Risk Assessment Tool: Application for Removable Device Media
An excerpt from the form that the City of London uses to decide whether or not to grant officers permission to download data onto portable media
Part 3: Risk/Benefit Comparison
When officers at the City of London police wish to download information onto a portable media device, they must file a formal application to do so. Based on the scores assessed in parts one and two, this is the criteria decision-makers use to compare the risks and benefits of the proposed data download. (To read about how the police force uses the tool, see "How To Tell If That USB Download Is Really Worth the Security Risk.")
This section defines how the scoring from the risk and benefits sections are compared. This section is included for informational purposes only and is used only by the decision maker. It is included to demonstrate transparency of process. The following table is intended to give guidance on the trade off between risk and benefit. It also defines the levels of approval required for the business case dependent on risk.
|
Benefit Risk |
0-45 |
45-200 |
200+ |
|
< 20 |
Rejected |
Rejected |
Rejected |
|
Between 20 & 40 |
Low risk & BenefitAuthority |
Rejected |
Rejected |
|
Between 40 & 60 |
Acceptable |
Medium Risk & Benefit |
Rejected |
|
60+ |
Acceptable |
Acceptable |
High Risk & Benefit |
Key concepts, strategies and tools for building an effective network security program. Learn about handling hackers, mitigating DDoS attacks, and much more.
Network security: The basics
Configure your network correctly, and know what's coming in and out. Network security proceeds from those two fundamental concepts.
Log management basics
Log management systems can bring you business intelligence—so choose the right type for your needs
Penetration testing: 10 tips for a successful program
Define your goals, develop attacker profiles, define deliverables, and more
The 7 deadly sins of network security
Thinking compliance equals security, failing to assess risk, and other classic blunders
What a botnet looks like
A visual, interactive tool for examining real botnet command-and-control structures
Next-generation firewalls: In depth
How to stress-test your network
The DDoS attack survival guide
Firewall audit tools: Dos and don'ts
Also find sample network security policies in CSO's tools, templates and policies library
- Gartner Next Generation Network IPS Webcast
- Introduction to VMware vCenter Site Recovery Manager 5
- Introduction to Virtualization
- Preventing Unplanned Downtime with Server Virtualization
- Secure Cloud Infrastructure and Next-Generation Data Centers - An Interactive Panel for Decision Makers
- Understand Your Data: The Future of Backup and Archiving
- Virtual Patching with Network Security
- Gartner Next Generation Network IPS Research Note
- Planning For Failure: Incident Management Is A Top Priority
- Overcome Top 7 Admin Challenges of Active Directory
- Insiders Can Ruin Your Company. Take Action.
- Top Solutions and Tools to Prevent Devastating Malware
- Patch Tuesday preview, February 2012
Microsoft published its Patch Tuesday Preview for February of 2012 a few minutes ago. IT admins can expect nine bulletins to address 21 security vulnerabilities.
It looks like four bulletins will be rated critical while the rest are designated as important.
Affected Microsoft products are:
- M86 report proves water is wet
- Actor, banker, soldier, spy: Suits and Spooks Anti-Conference aims to redefine security
More Salted Hash with Bill Brenner
