Reference no: EM132896877
BIT361 Security Management and Governance - Melbourne Polytechnic
Assessment Part
Perform a risk analysis on a small part of a business system and provide a list of possible controls. Provide the results in a report which discusses costings, implementation issues and user impacts. (1000 words)
The Case study scenario: (continued from Part A)
Your report on the need for a Security Management Program has been accepted, but they management have requested more information on: policy development and the need for a risk management program. Specifically, they have asked for an explanation of benefits of a risk management plan, the steps for creating a risk management plan, a description of risk assessment process.
To meet the client's request, you need to do the following:
Document contents:
• A discussion of the types of policies needed for information security.
• A discussion on what policy documents should look like.
• Explanation of benefits and purpose of a risk assessment.
• Description of risk assessment process.
• Outline the steps for creating a risk management plan.
• A set of asset and risk priorities using the tables below:
o Identification of Assets.
(One asset from each of the different categories: people, process, hardware and software).
o Identification of threats/vulnerabilities.
(One threat from each of the different categories: Internal, external, deliberate, and accidental).
• Priorities determined, Preliminary impact of risks
• Suggest controls for the items in the last table.
To assist with their understanding of risk assessment and management you have decided to consider 4 assets and 4 threats to be used to complete the tables below. To effectively demonstrate your skill, the tables would need to include examples of assets from different categories: people, process, hardware and software. Threats should also include examples from different categories: Internal, external, deliberate, and accidental.
The Assignment (Part B)
The format for submission for this document is less formal than for the original report: Cover page
Introduction (What is the purpose and why the report was needed/requested. Headings for each part of the client's request.
Attachment:- Security Management and Governance.rar