| Acknowledgments |
|
xi | |
| About the Author |
|
xiii | |
| Introduction |
|
xv | |
| 1 The Facilitated Risk Analysis and Assessment Process (FRAAP) |
|
1 | |
|
|
|
1 | |
|
|
|
2 | |
|
|
|
3 | |
|
1.4 Introducing the FRAAP |
|
|
5 | |
|
|
|
6 | |
|
1.5 The Pre-FRAAP Meeting |
|
|
8 | |
|
1.5.1 Pre-FRAAP Meeting Checklist |
|
|
13 | |
|
1.5.2 Pre-FRAAP Meeting Summary |
|
|
18 | |
|
|
|
18 | |
|
|
|
18 | |
|
1.6.2 FRAAP Session Introduction |
|
|
19 | |
|
1.6.3 FRAAP Session Talking Points |
|
|
20 | |
|
1.6.4 FRAAP Threats Identification |
|
|
22 | |
|
1.6.5 Identifying Threats Using a Checklist |
|
|
25 | |
|
1.6.6 Identifying Existing Controls |
|
|
26 | |
|
1.6.7 Establishing Risk Levels |
|
|
26 | |
|
|
|
30 | |
|
1.7 Using a Threats Identification Checklist |
|
|
38 | |
|
1.7.1 FRAAP Session Summary |
|
|
43 | |
|
|
|
47 | |
|
1.8.1 Complete the Action Plan |
|
|
50 | |
|
|
|
54 | |
| 2 Risk Analysis (Project Impact Analysis) |
|
57 | |
|
|
|
57 | |
|
2.2 The Difference between Risk Analysis and Risk Assessment |
|
|
57 | |
|
2.3 Risk Analysis and Due Diligence |
|
|
58 | |
|
2.4 Risk Assessment and Fiduciary Duty |
|
|
58 | |
|
2.5 Performing a Risk Analysis |
|
|
59 | |
|
2.6 Risk Analysis Elements |
|
|
61 | |
|
|
|
62 | |
|
2.8 When to Conduct a Risk Analysis |
|
|
64 | |
|
|
|
64 | |
|
2.10 Sample Risk Analysis Questionnaire |
|
|
65 | |
|
2.11 Sample Risk Analysis Report Outline |
|
|
65 | |
| 3 Pre-Screening |
|
67 | |
|
|
|
67 | |
|
|
|
71 | |
|
3.2.1 Pre-Screening Example 1 |
|
|
71 | |
|
3.2.2 Pre-Screening Example 2 |
|
|
73 | |
|
3.2.3 Pre-Screening Example 3 |
|
|
75 | |
|
3.2.4 Pre-Screening Example 4 |
|
|
78 | |
|
|
|
78 | |
| 4 Business Impact Analysis |
|
81 | |
|
|
|
81 | |
|
4.2 BIA versus Risk Assessment |
|
|
82 | |
|
4.3 Creating a BIA Process |
|
|
83 | |
|
4.4 Creating the Financial Impact Table |
|
|
84 | |
|
4.5 Working the BIA Process |
|
|
86 | |
|
|
|
88 | |
|
4.7 Objectives of the BIA |
|
|
93 | |
|
4.8 Using Questionnaires for a BIA |
|
|
93 | |
|
4.9 Data Collection and Analysis |
|
|
95 | |
|
4.10 Prepare Management Presentation |
|
|
96 | |
|
|
|
97 | |
| 5 Gap Analysis |
|
99 | |
|
|
|
99 | |
|
|
|
99 | |
|
|
|
100 | |
|
5.3.1 Gap Analysis Example 1 |
|
|
103 | |
|
5.3.2 Gap Analysis Example 2 |
|
|
106 | |
|
5.3.3 How to Use the Self-Assessment Checklist |
|
|
107 | |
|
|
|
108 | |
| Appendix A Facilitator Skills |
|
111 | |
| Appendix B FRAAP Team Members |
|
117 | |
|
|
|
117 | |
|
|
|
118 | |
|
|
|
123 | |
| Appendix C Project Scope Statement |
|
125 | |
|
|
|
125 | |
|
|
|
128 | |
| Appendix D Laws, Standards, and Regulations |
|
129 | |
| Appendix E Frequently Asked Questions about Risk Management |
|
131 | |
|
|
|
131 | |
|
Is There a Difference between Risk Analysis and Risk Assessment? |
|
|
131 | |
|
Why Should a Risk Analysis Be Conducted? |
|
|
132 | |
|
When Should a Risk Assessment Be Conducted? |
|
|
132 | |
|
Who Should Conduct the Risk Assessment? |
|
|
133 | |
|
How Long Should a Risk Assessment Take? |
|
|
134 | |
|
What Can a Risk Analysis or Risk Assessment Analyze? |
|
|
134 | |
|
Who Should Review the Results of a Risk Analysis and Risk Assessment? |
|
|
134 | |
|
How Is the Success of the Risk Analysis Measured? |
|
|
135 | |
|
|
|
135 | |
| Appendix F Risk Analysis versus Risk Assessment |
|
137 | |
|
|
|
137 | |
|
The Difference between Risk Analysis and Risk Assessment |
|
|
137 | |
|
Risk Analysis and Due Diligence |
|
|
138 | |
|
Risk Assessment and Fiduciary Duty |
|
|
138 | |
|
Conducting a Risk Assessment |
|
|
139 | |
|
Risk Assessment Timetable |
|
|
140 | |
|
Risk Assessment and Risk Analysis Results |
|
|
140 | |
|
|
|
140 | |
|
|
|
141 | |
| Appendix G Sample Threat Checklist |
|
143 | |
| Appendix H Sample BIA Questionnaire |
|
153 | |
| Appendix I Sample Risk Assessment Management Summary Report |
|
251 | |
|
Risk Assessment Scope Summary |
|
|
252 | |
|
Assessment Methodology Used |
|
|
252 | |
|
Assessment Findings and Action Plan |
|
|
253 | |
|
Full Findings Documentation |
|
|
254 | |
|
|
|
254 | |
| Appendix J Project Scope Statement |
|
259 | |
|
|
|
259 | |
|
|
|
260 | |
|
|
|
260 | |
|
Well-Defined Standards and Metrics |
|
|
262 | |
|
|
|
263 | |
| Appendix K Why Risk Assessments Fail |
|
265 | |
|
|
|
265 | |
|
|
|
266 | |
|
Stating Concerns as How They Impact Security |
|
|
266 | |
|
Every Threat Is a Major Concern |
|
|
267 | |
|
|
|
267 | |
| Appendix L Gap Analysis Examples |
|
269 | |
|
|
|
269 | |
|
Gap Analysis Using ISO 17799 |
|
|
270 | |
|
Answer the Following Questions |
|
|
270 | |
|
Gap Analysis Using Utility-Specific Standards |
|
|
298 | |
|
Gap Analysis Sample 3 Using Combination of Standards and Laws |
|
|
344 | |
| Appendix M Control Lists |
|
399 | |
|
|
|
399 | |
| Appendix N Heat Charts |
|
423 | |
| Index |
|
431 | |