Words of Risk Analysis
This page is a compilation of definitions offered for various common risk terms as stated in whatever texts I come across. I will be adding these definitions to SARMA’s SARMA-Pedia periodically.
Risk Management
- The identification, assessment, and mitigation of probabilistic security events (risks) in information systems to a level commensurate with the value of the assets protected [1]
Risk-Based Management
- Risk management that considers unquantifiable, speculative events as well as probabilistic events (that is, uncertainty as well as risk) [1]
Vulnerability
- A flaw in the security procedures, software, internal system controls, or implementation of a system of any type that may affect the integrity, confidentiality, accountability , and/or availability of data or services [1]
Vulnerability Assessment
- An examination of the ability of a system’s current security procedures and controls to withstand assault [1]
Threat
- Any circumstance or event that could harm a critical asset through unauthorized access, compromise of data integrity, disruption of service, or physical destruction or impairment [1]
References
- Erbschloe, M. (2005). Physical Security for IT. Elsevier Digital Press. ISBN: 155558327X.