1. MODULE II - EXERCISES Carmen R. Cintrón Ferrer © 2014

2. IT Risk Exercise (1) Carmen R. Cintrón Ferrer, 2014, Reserved Rights 2  Identify at least two events that pose Security Risks associated with IT infrastructure  Classify and order those risks based upon Probability - Impact  Suggest controls/countermeasures that will prevent/ reduce impact or transfer risk

3. IT Exercise (1) – Events Matrix Risk EventProbabilityMeasure(s) Recommended Carmen R. Cintrón Ferrer, 2014, Reserved Rights 3

4. IT Risk Exercise (2) Carmen R. Cintrón Ferrer, 2014, Reserved Rights 4  For the Risks analysed in the Table that follows:  Determine which proposed countermeasures should be implemented, based on Cost-Benefit Analysis.  If resources are limited, Which should be implemented first (prioritize)? Why?

5. Key FactorsRisk ARisk BRisk CRisk D Successful Event Cost$500K$10K$100K$10K Event Probability80%20%5%70% Estimated Impact Loss$400K$2K$5K$7K Cost of Measure/Control$100K$3K$2K$20K Net Impact (Value)$300K($1K)$3K($13K) Risk Determination? Investment Priority? Tomado de: Panko, Corporate and Computer Security, Fig. 1-9, p.36 IT Exercise (2) – Investment Analysis Carmen R. Cintrón Ferrer, 2014, Reserved Rights

6. 6 Examine the following references:  Introduction of the IRGC Risk Governance Framework, IRGC 2008 Introduction of the IRGC Risk Governance Framework, IRGC 2008  Managing the Risk of Aging Infrastructure by Richard Little, USC (2012) Managing the Risk of Aging Infrastructure by Richard Little, USC (2012) Write an essay that addresses the following questions:  What is the importance of the IRGC Model?  How does it compare to the Cobit/ITGi proposed model?  Was the model applied in the scenarios of Aging Infrastructure considered by Richard Little?  Were there any discernible difference(s) between the two scenarios?  Which key factors played a role in the events, could those risks be managed more effectively/efficiently?  Are there any lessons to be learned from the readings?  Is the Model appropriate for other scenarios? Exercise 3 Risk Management Cases