Investment Firm cybercrime risk assesment

 

• As the HU Investment Firm cybercrime expert, you are required to create a Cybercrime Risk Assessment.  The overall cybercrime risk assessment can be outlined with a minimum of two to three sentence descriptions of what the outline will cover under each section.
• Ensure that you provide information for three specific risks for each section. For example, three High, three Medium, and three Low.
• You will want to take into consideration that HU Financial Firm is a legal firm. 
• Items to think about would be the possibility of a natural disaster occurring or a cybercrime attack. 
• You will want to rank the possibility of an incident happening from high to low as identified in the sample template in this section, which has been provided for you.
• Additional information can be reviewed under the course reference links and research on the internet.

Iowa State University

Business Impact Analysis and Risk Assessment for Information Resources

{Department Name}

{Function}

{Date Completed}

Risk Analysis Team Members

NAME
TITLE

General Information

Department Name:

Department Head:

Departmental Team Leader:

Date Report Completed:

Date of Approval by Department Head:

Part 1 – General Comments

Business Impact Analysis and Risk Assessment Process

The General Comments section identifies special situations. It may refer to the process used for the business impact analysis and risk assessment or it could highlight any unique departmental characteristics. For example, the department may utilize some special hardware/software, there may be some special locations involved, or there may even be a dependence on someone else’s information resources to document. If this business impact analysis and risk assessment is for multiple departments, an explanation should be included in this section to explain the rationale for completing the report in this manner. The department should use this section as they see fit to further explain their business impact analysis and risk assessment.

General Comments

Part 2 – Identify Information Resources

Business Impact Analysis and Risk Assessment Process

“Information Resources” definition in the context of this process includes any hardware, software, systems, services, people, databases, and related resources that are important to the department. These resources should be identified in a manner such that overlap is minimized. In some cases it may be appropriate to combine resources (for example, all workstations for faculty, printers, etc.) while other situations may suggest specific resources (for example, special use server, a specific piece of hardware such as a printer or scanner, or a specific software package or application). It might also be appropriate to have some clear point of accountability (that is, an individual who is responsible for specific hardware, a software package, or an office process).

Information Resources

Part 3 – Categorize Information Resources by Impact

Business Impact Analysis and Risk Assessment Process

The team needs to determine the criteria to categorize the list of information resources as high, medium, or low related to impact on their day-to-day operations. Candidate criteria include characteristics like criticality, costs of a failure, publicity, legal and ethical issues, etc. It will be important that the team agree upon and establish a common understanding of the criteria and its meaning.

The team will need to consider the criteria in aggregate and use judgment and experience to classify the resources. The number of resources in any impact group is somewhat arbitrary, but becomes unwieldy as it becomes larger. A good target number for the initial “High Impact” resources is a dozen or fewer. Twenty is probably more than desirable. Classify the remaining resources as either medium or low impact as described below:

·
High Impact (H) – The department 1) cannot operate without this information resource for even a short period of time, 2) may experience a high recovery cost, 3) may realize harm or impedance in achieving one’s mission or in maintaining one’s reputation, or 4) may experience human death or serious injury.

·
Medium Impact (M) – The department 1) could work around the loss of this information resource for days or perhaps a week, but eventually restoration of the resource must occur, 2) may experience some cost of recovery, 3) may realize harm or impedance to achieving one’s mission or maintaining one’s reputation, or 4) may experience human injury.

·
Low Impact (L) – The department 1) could operate without this information resource for an extended (though perhaps finite) period of time during which particular units or individuals may be inconvenienced and/or need to identify alternatives or 2) may notice an affect on achieving one’s mission or maintaining one’s reputation.

Information Resources Categorized by Impact

High Impact Information Resources				Brief Description

Brief Description

Medium Impact Information Resources

Brief Description

Low Impact Information Resources

Part 4 – Identify and Categorize Risks by Likelihood

Business Impact Analysis and Risk Assessment Process

“Risks” as used here includes problems and threats. Risks must be tangible and specific with respect to one or more resources. When finalizing the list, eliminate duplicates, combine risks as appropriate, and include only those risks that team members agree are valid.

Categorize the identified risks by likelihood of occurrence. The definitions for likelihood are as follows:

·
High Likelihood (H) – The risk (threat) source is highly motivated and sufficiently capable, and controls to prevent the vulnerability are ineffective.

·
Medium Likelihood (M) – The risk (threat) source is motivated and capable, but controls are in place that may impede successful exercise of the vulnerability.

·
Low Likelihood (L) – The risk (threat) source lacks motivation or capability, or controls are in place to prevent or significantly impede successful exercise of the vulnerability.

Risks at the top of the list should be those risks that have a high likelihood of occurrence and the potential to have the largest impact on information resource availability.

Risks Categorized by Likelihood

Brief Description

Risk Likelihood	Risk

Part

5

– Information Resources, Associated Risks, and Corrective Actions

Business Impact Analysis and Risk Assessment Process

List the high impact information resources identified in Part 3 and document the risks associated with each information resource using the risks identified in Part 4. Supply comments where needed to clarify a specific situation. Denote the risk likelihood. In the final column, indicate the risk action decision by the team to mitigate each specified risk. Definitions for risk actions are as follows:

·
High Action (H) – Take corrective action as soon as possible.

·
Medium Action (M) – Implement corrective actions within a reasonable timeframe.

·
Low Action (L) – Take no corrective action. Accept the level of risk.

Information Resources, Associated Risks, and Corrective Actions

High Impact Information Resource	Related Risks and Comments	Risk Likelihood	Risk Action

Recommendations for Mitigating Risks

All high and medium risk actions associated with high impact information resources need a documented recommendation or plan for mitigating each risk. If no high impact information resources exist, the team should review identified high and medium risks and develop recommendations to mitigate those risks. The process for developing appropriate recommendations is as follows:

· Identify each recommendation that might be implemented (this includes technical and manual solutions, as well as policies and procedures) and appropriately documented. It may be obvious at this early point only one recommendation is applicable. Document that fact and include documentation regarding the dismissal of other recommendations.

· Provide a justification for each proposed recommendation — this may be the same for each or it could be different, in which case it will be useful in any evaluation. The obvious justification is that the recommendation will handle the problem, but a specific solution may not handle all risks.

· Develop a cost/benefit analysis for each proposed recommendation (in some cases this may involve other departments or units). This should include (but not be limited to) capital and direct costs, staff costs, training and support, and any ongoing operating costs.

· Specify any known implementation plans or specific dates for the recommendations. This could be an important consideration depending on the severity of the risk and the timeframe involved for implementation.

Recommendations for Mitigating Risks

Recommendation for Mitigating Risk

Name of Resource:

Impact:

Risk and/or Problem:

Proposed Solution(s):

Justification for solution:

Implementation plan with dates:

Date this report prepared:

Responsible individual:

PAGE

5