Risk, Threat and Vulnerability Management

Many companies and agencies conduct IT audits to test and assess the rigor of IT security controls in order to mitigate risks to IT networks. Such audits meet compliance mandates by regulatory organizations. Federal IT systems follow Federal Information System Management Act (FISMA) guidelines and report security compliance to US-CERT, the United States Computer Emergency Readiness Team, which handles defense and response to cyberattacks as part of the Department of Homeland Security. In addition, the Control Objective for Information Technology (COBIT) is a set of IT security guidelines that provides a framework for IT security for IT systems in the commercial sector.

These audits are comprehensive and rigorous, and negative findings can lead to significant fines and other penalties. Therefore, industry and federal entities conduct internal self-audits in preparation for actual external IT audits, and compile security assessment reports.

1.1: Organize document or presentation in a manner that promotes understanding and meets the requirements of the assignment.

1.2: Develop coherent paragraphs or points to be internally unified and function as part of the whole document or presentation.

1.3: Provide sufficient, correctly cited support that substantiates the writer’s ideas.

1.4: Tailor communications to the audience.

1.5: Use sentence structure appropriate to the task, message and audience.

1.6: Follow conventions of Standard Written English.

1.7: Create neat and professional looking documents appropriate for the project.

1.8: Create clear oral messages.

2.1: Identify and clearly explain the issue, question, or problem under critical consideration.

2.2: Locate and access sufficient information to investigate the issue or problem.

2.3: Evaluate the information in a logical and organized manner to determine its value and relevance to the problem.

2.4: Consider and analyze information in context to the issue or problem.

2.5: Develop well-reasoned ideas, conclusions or decisions, checking them against relevant criteria and benchmarks.

5.2: Knowledge of architectural methodologies used in the design and development of information systems and knowledge of standards that either are compliant with or derived from established standards or guidelines.

5.3: Uses defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats.

7.2: Includes the process of identifying, quantifying, and prioritizing the vulnerabilities in a system. Vulnerability from the perspective of disaster management includes assessing the threats from potential hazards to the population & to infrastructure.