IT Risk Management Risks and Security Patches

Question: Discuss about theIT Risk Management for Risks and Security Patches. Answer: Introduction: IT Risk Management Changes in IT Landscape Information Technology (IT) has become an integral part of every sector in the present era. The evolution of IT has been home to many major changes in terms of its operations, services and techniques. From vacuum tubes to microprocessors, wired to wireless communication, desktop based computing to mobile and cloud computing along with massive expansion of social networks and many more have been a part of the IT world. These changes have also impacted the business world along with the global technological changes in economy, society and for the government as well. Risks/Threats and their Severity With the expansion of IT, the concerns associated with the security of the same has emerged as a serious issue for the organizations and for the government. As per Committee of National Security Systems (CNSS), storage, processing and transactions are the three main areas that are prone to risks. These risks affect the three pillars of the CIA Triad viz. Confidentiality, Integrity and Availability of the information by violation of the same and impacting the privacy through unauthorized and unauthenticated access. Attacks that change or manipulate the data to compromise the integrity of the same such as data breaches and data loss are the first and the foremost category of security risks. Attackers also attempt to break in to the security of the system by impersonating as the authenticated users through means such as spam emails, phishing, whaling and many more (Zetter, 2016). Cloud based computing makes use of resource sharing, third party APIs and interfaces which opens the path for Account Hijacking and increased exploitation of system vulnerabilities. SQL injections, man-in-the-middle attack and sniffing and backdoor attacks have also become extremely common (www.intelligenthq.com, 2016). Denial of service and distributed denial of service attacks by flooding the network with unwanted traffic is a major security risk. Malware injections such as introducing viruses, worms, Trojans and logic bombs in the system also holds the potential to cause major damages. These risks can have low, significant and critical severity on the basis of the category of the information that is exposed to the attacker. Acquiring of critical, private and confidential information by the intruders can cause serious damage to the organization and may also result in legal and regulatory issues. The severity is comparatively low if the information that is acquired is public in nature. Mitigation of Risks There are a number of components in IT that need to be secured for the overall system security such as physical security, network security, infrastructure security, identity and access management and information security as a whole. Network scans and network monitoring can detect the network threats. Advanced identity and access management with use of latest authentication measures such as One Time Passwords (OTPs), Single Sign On and Single Sign Offs can also aid in improved IT security (blackstratus.com, 2015). Also, better access control and installation of firewalls, latest anti-virus and web security along with physical security at all the entry and exit points is essential to keep the information secure. Security Patches A security patch is a piece of software that in installed to remove the defect or bug that was earlier detected in the system. Earlier, the organizations adopted the approach of installing the patch as soon as it was developed and did not monitor it thereafter. However, with the increase in the security issues, it is essential to follow a defined patch management methodology. It includes a step by step approach to decide whether the patch should be installed or not and suggests the measures to perform the installation. Risk estimation is the first step in this methodology to determine the impact of installing and not installing the security patch. On the basis of the results, test environment is created to find out the performance of the patch with the use of test servers and critical applications of the system (www.sans.org, 2016). A back out plan is created in the next step to back up the entire data to recover the same in case of a disaster. Patch evaluation, patch distribution and installation functions are determined in the next step. If the patch qualifies for deployment and is well tested, the same must be approved by the business owners and recorded in the form of formal documentation and reports. The process comes to end with the p atch rollout and maintenance during post-production phase. References blackstratus.com,. (2015). How to Overcome Security Issues in Cloud Computing. BlackStratus. Retrieved 13 August 2016, from https://blackstratus.com/overcome-security-issues-cloud-computing/ www.horizons.gc.ca,. (2013). Rapid changes in information technology | Policy Horizons Canada. Horizons.gc.ca. Retrieved 13 August 2016, from https://www.horizons.gc.ca/eng/content/rapid-changes-information-technology www.intelligenthq.com,. (2016). Combating the Risks of Cloud Computing. Intelligent Head Quarters. Retrieved 13 August 2016, from https://www.intelligenthq.com/social-business-2/combating-the-risks-of-cloud-computing/ www.sans.org,. (2016). Sans.org. Retrieved 11 August 2016, from https://www.sans.org/reading-room/whitepapers/bestprac/practical-methodology-implementing-patch-management-process-1206 Zetter, K. (2016). The Biggest Security Threats Well Face in 2016. WIRED. Retrieved 13 August 2016, from https://www.wired.com/2016/01/the-biggest-security-threats-well-face-in-2016/