The process of recruiting new employees

Job responsibilities refer to the specific work tasks that employees regularly perform.

Job descriptions are not exclusive to the hiring process and they should be maintained throughout the life of the organization.

Screening of candidates for specific positions is based on multiple defined sensitivities and classification levels of the job description.

Background checks include

By reviewing an individual's online information, one can quickly glean an overall picture of an individual's attitude, intelligence, loyalty, common sense, diligence, honesty, respect, consistency, and compliance with social norms and/or corporate culture.

Conduct interviews with qualified job applicants

Onboarding is the process of adding new employees to an organization

New employees will be provided with a computer/network user account

Sign employment agreement

Managers should periodically review or audit each employee's job description, job tasks, privileges, and responsibilities throughout an employee's employment.

For user behavior analytics (UBA)

For user and entity behavior analytics (UEBA)

Information collected by UBA/UEBA monitoring can be used to improve personnel safety policies, procedures, training and related safety oversight programs.

Offboarding is the opposite process to onboarding, which means that after an employee leaves the company, their identity is deleted from the IAM system.

A complete offboarding process may include disabling or deleting user accounts, revoking credentials, revoking access codes, and terminating other specifically granted privileges.

During the termination process, it is important to have a strong relationship between the security department and the human resources (HR) department to maintain control and minimize risk.

Resignation security matters

Fired: Timing is everything

A Service Level Agreement (SLA) is a method of ensuring that an organization providing a service maintains appropriate service levels based on an agreement between the service provider, supplier or contractor, and the customer organization.

SLAs and controls of suppliers, consultants and contractors are an important part of risk reduction and avoidance.

Outsourcing is a term that generally refers to the use of an outside third party, such as a supplier, consultant, or contractor, rather than performing tasks or operations in-house.

Outsourcing can serve as a risk response option, becoming a transfer or assignment of risk.

Vendor Management System (VMS): VMS is a software solution that assists in the management and procurement of staffing services, hardware, software and other required products and services.

Compliance is the act of conforming to or adhering to rules, policies, regulations, standards or requirements

Compliance is an administrative or managerial form of security control

Compliance enforcement refers to sanctions or consequences imposed for failure to adhere to policies, training, best times, or regulations.

Compliance is also a regulatory issue.

Some definitions of privacy

Personally identifiable information (PII)

PII is any data item that can be easily or obviously traced back to the original author or related person.

There are many legal and regulatory compliance issues when it comes to privacy.

Risk management is a detailed process.

The main goal of risk management is to reduce risk to an acceptable level.

Two Elements of Risk Management

A concept related to risk management is risk awareness.

Risks to IT infrastructure are not limited to computers.

assets

Asset Valuation

Threat

Threat Agent/Agent

Threat event

Threat vector

vulnerability

exposure

risk

protective measures (safeguard)

attack

breach

Asset-based or asset-based risk analysis begins with an inventory of all organizational assets.

Once the inventory is completed, each asset needs to be valued.

Methods of Valuing Assets

A fundamental part of risk management is identifying and examining threats.

Create a list of threats as exhaustive as possible for the organization's identified assets.

The threat list should include threat subjects as well as threat events.

When compiling a threat list, be sure to consider threats from various sources.

A detailed and formal list of threat examples, concepts, and classifications NIST SP 800-30 Rev.1

Risk assessment and analysis should be performed by a team, not a single individual.

Risk assessment/analysis is primarily the responsibility of senior management

Senior management is responsible for initiating and supporting risk analysis and assessment by defining the scope and objectives of the work.

Risk is individual, or at least organization-specific, based on its assets, threats, threat agents/threat subjects, and their risk tolerance

risk assessment methods

The goal of risk assessment is to identify risks (based on asset-threat combinations) and prioritize them by importance.

Mixing quantitative and qualitative analysis into an organization's final risk assessment process is called hybrid assessment or hybrid analysis

Qualitative risk analysis methods

Quantitative risk analysis methods

exposure factor (EF)

Single Loss Expectation (SLE)

Annual Rate of Occurrence (ARO)

Annual Loss Expectation (ALE)

Comparison of Quantitative Risk Analysis and Qualitative Risk Analysis (Figure)

risk mitigation

risk assignment

risk deterrence

risk avoidance

risk acceptance

risk rejection

Inherent risks Example: Firefighters are at greater risk of being hit by a fire than ordinary people, career decisions

residual risk

Total Risk Threat * Vulnerability * Asset Price = Total Risk

Control gap Total risk - Control gap = Residual risk

For each asset-threat combination (i.e., identified risk), a list of possible and available protective measures must be compiled.

Factors influencing the annual cost of protective measures (ACS)

Cost/benefit calculation formula for specific protective measures against specific risks for a specific asset

Various formulas related to quantitative risk analysis