In an effort to speed delivery and reduce costs associated with the delivery of information services, many organizations short-change the planning and design phases of their information system projects. However, the consequences of adopting such a strategy often result in the delivery of services that do not adequately meet organizational requirements and may well end up increasing lifecycle system costs. The organization certainly leaves itself open to future problems if requirements for information confidentiality, integrity and availability are specified for the original system design.
IT professionals widely recognize that it is much more effective to design security and reliability directly into their systems from the outset than to try and add such capabilities after-the-fact. Consequently, the conduct of a risk assessment is essential in the planning of any major new information system or upgrade of existing capabilities.
A risk assessment essentially consists of:
- Clearly identifying organizational information assets, the data and information systems on which the organization depends
- Understanding vulnerabilities, the susceptibility of the asset to breakdown or malicious attack, associated with identified assets
- Identifying threats, object, person or incident capable of exploiting identified vulnerabilities.
An analysis system risks, that is, the probability of threats being realized, is performed to determine the probabilities of loss. Based on expected losses, the organization is better able to determine which countermeasures or controls are appropriate to its needs.
During the planning stage, organizations need to estimate the consequences of service failure, including how the consequences vary as a function of the duration of service failure, and the various threats capable of exploiting identified vulnerabilities. The participation of organizational management is critical to this process because they should best able to evaluate the consequences of system failure and determine the level of investment warranted to minimize adverse consequences.
IT and and security specialists can be expected to also play an important role by helping organizational managers to understand vulnerabilities, threats, and even probabilities associated with various threats.
As entire books have been dedicated to the subject, we do not attempt to provide a thorough treatment of risk assessments here. However, we do think it useful to include a brief discussion of a few representative issues that are usefully considered during the planning phase of an information system.
Information system planning necessarily focuses on IT solutions to meet identified requirements and minimizing system non-availability. IT solutions might include the purchase of redundant servers, tape backup systems, network firewalls and the like. These technology investments may represent warranted investments and we do not discount such recommendations. However, in considering overall systems availability and security, the physical location of the IT and information assets and the environmental systems on which they depend should also be carefully considered. For example, it is not uncommon to place computer centers in the basements of multi-story buildings, even if those buildings are located in known floodplains. Computers do not tolerate water well, and since water tends to seek the lowest levels within a building, a basement computer facility represent a risk that might be been easily avoided.
Power, air conditioning, external communications links all represent potential points of failure for computer systems. The likelihood of such events must be considered in the selection of information services on which an organization is to depend. In many areas, commercial power and communications are unreliable. Accordingly, managers must consider the probability and length of service outages and include additional investments, e.g., for uninterruptible power supplies capable of conditioning the power and generating backup power if commercial services are disrupted. When planning for the provision of IT-enabled services, organizational managers must realistically appraise the constraints and limitations imposed by the organization's environment.
In short, effective IT planning should incorporate a rigorous assessment of threats and the inclusion of appropriate safeguards and countermeasures within the overall design of proposed information systems.
- 瀏覽次數：1589
