Three Ways to Handle Risk in IT Systems
January 7th 2012 Posted at Beauty
Comments Off 
Risk cannot be avoided, but conversely you cannot worry about everything. We tend to be most concerned with risks based on our primary business activities, validated data, and industry best practice. Any risk that may effect out primary business activities must be scrutinized carefully; the impact from those risks manifesting themselves may be grave. So must any based on validated data; for example a bank branch that has had 5 armed robberies in the past 2 years is likely to see another, and a server that has been attacked several times in the past is likely to be attacked again. Also, any risks that have manifested themselves for similar organizations to ours must be considered as well. If many organizations similar to ours have seen a specific attack directed against themselves, we may as well in the future.For any given risk, we may choose to accept it. Th how to get rid of acne e risk may not be so great or perhaps any countermeasures are too expensive; do not now a positive return on investment (ROI). For example one company uses telnet access servers, and telnet sends clear text passwords and usernames over the network. It was determined that the risk in their particular case was not so great and it was accepted. There are many risks we will simply acceptAn organization can also mitigate or reduce a risk through appropriate controls. For example, there is risk in connecting to the Internet but that risk can be reduced through the use of a good firewall, intrusion detection system (IDS), and anti virus. These are all examples of security controls used to mitigate risk. Sometimes risk is mitigated to the extent that that risk no longer exists.It is also possible in some cases to transfer risk to others, for example through insurance.