IT Infrastructure Amna Riaz007 Tayaba Ashraf008

Risk 0 Uncertain or chance events that planning can not overcome or control. 0 A risk is a potential problem – it might happen and it might not 0 Risk concerns future happenings 0 Two characteristics of risk 0 Uncertainty – the risk may or may not happen, that is, there are no 100% risks (those, instead, are called constraints) 0 Loss – the risk becomes a reality and unwanted consequences or losses occur

Risk Management 0 Risk Management is the name given to a logical and systematic method of identifying, analyzing, treating and monitoring the risks involved in any activity or process. 0 Risk Management is a methodology that helps managers make best use of their available resources.

Risk Management 0 Risk management is a structured approach to managing uncertainty and includes actions taken to: 0 identify; 0 assess; 0 monitor; and 0 reduce the impact of risks to your business.

Risk management process 0 Risk Identify 0 Identify possible risks; recognize what can go wrong 0 Assessment Risk 0 Analyze each risk to estimate the probability that it will occur and the impact (i.e., damage) that it will do if it does occur 0 Evaluate the risks 0 Rank the risks by probability and impact - Impact may be negligible, marginal, critical, and catastrophic 0 Develop a contingency plan to manage those risks having high probability and high impact

The Risk Management Process

IT Risk by George Westerman and Richard hunter

IT Risk 0 IT risk not as a technical issue, but as a business and management one. It can be thought of as being split in three parts. 0 Part One: 0 About the framework and the overall approach to risk management. 0 Part Two: 0 Concentrates on the actionable management steps business and technology executives can use to manage risk. 0 Part Three: 0 looks at the future and proposes improvements to risk management.

IT Risk Part One 0 The 4A Risk Management Framework A framework of four A’s that looks at risk from a business perspective, rather than an assurance or compliance perspective. The four A’s that define IT risk are: 0 Availability—Keeping Existing processes running and information flowing through the business 0 Access—Ensuring that the appropriate people, including customers and suppliers, can get the information and functionality they need to be effective, but Unauthorized people do not gain access.

Part one cont. … 0 Accuracy—Concentrating on providing accurate, timely and complete information to meet Requirements of management, Staff, customers, supplier 0 Agility—Implement new Strategy initiatives, such as acquiring a firm, completing a major business process redesign or lunching a new product/services. The ability to change with managed cost and speed.

Part 1 Cont.… 0 The Three Core Disciplines of IT Risk Management These are: 0 A well-structured foundation of IT assets, an installed technology base of infrastructure and application technologies, and supporting personnel and procedures 0 A well-designed and well-executed risk governance process that provides an enterprise-level view of all risks 0 A risk-aware culture in which everyone has appropriate knowledge of risk

IT Risk Part 2 0 Fixing the Foundation 0 Strengthening the base of the pyramid; the importance of infrastructure in risk management 0 Simplifying the base of the pyramid; about how complexity drives risk, cost and performance levels. 0 Critical point when they show how change in infrastructure is IT change, while change in applications is business change.

Part 2 Cont Developing the Risk Governance Process 0 Covering how to manage and make decisions regarding IT and business risks 0 Building a Risk-aware Culture 0 An important connection between risk and culture, and a critical distinction between being risk-aware and risk-averse.

IT RiskPart 3 0 Looking Ahead 0 Talks about how to incorporate risk management as a positive force in planning and strategy setting 0 Some Ways Executives Can Improve IT Risk Management 0 Different ways executives can improve IT risk management. Some of these ways are: 0 Treat IT risk as business risk. 0 Simplify the foundation. 0 Give to every employee an appropriate awareness of the risks, vulnerabilities and policies that matter most to them. 0 Measure effectiveness. 0 Lead by example.