 | (2) |
|
1.6.4 FRAAP Threats Identification |
|
|
22 | (3) |
|
1.6.5 Identifying Threats Using a Checklist |
|
|
25 | (1) |
|
1.6.6 Identifying Existing Controls |
|
|
26 | (1) |
|
1.6.7 Establishing Risk Levels |
|
|
26 | (4) |
|
|
30 | (8) |
|
1.7 Using a Threats Identification Checklist |
|
|
38 | (9) |
|
1.7.1 FRAAP Session Summary |
|
|
43 | (4) |
|
|
47 | (7) |
|
1.8.1 Complete the Action Plan |
|
|
50 | (4) |
|
|
54 | (3) |
|
2 Risk Analysis (Project Impact Analysis) |
|
|
57 | (10) |
|
|
57 | (1) |
|
2.2 The Difference between Risk Analysis and Risk Assessment |
|
|
57 | (1) |
|
2.3 Risk Analysis and Due Diligence |
|
|
58 | (1) |
|
2.4 Risk Assessment and Fiduciary Duty |
|
|
58 | (1) |
|
2.5 Performing a Risk Analysis |
|
|
59 | (2) |
|
2.6 Risk Analysis Elements |
|
|
61 | (1) |
|
|
62 | (2) |
|
2.8 When to Conduct a Risk Analysis |
|
|
64 | (1) |
|
|
64 | (1) |
|
2.10 Sample Risk Analysis Questionnaire |
|
|
65 | (1) |
|
2.11 Sample Risk Analysis Report Outline |
|
|
65 | (2) |
|
|
67 | (14) |
|
|
67 | (4) |
|
|
71 | (7) |
|
3.2.1 Pre-Screening Example 1 |
|
|
71 | (2) |
|
3.2.2 Pre-Screening Example 2 |
|
|
73 | (2) |
|
3.2.3 Pre-Screening Example 3 |
|
|
75 | (3) |
|
3.2.4 Pre-Screening Example 4 |
|
|
78 | (1) |
|
|
78 | (3) |
|
4 Business Impact Analysis |
|
|
81 | (18) |
|
|
81 | (1) |
|
4.2 BIA versus Risk Assessment |
|
|
82 | (1) |
|
4.3 Creating a BIA Process |
|
|
83 | (1) |
|
4.4 Creating the Financial Impact Table |
|
|
84 | (2) |
|
4.5 Working the BIA Process |
|
|
86 | (2) |
|
|
88 | (5) |
|
4.7 Objectives of the BIA |
|
|
93 | (1) |
|
4.8 Using Questionnaires for a BIA |
|
|
93 | (2) |
|
4.9 Data Collection and Analysis |
|
|
95 | (1) |
|
4.10 Prepare Management Presentation |
|
|
96 | (1) |
|
|
97 | (2) |
|
|
99 | (12) |
|
|
99 | (1) |
|
|
99 | (1) |
|
|
100 | (8) |
|
5.3.1 Gap Analysis Example 1 |
|
|
103 | (3) |
|
5.3.2 Gap Analysis Example 2 |
|
|
106 | (1) |
|
5.3.3 How to Use the Self-Assessment Checklist |
|
|
107 | (1) |
|
|
108 | (3) |
|
Appendix A Facilitator Skills |
|
|
111 | (6) |
|
Appendix B FRAAP Team Members |
|
|
117 | (8) |
|
|
117 | (1) |
|
|
118 | (5) |
|
|
123 | (2) |
|
Appendix C Project Scope Statement |
|
|
125 | (4) |
|
|
125 | (3) |
|
|
128 | (1) |
|
Appendix D Laws, Standards, and Regulations |
|
|
129 | (2) |
|
Appendix E Frequently Asked Questions about Risk Management |
|
|
131 | (6) |
|
|
131 | (1) |
|
Is There a Difference between Risk Analysis and Risk Assessment? |
|
|
131 | (1) |
|
Why Should a Risk Analysis Be Conducted? |
|
|
132 | (1) |
|
When Should a Risk Assessment Be Conducted? |
|
|
132 | (1) |
|
Who Should Conduct the Risk Assessment? |
|
|
133 | (1) |
|
How Long Should a Risk Assessment Take? |
|
|
134 | (1) |
|
What Can a Risk Analysis or Risk Assessment Analyze? |
|
|
134 | (1) |
|
Who Should Review the Results of a Risk Analysis and Risk Assessment? |
|
|
134 | (1) |
|
How Is the Success of the Risk Analysis Measured? |
|
|
135 | (1) |
|
|
135 | (2) |
|
Appendix F Risk Analysis versus Risk Assessment |
|
|
137 | (6) |
|
|
137 | (1) |
|
The Difference between Risk Analysis and Risk Assessment |
|
|
137 | (1) |
|
Risk Analysis and Due Diligence |
|
|
138 | (1) |
|
Risk Assessment and Fiduciary Duty |
|
|
138 | (1) |
|
Conducting a Risk Assessment |
|
|
139 | (1) |
|
Risk Assessment Timetable |
|
|
140 | (1) |
|
Risk Assessment and Risk Analysis Results |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
141 | (2) |
|
Appendix G Sample Threat Checklist |
|
|
143 | (10) |
|
Appendix H Sample BIA Questionnaire |
|
|
153 | (98) |
|
Appendix I Sample Risk Assessment Management Summary Report |
|
|
251 | (8) |
|
Risk Assessment Scope Summary |
|
|
252 | (1) |
|
Assessment Methodology Used |
|
|
252 | (1) |
|
Assessment Findings and Action Plan |
|
|
253 | (1) |
|
Full Findings Documentation |
|
|
254 | (1) |
|
|
254 | (5) |
|
Appendix J Project Scope Statement |
|
|
259 | (6) |
|
|
259 | (1) |
|
|
260 | (1) |
|
|
260 | (2) |
|
Well-Defined Standards and Metrics |
|
|
262 | (1) |
|
|
263 | (2) |
|
Appendix K Why Risk Assessments Fail |
|
|
265 | (4) |
|
|
265 | (1) |
|
|
266 | (1) |
|
Stating Concerns as How They Impact Security |
|
|
266 | (1) |
|
Every Threat Is a Major Concern |
|
|
267 | (1) |
|
|
267 | (2) |
|
Appendix L Gap Analysis Examples |
|
|
269 | (1) |
|
|
269 | (1) |
|
Gap Analysis Using ISO 17799 |
|
|
270 | (1) |
|
Answer the Following Questions |
|
|
270 | (28) |
|
Gap Analysis Using Utility-Specific Standards |
|
|
298 | (46) |
|
Gap Analysis Sample 3 Using Combination of Standards and Laws |
|
|
344 | (55) |
|
|
399 | (1) |
|
|
399 | (24) |
|
|
423 | (8) |
Index |
|
431 | |