Risk Assessment and Analysis Framework

This assignment delves into the crucial process of risk assessment and analysis. It explores various frameworks and methodologies used to identify, analyze, and evaluate potential threats and vulnerabilities. Students will gain insights into different types of risks, tools for risk analysis, and strategies for mitigating identified risks. The emphasis is on understanding the systematic approach involved in risk management and its application in real-world scenarios.

Running head: RISK ASSESSMENT AND ANALYSIS
Risk Assessment and Analysis
Name of the Student:
Student ID:
Name of the University:
Author’s note:

1RISK ASSESSMENT AND ANALYSIS
Table of Contents
Introduction......................................................................................................................................2
1. Illustration of Security Risks and Threats in VIC Government..................................................2
2. Explanation of the Diagram and Categorization of Risk Factors................................................3
2.1 Description of the components of diagram............................................................................3
2.2 Classification of Risk Exposure Areas..................................................................................7
3. Comparison and Ranking of Accidental and Deliberate Threats................................................8
4. Security and Risk Management Challenges for VIC government...............................................9
5. Comparing Risk and Uncertainty................................................................................................9
6. Risk Mitigation and Management.............................................................................................10
Conclusion.....................................................................................................................................11
References......................................................................................................................................12

2RISK ASSESSMENT AND ANALYSIS
Introduction
The information system development had been largely responsible for the development
of the effective and smart operations of the organization. The deployment of the effective and
smart operations would be helpful for carving the systematic flow of operations and integrating
the systematic flow of the diagram. The employment of the effective operations would result in
forming the deployment of the operations of the organization. The flow of the operations would
form the major implementation of the information system.
The report would be developed for forming the analysis of the various risk factors and
their impact on the development of the operations. The implementation of the operations would
be helpful in forming the effective development of the functions in the organization. The
development of the improved services would be the primary concern for the development and
implementation of the information system. This report would highlight the development of the
improved services in the organization and it would help in integrating the existing functions of
the VIC.
1. Illustration of Security Risks and Threats in VIC Government
The following diagram would be helpful in analysis of the risk factors for VIC
government as it had highlighted the major factors of the risk and threats to the information
system implementation in VIC Government,

3RISK ASSESSMENT AND ANALYSIS
Figure 1: Factors of Risk and Threats in information system of VIC Government
(Source: Created by the author in Ms-Visio)
2. Explanation of the Diagram and Categorization of Risk Factors
2.1 Description of the components of diagram
The diagram had been developed by using the Ms-Visio Software and it includes all the
major components of the risk or threats for implementation of the information system in VIC
Government. The risk analysis had considered the threats and its classification in accidental and
deliberate. However, the risk can be classified into internal and external risks depending on the
source of the actions. The brief explanation of the components used in the diagram is given
below,

4RISK ASSESSMENT AND ANALYSIS
VIC Government: The users of the implemented information system can be represented
as the VIC government in the diagram. The data and information stored in the information
system are stored for the VIC government. The government acts as the primary stakeholder for
the information system and it serves the role of user and sponsor (Von Solms & Van Niekerk,
2013). Moreover, the most crucial impact of the implementation of the information system is on
the members of VIC Government whose data has been stored in the organization. The VIC
government symbolizes the number of persons and government departments whose data and
information would be stored on the implemented information system.
Information Management System: The system that has been implemented for VIC
government is Information Management System. The information management system would
comprise of developing the effective and smart operations for VIC government. The information
management system would help the government for carrying out smoother operations. According
to Bommer, Crowley and Pinho (2015), the implementation of the operations of information
management system would form the base of storage and access to data for VIC Government. The
development of the operations would also form the influence of the improved processes for
integrating the operations and development of the improvement facilities.
Codes of Practices: The code of practice is a basic set of norms and rules developed by
the government computer society for being able to stimulate and develop the improvement plan
of operations in the system. The code of practices has been set by Australian Computer Society
for managing the integrity of operations related to computer devices. The code of practice is
termed as ISO/IEC.AC/AZS 17799:2001 and it results in development of the ethically correct
and cohesive practices of the operations. The implication of the smart processing would help in
forming the development of the system integration for the organizational processing.

5RISK ASSESSMENT AND ANALYSIS
Risk and Threats: Bommer, Crowley and Pinho (2015) defined risk as those factors that
have a considerable impact of accelerating or retarding the flow of operations in the
organization. The threats can be consider as the factors having immediate danger for the
completion of the operations. The systematic flow of operations in the information system would
be halted due to the various processes of the operations. The threats have endangered the security
and privacy of the operations of the organization. The implementation of the operations would
divulge due to the impact of the threats on the operation of the organization. The various threats
and risks in the implementation of information system for VIC Government are failure of
outsourced operations, staff errors, technical failures, industrial action, theft and fraud, piracy of
software, unauthorized software, unauthorized access, denial of service, programming errors,
loss of information, failure of communication, transmission errors, website intrusion, malwares,
eavesdropping, and social engineering issue.
Accidental and Deliberate Threats: The risk analysis had considered the threats and its
classification in accidental and deliberate. Alcorn, Good and Pain (2013) have contrasted
accidental and deliberate threats as two factors. The accidental threats would serve the
classification of the operations gone wrong. The accidental threats would be developed without
any intention of harming the information system in the organization. The development of the
effective and smart operations would be helpful for critically evaluating the operations in the
organization. The accidental threats would hinder the effective and smart processing of the
information in VIC government. Some of the accidental threats of the VIC information
management system implementation are failure of outsourced operations, staff errors, technical
failures, loss of information, transmission errors, failure of communication, and programming
errors. On the contrary deliberate threats are intentionally done activities that had been done for

6RISK ASSESSMENT AND ANALYSIS
harming the operations of the organization (Von Solms & Van Niekerk, 2013). The development
of the effective and smart operations would be helpful for critically evaluating the operations in
the organization. The deliberate threats would hinder the security and privacy of the information
in VIC government. Some of the deliberate threats of the VIC information management system
implementation are unauthorized software, eavesdropping, theft and fraud, website intrusion,
piracy of software, unauthorized access, social engineering issue, industrial action, malwares,
and denial of service.
External and Internal Threats: As opined by Lam (2014), the risk factors in the
implementation of the information system at VIC can be classified into external and internal
threats. Man et al. (2013) have defined external threats for the VIC government as the external
factors that have affected the development of the system privacy and security. These factors have
significant influence in hindering the development of the effective and smart operations. The
various threats of external threat are denial of service, technical failures, unauthorized access,
programming errors, transmission errors, website intrusion, malwares, and eavesdropping. The
implication of the internal threats would be implied for hindering the development of the
operations and it would form the major influence in critical evaluation of the information system.
The internal factors would benefit the implication of the operations and it would form the
hindrance of the operations in the development of the information system (Alcorn, Good & Pain,
2013). The various threats of internal threat are failure of outsourced operations, staff errors,
unauthorized software, social engineering issue, loss of information, piracy of software, failure
of communication, and industrial action.

7RISK ASSESSMENT AND ANALYSIS
2.2 Classification of Risk Exposure Areas
Lam (2014) has classified the area of the impact of risk in terms of high, medium,
medium-low, and low risk exposure areas. The implementation of the information system for
VIC government would be implied for the development of the information system. The
classification would form the implication of the information system and development of the
analysis of the risk exposure areas. The High Risk Exposure Areas are factors of risk that have
critical impact on the operations of the organization and it had resulted in forming the
development of the serious concerns for the VIC government organization. The implementation
of the information system would have to face the high probability of the occurrence of the
development of operations. The high risk exposure areas are intrusion, phishing, malware, and
data theft. The Medium Risk Exposure Areas are the factors of risk that have moderate impact
on the operations of the organization and it has resulted in forming major impact on the
operations of the organization. The VIC government organization would result in forming the
lower probability of the occurrence of operations. The medium risk exposure areas are issues of
design, data misinterpretation, and software issues. The Medium Low Risk Exposure Areas
are the factors of risk that have minor impact on the operations of the organization and it has
resulted in forming minor impact on the operations of the organization. The VIC government
organization would result in forming low probability of occurrence of operations. The medium
low risk exposure areas are wrong data entry, data incompatibility, and integration issue. The
Low Risk Exposure Areas are the factors of risk that have no significant impact on the
operations of the organization and it has resulted in forming least impact on the operations of the
organization. The VIC government organization would result in forming lowest probability of

8RISK ASSESSMENT AND ANALYSIS
occurrence of operations. The low risk exposure areas are social engineering issues and errors
generated by the users.
3. Comparison and Ranking of Accidental and Deliberate Threats
Accidental and Deliberate threats for the VIC government information system
implementation is compared in the table below,
Rank Description Examples Justification of
ranking
1st The deliberate threats are
intentionally done activities
that had been done for
harming the operations of the
organization (Von Solms &
Van Niekerk, 2013).
The deliberate threats would
hinder the security and
privacy of the information in
VIC government.
Some of the deliberate threats of
the VIC information management
system implementation are
unauthorized software,
eavesdropping, theft and fraud,
website intrusion, piracy of
software, unauthorized access,
social engineering issue, industrial
action, malwares, and denial of
service.
Since the threat is
done purposely
and intentionally
it had been ranked
1st
2nd According to Alcorn, Good
and Pain (2013), the
accidental threats would serve
the classification of the
operations gone wrong. The
accidental threats would be
developed without any
intention of harming the
information system in the
organization.
Some of the accidental threats of
the VIC information management
system implementation are failure
of outsourced operations, staff
errors, technical failures, loss of
information, transmission errors,
failure of communication, and
programming errors.
Since the threat is
done without any
motive or
intention, it has
been given ranked
2nd
Table 1: Comparison of Accidental and Deliberate Threats for VIC government

9RISK ASSESSMENT AND ANALYSIS
4. Security and Risk Management Challenges for VIC government
The implementation of the VIC government would have to face some risk and challenges
for the development of the information system in the VIC government. The security and risk
management challenges are,
Security Challenges: Rasmussen (2013) has pointed out that the implementation of the
information system would involve the development of the security challenges for VIC
government. The eavesdropping, theft and fraud, website intrusion, unauthorized access,
malwares, and denial of service are the major issues and security challenges for VIC
government.
Operational Challenges: The operational challenges of VIC government are resulted
when the information system implemented would not be able to accommodate the operations of
the organization (Rasmussen, 2013). The social engineering issue, industrial action, failure of
outsourced operations, loss of information, transmission errors, failure of communication, and
programming errors are the major issues and operational challenges for VIC government.
5. Comparing Risk and Uncertainty
Silbey (2013) defined risk as those factors that have a considerable impact of accelerating
or retarding the flow of operations in the organization. The threats can be consider as the factors
having immediate danger for the completion of the operations. The systematic flow of operations
in the information system would be halted due to the various processes of the operations. The
risks are the technical failures, unauthorized access, theft and fraud, transmission errors, and
malwares, and website intrusion.

10RISK ASSESSMENT AND ANALYSIS
Covello et al. (2013) has explained uncertainty as the factor for the development of the
operations of the unpredictability and information processing. The VIC government would
involve the implementation of the effective and improved processes. However, the
unpredictability of operations would imply the effective and improved processing of VIC. The
uncertainties are the failure of outsourced operations, industrial action, and failure of
communication, social engineering issue, and transmission errors.
6. Risk Mitigation and Management
The risk mitigation and management would be helpful for the implementing the effective
and improved processing of the operations. The analysis of the risk mitigation and management
are,
Risk Identification: The identification of the risk factor would be implied for the
development of the effective and improved analysis of the risk factor. The identification of the
risk are evaluated for identifying the factors of risk in the operations.
Risk Analysis: The analysis of the risk would be implied for forming the development of
the risk and prioritizing them for the improvement of the operations. The analysis has formed the
development of the operations in risk identification.
Risk Mitigation: The mitigation of the risk can be done by forming the effective risk
mitigation strategies and implementing them for forming the effective deployment of the
operations. The implementation of the risk mitigation would involve the deployment of the
effective and smart processing of the operations.

11RISK ASSESSMENT AND ANALYSIS
Risk Evaluation: The evaluation is used for forming the accurate and systematic and
improved processing of the operations. The evaluation would tend to form the development of
the effective and improved processing.
Conclusion
The integration of the information processing was largely responsible for the
development of operations in VIC Government and it could be achieved by developing the
effective risk management operations. The threats of implementing the information system at
VIC Government were failure of outsourced operations, staff errors, technical failures, industrial
action, theft and fraud, piracy of software, unauthorized software, unauthorized access, denial of
service, programming errors, loss of information, failure of communication, transmission errors,
website intrusion, malwares, eavesdropping, and social engineering issue. The risk assessments
had helped in integrating the development of the proper risk plan and its impact for the
systematic development of operations. The management of the operations formed the faster and
improved functions to implement the systematic and improved processing of the organization.
The risks caused the sluggish in the development of the operations and it would form hindrances
for carrying out the operations of the VIC government. The security threats or risk factors were
highly responsible for harming the flow of operations and resulting in direct or indirect harm to
the stakeholders. The implementation of the information system for VIC government consisted
of dividing the risk into high, medium, medium-low, and low risk exposure areas and analysing
them in terms of accidental and deliberate threat.

12RISK ASSESSMENT AND ANALYSIS
References
Alcorn, A.M., Good, J. and Pain, H., (2013, July). Deliberate system-side errors as a potential
pedagogic strategy for exploratory virtual learning environments. In International
Conference on Artificial Intelligence in Education (pp. 483-492). Springer Berlin
Heidelberg
Ali, E., Denis, A. F., Kujur, F. E., & Chaudhary, M. (2014). Risk Management Strategies for
Accidental Risk Occurrence on Construction Sites–A Case Study of Allahabad. Journal
of Academia and Industrial Research (JAIR),3(2), 89.
Bommer, J. J., Crowley, H., & Pinho, R. (2015). A risk-mitigation approach to the management
of induced seismicity. Journal of Seismology, 19(2), 623-646.
Covello, V. T., Lave, L. B., Moghissi, A. A., & Uppuluri, V. R. R. (Eds.). (2013). Uncertainty in
risk assessment, risk management, and decision making (Vol. 4). Springer Science &
Business Media.
Healey, A. N. (2016). The insider threat to nuclear safety and security. Security Journal, 29(1),
23-38.
Lam, J. (2014). Enterprise risk management: from incentives to controls. John Wiley & Sons.
Mans, R. S., van der Aalst, W. M., Vanwersch, R. J., & Moleman, A. J. (2013). Process mining
in healthcare: Data challenges when answering frequently posed questions. In Process
Support and Knowledge Representation in Health Care (pp. 140-153). Springer Berlin
Heidelberg.

13RISK ASSESSMENT AND ANALYSIS
Nowak, B. (2013). A 5-step strategy for harnessing global information growth.Information
Management, 47(4), 42.
Perera, R., & Nand, P. (2015, April). A multi-strategy approach for lexicalizing linked open data.
In International Conference on Intelligent Text Processing and Computational
Linguistics (pp. 348-363). Springer International Publishing.
Rakow, T., Heard, C. L., & Newell, B. R. (2015). Meeting Three Challenges in Risk
Communication Phenomena, Numbers, and Emotions. Policy Insights from the
Behavioral and Brain Sciences, 2(1), 147-156.
Rasmussen, S. (2013). Risk and uncertainty. In Production Economics (pp. 163-180). Springer
Berlin Heidelberg.
Silbey, S. S. (2013). Organizational Challenges to Regulatory Enforcement and Compliance A
New Common Sense about Regulation. The Annals of the American Academy of Political
and Social Science, 649(1), 6-20.
Spring, J. (2014). Fall 2014 SEI Research Review: Malware Analysis. CARNEGIE-MELLON
UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST.
Steinberg, A. N. (2016). A model for threat assessment. In Fusion Methodologies in Crisis
Management (pp. 313-340). Springer International Publishing.
Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber
security. computers & security, 38, 97-102.