Phân tích &
Qu n lý r i roả ủ
Võ Vi t Minh Nh tế ậ
Khoa CNTT – Tr ng ĐHKHườ
N i dung trình bàyộ
M đ uở ầ
Đ nh nghĩa r i roị ủ
Tính d b xâm h i (vulnerability)ể ị ạ
M i de d a (threat)ố ọ
Xác đ nh r i ro cho m t t ch cị ủ ộ ổ ứ
Đo l ng r i roườ ủ
M đ uở ầ
Security is about managing risk. Without an
understanding of the security risks to an
organization’s information assets, too many
or not enough resources might be used or
used in the wrong way.
Risk management also provides a basis for
valuing of information assets. By identifying
risk, you learn the value of particular types of
information and the value of the systems that
contain that information.
What is risk?
Risk is the underlying concept that forms the
basis for what we call “security.”
Risk is the potential for loss that requires
protection. If there is no risk, there is no need
for security.
And yet risk is a concept that is barely
understood by many who work in the security
industry.
What is risk?
Example of the insurance industry
how much the car repair is likely to cost?
how much the likelihood that the person will be in
an accident?
Two components of risk:
The money needed for the repair => vulnerability
the likelihood of the person to get into an accident
=> threat