Risk management

Risk is defined as an exposure to loss, injury, or damage due to threats, vulnerabilities, and attacks. Risk management is to manage the risks.

Identifying threats and vulnerabilities, attacks, estimating potential impact, and establishing and implementing suitable controls to treat the risk are functional steps in risk management. Monitoring, reviewing, communicating the results, and improving the security posture are continual improvement processes in the risk management cycle.

Note

Security posture is an overall plan of the organization pertaining to security. It includes security governance, policies, procedures, and compliance.

Observe the following illustration, which is a typical web application network infrastructure consisting of the N-tier architecture:

Fig 2

In the preceding architecture, various assets are involved in the business process of accessing, updating, or modifying the information. For example, an employee (people asset) accesses a web application (information...