1. Enterprise risk management
INFO 312
AUTUMN 2015
UNIVERSITY OF WASHINGTON INFORMATION SCHOOL
WEEK #6B
NOVEMBER 4, 2015

2. Your papers All are graded. Pleasantly surprised.
Several are publishable.
Advice you get from me on papers will stand you in good stead in other classes where you have to write.
Make reference to the course readings as well as to other research you have done.
Figure out how you know something and then give credit in citations.
Don’t just summarize the reading that you have done – come up with your own set of recommendations as well.
If you are writing on a topic you have no reason to believe that your teacher knows much about, take the time to explain the company or issue.

3. Managing risk and information security
Malcolm Harkins, Intel

4. Harkins article: risk and information security
First example in article highlights third party risk, which is our theme this week. How much risk is involved in outsourcing payroll? What questions/guarantees should be extracted from the proposed vendor?
Article points out that information security team is often required, not just by HR, but by other parts of the firm as well where information risk is concerned. Next example is the technology group where partnership is also important.
Information risk governance processes focuses on enabling (not hindering) the business while protecting confidentiality, integrity and availability of the information, corporate or personal, whether about employees or customers.

5. How bureaucratic is governance?
MIT Center for Information Systems Research (MIT CISR):
“Good governance is enabling and reduces bureaucracy and dysfunctional politics by formalizing organizational learning and thus avoiding the trap of making the same mistakes over and over again.”
MIT research shows that firms with good IT governance have profits that are 20% higher than the competition
IT policies provide a good framework but should allow latitude in how the work is carried out. If too preoccupied with rules and procedures, we may fail and not get desired outcome

6. RACI model for IT and risk governance

7. Another view of the RACI

8. RACI Example: Going to court

9. Intel internal information risk focus (2012)

10. Important Partnerships at Intel
Legal
Privacy
Litigation
Intellectual Property and Data Classification
Contracts
Financial Compliance (SEC)
Employees
Via security policies
Via training, awareness and corporate information
Internal Audit
Corporate Security

11. A fair approach to managing information risk
Jack Freund and Jack Jones

12. What is FAIR approach?
“Factor Analysis of Information Risk (FAIR) is the only international standard Value at Risk (VaR) model for cyber security and operational risk.
Provides a model for understanding, analyzing and quantifying information risk in financial terms
Unlike risk assessment frameworks that focus their output on qualitative color charts or numerical weighted scales 
Builds a foundation for developing a scientific approach to information
risk management
Benefits:
Speak in one language concerning your risk
Consistently study and apply risk to any object or asset
View organizational risk in totality
Challenge and defend risk decisions using an advanced risk model
Understand how time and money will impact your security profile”
From

13. FAIR = An enterprise scalable risk model
Risk Model Components
An ontology and standard nomenclature for information and operational risk
A framework for establishing data collection criteria
Measurement scales for risk factors
Integrates into a computational engine for calculating risk
A modeling construct for analyzing complex risk scenarios
-- From

14. Questions?