Enhancing IT Security: Workers Werks Credit Union's Risk Management Report

03/20/2023 Thistle, Cameron SNHU IT 313 Introduction: As a risk management consultant, it is my job to write a report on Workers Werks Credit Union's IT security Risk Management Plan. The current cybersecurity risk plan has been in place for almost three years. Since then, both the workforce and the company's revenue have significantly grown. Having said that, they need to make significant adjustments if they want to grow even more. Presently the CIO is stressed that the business should become secure and stick to all legitimate and moral necessities. Scope: The whole association should be implied in risk the executives since it is a confounded and complex errand. Because it begins by outlining the escalation process and the various roles that various executives and managers will play to ensure that the organization is prepared to respond to any type of risk that might be recognized, the current plan appears to provide a high-level overview of the company's risk management. The implementation of a risk management strategy ought to be approached similarly to any other change that necessitates the assignment of responsibilities to the entire management team. By ensuring that all the company's systems are secure and that the risk management system does not result in irrational spending, the primary objective of the plan is to safeguard the profitability of the business. To achieve this, a specific risk management strategy is outlined in the plan. The first thing that needs to be done is to identify the information system. This requires a few inputs, one of which is a description of how to protect the IT architecture. The plan's risk assessment section lays out the various steps the company would take to protect its systems from common cybersecurity threats, reduce risks, and restore equilibrium. Data breaches may result in extremely high costs for a company. To avoid having to pay such a cost, it has a threat assessment feature that will assist in identifying potential risks and reducing them before they occur. To guarantee the CIA's confidentiality, integrity, and availability to fully achieve business objectives, the plan outlines how information security would be maintained. The first step that NIST recommends for risk management is to classify information systems and the data processed, stored, or sent on them. The risk management plan uses the three information security principles of confidentiality, integrity, and availability, or the CIA, to classify risks. Like a business impact analysis (BIA), which identifies the company's critical systems, this focuses on the maximum acceptable downtime, recovery time goal, and recovery point goal. The company appears to have a solid grasp of the controls it needs to put in place under the "Assets" section to achieve its goal, which is to protect its most valuable assets, such as customer information and any other data whose compromise would have dire consequences for the company's stakeholders. Risk: The plan outlines a risk assessment procedure that includes locating assets that need to be protected, identifying threats to the organization's systems, evaluating the security controls in place to protect those assets, monitoring vulnerabilities, and determining how those vulnerabilities will be fixed as a final step. The organization's risk management plan calls for the security team to conduct a risk assessment to determine the potential harm that could be caused and the exposure factors that are likely to be caused by a threat or vulnerability that has been identified, even though it is impossible to identify every security risk or vulnerability that a company faces. One strategy the company intends to implement in the hope of mitigating both internal and external risks is the concept of "risk treatment," which encompasses options like risk control, risk retention, and risk avoidance. Impact: The strategy categorizes the risk levels as low, moderate, or high based on how the risks would affect the strategy's key assets. It is essential to keep in mind that risk is defined as the intersection of chance and impact. Each element should be given a security effect category, such as low, medium, or high, when protecting the CIA. This may be of assistance to the business in determining the most effective way to implement security solutions to safeguard valuable assets. As it moves through the risk management plan, the company should consider how potential risks could affect its resources and operations. The team members can use their knowledge to determine the likelihood of danger or the availability of sector resources, and if necessary, they can create impact categories to assist in determining the overall risk. Quantitative risk analysis should be included in the strategy to estimate the financial cost and loss. Quantitative risk analysis can help determine the true value of each asset and the cost of safeguards and controls that can be used to mitigate risks, vulnerabilities, and other potential threats. The current risk management strategy categorizes risks as disastrous, major, moderate, minor, or insignificant. Each risk is then given a priority number that indicates how quickly the issue needs to be fixed. To adequately address the financial impact of losses, it is essential to incorporate quantitative risk analysis into the strategy. The annualized loss expectation that the company would anticipate having to manage for a specific risk could be estimated with the assistance of this evaluation. Business continuity is essential even if the company's systems are hacked. It may be helpful to have a strategy in place to keep operations running to minimize losses caused by compromised assets or business procedures. For example, the strategy needs to include details about how it will handle lost assets, restore data, or even deal with system outages. This criterion is not addressed in the plan for risk management. Mitigation: To lessen the likelihood of a risk occurring or having an impact, the organization is required to implement risk mitigation strategies. It would be able to reduce the amount of harm that could occur to a level that could be sustained by putting in place the necessary safeguards to guard against weaknesses and threats. The implementation of security controls is one of the steps that are required to be taken as part of the plan for risk management. Security regulations may also contribute to reducing risks and hazards to a level that can be tolerated if they are properly implemented. As part of the strategy for reducing risk, the current plan for risk management does not include any methods for putting security policies into practice. Legal Compliance: If security rules and standards aren't followed, data breaches could cost the company money and lead to lawsuits. There must be a section that explains how the company will ensure compliance with all applicable security regulations. Compliance necessitates adhering to both statutory and regulatory requirements as well as company policies and procedures. The way the business will demonstrate compliance is not outlined in the risk management plan. It was essential to include a strategy for ensuring that its operations adhered to the best security practices and for modifying such rules as required. Non-Compliance: A corporation must adhere to not only the applicable jurisdiction's rules and regulations but also its own internal policies and procedures to be complying. The risk management strategy contains no mention of the organization's compliance demonstration strategy. It is possible that it will require a plan to ensure the highest possible levels of security in its operations and procedures for modifying such policies in response to shifting requirements. Ethical Considerations: An internal code of ethics for the company is needed to just make sure that the security procedures are following the law. Even though the company's comprehensive risk management strategy makes it easy to believe that it adheres to the predetermined code of ethics, it is essential to provide a strategy for ensuring that everyone is working to maintain the robustness and safety of its security infrastructure and systems. The company must establish crystal-clear regulations that describe the expected behaviors of employees and ensure that appropriate IT security procedures are strictly followed within the company to achieve this objective. References: Knowles, M. Knowles, Mark. "Cybersecurity Risk Management: Frameworks, Plans, & Best Practices - Hyperproof". Hyperproof, 2021, https://hyperproof.io/resource/cybersecurity-risk-management-process/. Accessed 21 Mar 2023.