Information Risk Management

Cyber Security

This Case Study is related to Cyber Security domain. A cyber security expert who knows ISO 27001 standards can do this assignment.

We use an Information security management system also known as IS0 27001. Assess the risk of three business domains: IT & Infrastructure, Equipment, and Logistics & Support services. you have to choose one company from the UK and assess the risk of these three business domains of the company.

Section 1: Overview of Assessment

Question 1. Form a deep and systematic understanding of relevant standards, such as ISO27001, in the context of Information Security Management.

Question 2. Analyse a broad range of issues related to real-world security issues that face commercial organisations and other institutions.

Question 3. Evaluate and critique the shortcomings of real-world security incidents and provide clear justification and innovation solutions for how ISMS could help mitigate future incidents.

Question 4. Assess and evaluate the appropriateness of security laws and regulations.

Question 5. Reflect on personal capabilities for the proposal of an ISMS, providing a strong rationale for the methods adopted.

Broadly speaking, the assignment requires you to produce a 3000-word report that provides a critical reflection on a real-world security scenario provided in the case study, with evidence of risk assessment using suitable methodologies, and how this can inform mitigation of future incidents.

Working on this assignment will help you to develop your knowledge and understanding of applying risk methodologies to resolve real-world security incidents. It will also help to develop your critical thinking skills for identifying appropriate mitigation strategies to avoid future security incidents.

Section 2: Task Specification

Produce a 3000-word report to address a case study of information risk management, informed by a real-world security incident and demonstrating concepts of information risk management.

For this assignment, you are provided with the following case study built around a real-world security incident,

Case study:

Imagine you are in charge of an organisational risk management strategy across three distinct departments of the organisation. The organisation envisions risk as, ‘potential vulnerabilities present across our security landscape leads to exposure which enables a cyber incident against the infrastructure, capability, services and applications, which leads to an impact upon Confidentiality, Integrity and/or Availability resulting in reduced resilience, reduced safety, ineffective capabilities, loss of business services, financial impact and reputational damage to UK Government'.

The risk applies to three main business domains:

1. IT & Infrastructure

2. Equipment

3. Logistics & Support services

Each business domain is managed by a separate Director, but collectively they (all three) own the risk. There is a separate Director who is accountable for the risk, and they report the status to the Executive Board throughout the year.

Given the complexity of the risk and its significant breadth and depth it's difficult to establish a baseline level of risk exposure - a pre-mitigation level, which represents the whole business (all three domains). Defining the Risk Appetite (RA) is also challenging given the differences across the domains, the views from each Director, the level of resources available etc.

Considering all of the above, answer the following questions,

Question 1. How would a baseline risk level be established? How ISMS and FAIR can be applicable to organisation.

Question 2. What approach could be taken to define a risk assessment and can a single approach work or it will be more appropriate to individually assess for each domain? Along with risk analysis and treatment strategies.

Question 3. How would the effectiveness of controls (risk response) be measured? What can be risk quantification measures and metrics? How to monitor ongoing (residual) risk?

You are expected to use risk assessment methodologies as covered in this module with critical reflection on your choice of risk methodology, and its strengths and limitations.

You have the freedom to select the risk assessment approach.