Difference between revisions of "Security Risk"
From MgmtWiki
(Created page with "==Full Title== For Identity Management this is the measure of the risk created by exposing protected information and access on the web. ==Context== Risk Management consis...") |
(→Context) |
||
| Line 3: | Line 3: | ||
==Context== | ==Context== | ||
| − | Risk Management | + | [[Risk Management]] consists of risk evaluation based on assets that need protection. In any transaction there are at least two points of view, that of each party to the transaction, For identity risk management we will be addressing the POV of the user and of the web site, also known (in the GDPR) as the [[Principal]] and the [[PII Controller]]. |
* [[Threat Model]] provides the core data needed for [[Security Risk]] evaluation. | * [[Threat Model]] provides the core data needed for [[Security Risk]] evaluation. | ||
| − | |||
==Cost== | ==Cost== | ||
Revision as of 08:03, 25 March 2021
Contents
Full Title
For Identity Management this is the measure of the risk created by exposing protected information and access on the web.
Context
Risk Management consists of risk evaluation based on assets that need protection. In any transaction there are at least two points of view, that of each party to the transaction, For identity risk management we will be addressing the POV of the user and of the web site, also known (in the GDPR) as the Principal and the PII Controller.
- Threat Model provides the core data needed for Security Risk evaluation.
Cost
- The Risk is typically measured by the likelihood of a breach times the cost of the breach.
- An alternate measure is to look at similar enterprises and measure the cost of breaches in those simply situations.
- Banking has in many ways the easiest measures as there is a history of losses by a range of categories so a measure of risk is actually fairly easy to gage, at least for old techniques. Even for new techniques the historical data can help to create a risk metric. For example Ross Anderson and his grad students have created an extensive inventory of cybercrime costs.
