Enterprise risk management INFO 312 AUTUMN 2015 UNIVERSITY OF WASHINGTON INFORMATION SCHOOL WEEK #6B NOVEMBER 4, 2015

Your papers All are graded. Pleasantly surprised. Several are publishable. Advice you get from me on papers will stand you in good stead in other classes where you have to write. Make reference to the course readings as well as to other research you have done. Figure out how you know something and then give credit in citations. Don’t just summarize the reading that you have done – come up with your own set of recommendations as well. If you are writing on a topic you have no reason to believe that your teacher knows much about, take the time to explain the company or issue.

Managing risk and information security Malcolm Harkins, Intel

Harkins article: risk and information security First example in article highlights third party risk, which is our theme this week. How much risk is involved in outsourcing payroll? What questions/guarantees should be extracted from the proposed vendor? Article points out that information security team is often required, not just by HR, but by other parts of the firm as well where information risk is concerned. Next example is the technology group where partnership is also important. Information risk governance processes focuses on enabling (not hindering) the business while protecting confidentiality, integrity and availability of the information, corporate or personal, whether about employees or customers.

How bureaucratic is governance? MIT Center for Information Systems Research (MIT CISR): “Good governance is enabling and reduces bureaucracy and dysfunctional politics by formalizing organizational learning and thus avoiding the trap of making the same mistakes over and over again.” MIT research shows that firms with good IT governance have profits that are 20% higher than the competition IT policies provide a good framework but should allow latitude in how the work is carried out. If too preoccupied with rules and procedures, we may fail and not get desired outcome

RACI model for IT and risk governance

Another view of the RACI

RACI Example: Going to court

Intel internal information risk focus (2012)

Important Partnerships at Intel Legal Privacy Litigation Intellectual Property and Data Classification Contracts Financial Compliance (SEC) Employees Via security policies Via training, awareness and corporate information Internal Audit Corporate Security

A fair approach to managing information risk Jack Freund and Jack Jones

What is FAIR approach? “Factor Analysis of Information Risk (FAIR) is the only international standard Value at Risk (VaR) model for cyber security and operational risk. Provides a model for understanding, analyzing and quantifying information risk in financial terms Unlike risk assessment frameworks that focus their output on qualitative color charts or numerical weighted scales  Builds a foundation for developing a scientific approach to information risk management Benefits: Speak in one language concerning your risk Consistently study and apply risk to any object or asset View organizational risk in totality Challenge and defend risk decisions using an advanced risk model Understand how time and money will impact your security profile” From http://www.risklens.com/what-is-fair

FAIR = An enterprise scalable risk model Risk Model Components An ontology and standard nomenclature for information and operational risk A framework for establishing data collection criteria Measurement scales for risk factors Integrates into a computational engine for calculating risk A modeling construct for analyzing complex risk scenarios -- From http://www.risklens.com/what-is-fair

Questions? asearle@uw.edu abbast@uw.edu