IT risk

Information technology risk, or IT risk, IT-related risk, is a risk related to information technology. This relatively new term due to an increasing awareness that information security is simply one facet of a multitude of risks that are relevant to IT and the real world processes it supports.

Three definitions of IT risk are:

ISO definition

IT risk: the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization. It is measured in terms of a combination of the probability of an event and its consequence. [ISO/IEC 13335-1:2005] [ [http://www.opensecurityarchitecture.org/cms/foundations/definitions/it-risk Definition of IT Risk] ]

NIST definition

IT-related risk: The net mission impact considering (1) the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and (2) the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to—

1. Unauthorized (malicious or accidental) disclosure, modification, or destruction of information 2. Unintentional errors and omissions 3. IT disruptions due to natural or man-made disasters 4. Failure to exercise due care and diligence in the implementation and operation of the IT system. [ [http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf Risk Management Guide for Information Technology Systems] from NIST 800-53 rev2]

FAIR definition

IT risk is the probable frequency and probable magnitude of future loss. [ [http://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf FAIR: Factor Analysis for Information Risks] ]

References