Digital Risk Management System
Introduction
Computer risk analysis is a process that includes the identification of computer assets, their vulnerabilities and threats to which they are exposed, as well as their probability of occurrence and their impact, in order to determine the appropriate controls to accept, reduce, transfer or avoid the occurrence of the risk.
Taking into account that the exploitation of a risk would cause damage or financial or administrative losses to a company or organization, there is a need to be able to estimate the magnitude of the impact of the risk to which it is exposed through the application of controls. These controls, to be effective, must be implemented together, forming a security architecture with the purpose of preserving the properties of confidentiality, integrity and availability of the resources that are at risk.
Information security risks must be considered in the context of the business, and the interrelationships with other business functions, such as human resources, development, production, operations, administration, IT, finance, etc. and customers must be identified to achieve a global and complete picture of these risks.
Every organization has a mission. In this digital era, organizations that use technological systems to automate their processes or information must be aware that cyber risk management plays a critical role.
The primary goal of cyber risk management should be to “protect the organization and its ability to manage its mission,” not just the protection of IT assets. Furthermore, the process should not only be treated as a technical function generated by the technology experts who operate and manage the systems, but as an essential management function by the entire organization.
It is important to remember that risk is the negative impact on the exercise of vulnerability, considering the probability and importance of occurrence. So we can broadly say that risk management is the process of identifying, evaluating and making decisions to reduce risk to an acceptable level.
Computer risk analysis is an element that is part of the business continuity management program (Business Continuity Management).
In the analysis of computer risk it is necessary to identify if there are controls that help minimize the probability of occurrence of the vulnerability (controlled risk); if they do not exist, the vulnerability will be an uncontrolled risk.
Within the risk assessment it is necessary to carry out the following actions: