Business Risk Assessment: Hazard Categories, Evaluation Criteria, and Outcomes

This guide provides a comprehensive understanding of business risk assessment, including hazard categories, evaluation criteria, and outcomes. It also includes a risk assessment tool and recommended corrective actions. The guide covers various risks such as hacking, errors, typhoons, bombing, communication failures, and more. It also discusses the impact of risks on data systems and the organization's operations. The guide is useful for students studying business risk assessment, and professionals looking to assess and manage risks in their organizations.

BUSINESS RISK ASSEMENT
Name
Subject:
Date of Submission
1 | P a g e

Table of Contents
Introduction.................................................................................................................................................3
Hazard Categories.......................................................................................................................................3
Evaluation Criteria.......................................................................................................................................4
Outcomes....................................................................................................................................................4
Risk level......................................................................................................................................................6
Recommended corrective actions...............................................................................................................7
INCIDENT RESPONSE PAPER........................................................................................................................7
Risk: Hacking:...........................................................................................................................................8
Risk assessment tool................................................................................................................................8
References...................................................................................................................................................9
2 | P a g e

Introduction
Risks are inevitable parts of any business organization in its operations and daily business
activities, this therefore creates a need of assessing the risk in terms of its impacts to the
profitability and performance of the respective business organization.
Conferring to Ready.gov, peril valuations spot prospective problems, however a business impact
analysis ascertains how these problems might affect a actual business. Since these two tasks go
hand-in-hand, it is useful to pronounce them together.
Hazard Categories.
Threat Origination
Category
Type Identifier
Threats launched purposefully P
Threats created by unintentional human or
machine errors U
Threats caused by environmental agents or
disruptions E
From the above table, the hazard categories are shown given identifiers each, Threats denoted by
P are malicious which are purposefully launched by ill-intended individuals.
Threats denoted by U are those that could be termed as miscelenoiuos having been launched
unintended by human or machine errors in the event of duty delivery.
The E threats are also not intended for but are as a result of natural disasters which cannot be
possibly avoided but it is wise to be included in the business plans during financing the business
operations.
3 | P a g e

Using the Securities and Exchange Commission (SEC) agency, below is the risk assessment:
Goals. The main objective of the 2012 FISMA assessment was to assess the SEC’s systems and
to give the OIG with input to the SEC’s response.
The assessment comprised of the following;
 Progressive monitoring management.
 Management configuration.
 Point and access management.
 Risk management.
 Safety training.
 Breakthrough and plan actions.
 Management remotely.
 Contingency planning.
 Contractor systems.
 Safety planning.
From the tentative risks in the above table, the probability of risks P and E occurring is very
minimal therefore we majorly concentrated on the risk U (Quinsey et.al 2010).
Evaluation Criteria.
The evaluation was based on the following;
1.The systems inventory and its quality.
2.The enterprise security architecture
3.Data and boundary protection.
4.The network security protocols
Outcomes.
The review concluded that OIT did not exhaustively conduct and document progressive
monitoring inline with certain NIST requirements. Progressive or continuous monitoring is the
process whereby organizations develop a clear strategy and implements a program for the
continuous supervision of security and safety control effectiveness. This comprises of potential
4 | P a g e

need to change or beef up a control set taking into consideration any actual or proposed changes
to the information system or its operating environs ( Assessment, P. R. 2009).
Penetration testing and loophole scanning on a continuous basis and provided NIT with its test
reports, however it was deduced that penetration testing is not sufficient enough to satisfy
continuous monitoring strategy requirements as stipulated by the SP in NIST publication(SP
800-137)
It was also noticed that some areas were not tested, between year certification and accreditation
(C&A) assessment sequence or on the continuous basis for grave safety controls. Due to this,
OIT’s progressive monitoring program required enlargements with respect to its assessing
process and performance consequently.
It was also eminent that OIT top management is entirely in compliance with FISMA and
requirements and guidelines. In spite of all these compliances, OIT failed to define baseline
(Lim,et.al 2012) configurations and there is no compliance configuration too either. In addition
to these drawbacks, OIT has not given a go ahead formal project plan to Personal Identity
Verification
and has not been implemented as technical solution link. This is to cater threats under categories
P and U.
The assessment of the SEC’s risk management strategy deduced that it does not fully address the
requirements needed for a comprehensive administrative hierarchy and the organization overall
safety risk management. Further, risk from a scheme and business process aspects are not catered
for in the assessments as identified in the NIST SP 800-37 Rev.1.2.3 as consequence
Of not updating the risk management strategy to tackle the NIST guidelines.
The result of all these drawbacks is that SEC is possibly exposed to a lot of risks as business
operation.
ID Threat Name Description Typical impact to the data systems.
T1 cat
P
Hacking It is an
intentional
Confidentiality
obviously tempered
The integrity is
also messed up
5 | P a g e

threat launched
malicious
personnel to
remotely break
in the data
systems.
with having
disclosed the
confidential
information.
with
T2 cat
U.
Errors Unintentional
threat usually
launched in the
event daily
operations.
The
confidentiality
though not
guaranteed but
can be kept
anonymously.
The integrity is
so not lost as in
the occurrence
of other threats.
T3 cat
E
Typhoon Occurs from the
massive sea
winds .
The impact here is
massive and its
usually physical, this
is not likely to occur
due to the
organization’s
location in the far
areas from massive
water bodies.
T4 cat
P
Bombing Intentional
attack launched
by use of
explosives
Massive impact of
total destruction of
the organization’s
premises.
T5 cat
U,P &
E
Communication
failures.
Can be as a
result of human
errors,
intentional
errors or as a
The impact is
evident as the
operations can
never run
smooth without
6 | P a g e

result of natural
disaster.
communication.
T6 cat
P
Emanating
issues.
Majorly
revolves around
the cybercrime
issues such as
evesdropping.
The
confidentiality
of the
organization’s
sensitive
information is
tempered with.
T7 cat
P & U
Data disclosure. This can be
intentional or
unintentional
depending on
the
circumstance.
Confidentiality
is also put to
test here.
T8 cat
U
Data Entry
Error
Human
inattention,
lack of
knowledge,
and failure to
cross-check
system
activities
could
contribute to
errors
becoming
integrated and
ingrained in
automated
Modification
7 | P a g e

systems.
T 9 cat
P
Denial of
Service
An adversary
uses
techniques to
attack a single
target
rendering it
unable to
respond and
could cause
denial of
service for
users of the
targeted
information
systems.
Denial of Service
T 10
cat P
Distributed
Denial of
Service Attack
An adversary
uses multiple
compromised
information
systems to
attack a single
target and
could cause
denial of
service for
users of the
targeted
information
systems.
Denial of Service
8 | P a g e

T 11 cat E Earthquak
e
Seismic activity can damage
the information system or its
facility. Please refer to the
following document for
earthquake probability maps
http://pubs.usgs.gov/of/2008/1
128/pdf/OF08-1128_v1.1.pdf .
Destructi
on
Denial of
Service
T 12 cat E
& P
Electroma
gnetic
Interferen
ce
Disruption of electronic and
wire transmissions could be
caused by high frequency
(HF), very high frequency
(VHF), and ultra-high
frequency (UHF)
communications devices
(jamming) or sun spots.
Denial of
Service
T13 cat P Espionage
The illegal covert act of
copying, reproducing,
recording, photographing or
intercepting to obtain sensitive
information .
Dis
clo
sur
e
Modifica
tion
T14 cat E &
P Fire
Fire can be caused by arson,
electrical problems, lightning,
chemical agents, or other
unrelated proximity fires.
Destructi
on
Denial of
Service
9 | P a g e

T15 cat E Floods
Water damage caused by flood
hazards can be caused by
proximity to local flood plains.
Flood maps and base flood
elevation should be
considered.
Destructi
on
Denial of
Service
T16 cat P Fraud
Intentional deception
regarding data or information
about an information system
could compromise the
confidentiality, integrity, or
availability of an information
system.
Dis
clo
sur
e
Modifica
tion or
Destructi
on
Unavailable
Accurate
Records
T17 cat E
Hardware
or
Equipmen
t Failure
Hardware or equipment may
fail due to a variety of reasons.
Denial of
Service
T18 cat P
Hardware
Tamperin
g
An unauthorized modification
to hardware that alters the
proper functioning of
equipment in a manner that
degrades the security
functionality the asset
provides.
Modifica
tion
Denial of
Service
10 | P a g e

T19 cat
E Hurricane
A category 1, 2, 3, 4, or 5
land falling hurricane
could impact the facilities
that house the
information systems.
Destruction Denial
of
Service
T20 cat
P
Malicious
Software
Software that damages a
system such a virus, Trojan,
or worm.
Modificatio
n or
Destruction
Denial
of
Servic
e
T21 cat
P
Phishing
Attack
Adversary attempts to
acquire sensitive
information such as
usernames, passwords, or
SSNs, by pretending to be
communications from a
legitimate/trustworthy
source.
Typical attacks occur via
email, instant messaging,
or comparable means;
commonly directing users
to Web sites that appear
to be legitimate sites,
while actually stealing the
entered information.
Disclosur
e
Modificatio
n or
Destruction
Denial
of
Service
11 | P a g e

T22 cat
E
Power
Interruptions
Power interruptions may be
due to any number of
reasons such as electrical
grid failures, generator
failures, uninterruptable
power supply failures (e.g.
spike, surge, brownout, or
blackout).
Denial
of
Servic
e
T23 cat
U
Procedural
Error
An error in procedures could
result in unintended
consequences. This is also
used where there is a lack of
defined procedures that
introduces an element of
risk.
Disclosur
e
Modificatio
n or
Destruction
Denial
of
Servic
e
T24 cat
P
Procedural
Violations
Violations of standard
procedures.
Disclosur
e
Modificatio
n or
Destruction
Denial
of
Servic
e
T25 cat
U
Resource
Exhaustion
An errant (buggy) process
may create a situation that
exhausts critical resources
preventing access to
services.
Denial
of
Servic
e
12 | P a g e

T26 cat
P Sabotage Underhand interference with
work.
Modificatio
n or
Destruction
Denial
of
Servic
e
T27 cat
P Scavenging Searching through disposal
containers (e.g. dumpsters)
to acquire unauthorized data.
Disclosur
e
T28 cat E Severe
Weather
Naturally occurring
forces of nature could
disrupt the operation of
an information system by
freezing, sleet, hail, heat,
lightning, thunderstorms,
tornados, or snowfall.
Destruction Denial
of
Servic
e
T29 cat P Social
Engineering
An attacker manipulates
people into performing
actions or divulging
confidential information,
as well as possible access
to computer systems or
facilities.
Disclosur
e
13 | P a g e

T30 cat P Software
Tampering
Unauthorized
modification of software
(e.g. files, programs,
database records) that
alters the proper
operational functions.
Modificatio
n or
Destruction
T31 cat P Terrorist
An individual performing
a deliberate violent act
could use a variety of
agents to damage the
information system, its
facility, and/or its
operations.
Modificatio
n or
Destruction
Denial
of
Servic
e
T32 cat P Theft An adversary could steal
elements of the hardware.
Denial
of
Servic
e
14 | P a g e

T33 cat P Time and
State
An attacker exploits
weaknesses in timing or
state of functions to
perform actions that
would otherwise be
prevented (e.g. race
conditions, manipulation
user state).
Disclosur
e
Modificatio
n
Denial
of
Servic
e
T34 cat E Transportation
Accidents
Transportation accidents
include train derailments,
river barge accidents,
trucking accidents, and
airlines accidents. Local
transportation accidents
typically occur when
airports, sea ports,
railroad tracks, and major
trucking routes occur in
close proximity to
systems facilities.
Likelihood of HAZMAT
cargo should be
determined when
considering the
probability of local
transportation accidents.
Destruction Denial
of
Servic
e
15 | P a g e

T35
cat P
Unauthori
zed
Facility
Access
An unauthorized individual
accesses a facility which may
result in comprises of
confidentiality, integrity, or
availability.
Disclosure Modificati
on or
Destructio
n
T36
cat P
Unauthori
zed
Systems
Access
An unauthorized user accesses a
system or data.
Disclosure Modificati
on or
Destructio
n
Risk level.
Depending on the prospective impacts of the threat, we categorize the risks in degrees with T3
being the most costly even though unlikely to occur. T1 is also a high degree risk due to the
existence of malicious groups of people especially in the competitive world and anyone could
launch attacks just bring the respective organization down. (Hsiao,et.al,2011). Risk level can also
be given in terms of the likeliness of occurrence of the risks, errors for instance are bound to
occur as long as we have operations therefore could be given highest degree, this could be
followed by any of the remaining two the order is not obvious too. The thing here is that the risk
is countered correctly able to rescue the organization and its operations and its name at large.
Recommended corrective actions.
For natural disaster risks related we can do very little about them, we can fit the lightening
arrestors or even carefully locate the organization’s premise, this however is a subject to
discussion due to the proximity to the market and the total production costs. During site location,
it is important to consider these kind of events should they arise since they pose a challenge. This
must also be done within the jurisdiction of marketing research reports since we have to put up
the premise where there is ample market as well as where the risks especially from the natural
disasters are minimal.
16 | P a g e

For the other two categories of risks we can avoid them a great deal if not entirely since they are
human initiated. We can use good security features to seal all the remote and physical security
loopholes within the organization. For this kind of risks the only solution is to put tough security
measures even though they are not hundred percent guaranteed but at least there is a chance of
securing our most sensitive data and confidentiality for that matter.
INCIDENT RESPONSE PAPER.
An incidence response paper is documented paper elaborating the responses taken or to be taken by
any organization in the event of occurrence of any disaster either natural or human caused.
to respond to the already occurred issue and the risk is posed. This can be mitigated through by
having onsite back ups and remote back ups for the cases of data loss or confidentiality issues.
Additionally the response can be pre whereby necessary security measures are put in place
earlier. Human-caused threats will always be present and especially the intended one, this
therefore calls for pre security analysis and mitigation techniques.
In any occurrence of an event termed as a risk, there should be a relevant response towards the
occurrence to be able to counter the effect.
The incidence response paper is categorized into;
Natural disaster risks under category E.
Threats or rather the occurrences in this category are not anticipated for and therefore the
response relies on the organization’s disaster response plans. For issues such as the earthquakes
or floods, the response may be to save only the savable cautiously as possible to avoid loss the
17 | P a g e

loss of lives which is very important. The risks posed by this kind of threat can be best mitigated
by having a response plan in terms of business recovery plan strategy. This is well done by
having multiple secure back up facilities and adequate funds set aside as emergency funds should
a case and a need arise.
Spare planning can be defined as the process of preparing sequentially for future contingencies,
including major incidents and disasters. The plan is usually a document, shared between parties
and stakeholders that specifies tasks and obligations adopted in the multi-agency response to the
emergency. It is a mirror for managing events and, as such, should be responsive to management
needs. It should specify the lineaments of action, collaboration, command, and communication
during a civil contingency such as a disaster or major event; in other words, it is the framework
for emergency response. The maintenance of public security, drawback of damage, protection of
the vulnerable, and efficient use of life-saving resources are some of the objectives of the plan.
Although the end product is a document, emergency planning is more of a process than an
outcome, especially as the plan itself will need to be updated over time as circumstances change.
Intentional Human posed threats under category P
The intentional human posed threats can be dealt with at two levels, post and pre occurrence. For
this case it revolves around post level whereby the organization needs
18 | P a g e

Un-intended human caused threats under category U
This kind of threats are also unavoidable having in mind imperfect nature of machines and
human labor. The response plan for the risks from this category can be managed by having the
correct business recovery plan say back ups and onsite trained personnel to help out in the
recovery process.
Risk assessment tools.
Risk assessment tools are tools developed for sole purpose of assessing the risks, the possibilities
of occurrence and the result to the welfare of the organization. My example in this response
paper is the Upstream Risk Management Framework. This is a sector- focused integrity security
and cyber risk management framework. That operates on displayed five pillars,
The audit, Policy, Planning, Management and Response and lastly implementation.
Auditing is done to give a detailed explanation how the risk or the threat occurred, policy just
elaborates the “if’s” and the result should a threat happen ,
Audit Policy
Planning.
Management
and Response plan Implementation
19 | P a g e

20 | P a g e

References
Assessment, P. R. (2009). Down syndrome: prenatal risk assessment and diagnosis. Am Fam
Physician, 62(4), 825-832.
Hsiao, Y. M. U., Moxley, D. M., Plaza, R. T., & Van Hise, D. G. (20011). U.S. Patent No.
6,266,784. Washington, DC: U.S. Patent and Trademark Office.
Lim, S. S., Vos, T., Flaxman, A. D., Danaei, G., Shibuya, K., Adair-Rohani, H., ... & Aryee, M.
(2012). A comparative risk assessment of burden of disease and injury attributable to 67
risk factors and risk factor clusters in 21 regions, 1990–2010: a systematic analysis for
the Global Burden of Disease Study 2010. The lancet, 380(9859), 2224-2260.
Oliver, D., Daly, F., Martin, F. C., & McMurdo, M. E. (2010). Risk factors and risk assessment
tools for falls in hospital in-patients: a systematic review. Age and ageing, 33(2), 122-
130.
Prosise, C., Mandia, K., & Pepe, M. (2003). Incident response & computer forensics.
Quinsey, V. L., Harris, G. T., Rice, M. E., & Cormier, C. A. (2010). Violent offenders:
Appraising and managing risk. American Psychological Association.
Steadman, H. J., Silver, E., Monahan, J., Appelbaum, P. S., Clark Robbins, P., Mulvey, E. P., ...
& Banks, S. (2008). A classification tree approach to the development of actuarial
violence risk assessment tools. Law and human behavior, 24(1), 83.
21 | P a g e