Managing Risk

The field of security – and American regulation – realizes that not all organizations need the same level or type of security. Banks need more security than the average small not-for-profit. The idea of risk analysis is to determine where the gold is in your organization, and to design the appropriate security to protect your assets – both informational and physical assets. The three pillars of security are confidentiality, integrity and availability. For risk analysis, we should evaluate for each important asset: must it remain confidential, with integrity, and/or available? Google may be most concerned with availability, while the Social Security Administration might be most concerned with confidentiality and integrity. A pharmacy should be concerned with confidentiality, integrity, and availability. We will consider appropriate qualitative and quantitative methods to evaluate risk with these issues in mind.