CMGT/433 - Risk and Vulnerability Management: A Comprehensive Report

This report provides a comprehensive overview of risk and vulnerability management within an organizational context. It begins by defining risk and its types, positive and negative, and then explores mitigation strategies. The report details vulnerability management, including its objectives (asset discovery, vulnerability assessment, threat detection, behavior monitoring, and security intelligence) and the vulnerability management process cycle (scanning, remediation, reporting, and repeat). Contingency planning is also covered, outlining its major components (BIA, IRP, DRP, and BCP) and the six steps involved in the contingency process. The report emphasizes the importance of incident response and references key sources for further study. This analysis is crucial for understanding how organizations can proactively identify, assess, and manage potential threats to ensure business continuity and security.

RISK AND VULNERABILITY
MANAGEMENT IN THE ORGNAIZATION

RISK:
Risk is he the unpredictable event happened during
the course of the development of the project or event.
There are two types of risks:
Positive Risk: Responsible for creating the new
opportunities for the organization or the project.
Negative Risk: Responsible for creating the constraints.

MITIGATION OF THREATS AND VULNERABILITIES OF
THE RISK IN THE ORGNAIZATION:
There are various ways for the mitigation of the threats from
the risks in the organization. Of these are-
Identification of the risk: This can be done in the risk analysis phase.
The issues and the challenges for the organization is needed to be
identified in this phase.
Assigning priority for each risk: Assigning priority for each risk is
important as it will help in making the scheduling for the solving of
the risks.
These steps are helpful for the mitigation of threats from the risks in
the organization. All these steps are included in the risk management
planning.

MAJOR COMPONENETS OF
CONTINGENCY PLANNING:
Generally there are four components of contingency
planning. These four components are:
Business Impact Analysis (BIA): This component is concerned
about the impact of the risks on the business.
Incident Response Planning (IRP) : This component is concerned
about the taking the quick response if the sudden threat can appear
due to the risk is happened.
Disaster Recovery Planning (DRP): This component is concerned
about the restoring the whole system after the occurrence of the
risks.
Business Continuity planning (BCP): BCP is concerned about the
planning of the business in a simple way in case of the damage from
the risk has major impact on the system or the organization.

Cont.
There are six steps in the contingency
process. These six steps are-
Identification of the objective and functionality of the
business.
•Identification of the resources.
•Anticipating potential disasters.
•Selection of the right strategy.
•Implementation of the selected strategy.
•Testing the strategy.

VULNERABILITY MANAGEMENT:
Vulnerability management is a security practice
which is responsible for the mitigation of the security and
the threats from the risks and issues in the organization.
The objectives of the vulnerability management are
discovery of assets, assessment of vulnerabilities,
detection of threats, monitoring of the behavior and
security intelligence.

Cont.
Vulnerability is the process for the mitigation of
threats in the organization. This process includes the
identification of the threats in the different organizational
components. There are several frameworks for the
vulnerability management:
•Asset Discovery
•Assessment of vulnerability
•Detection of the threat
•Monitoring of the behavior
•Security intelligence

STEPS IN THE VULNERABILITY MANAGEMENT PROCESS:
Vulnerability management is a continuous process. There
are several steps in the cycle of the process regarding the
vulnerability management. These are-
• Scanning
•Remediation
•Reporting
•Repeat
Some of the significant functions of the vulnerability
management process are:
•Finding the missing patches.
•Detecting the systems which are misconfigured.
•Finding the vulnerabilities in the services or the applications in the
system.
•Assigning the priority of the vulnerabilities detected.
•Verification of the technology used in the system.
•Detection of the unauthorized devices.
•Reporting all the vulnerabilities.

RISKS IN THE INCIDENT
RESPONSE:
Incident response: It is a component of the
contingency planning process. This component is
concerned about taking the required actions in case
if the risk poses a threat for the organization. In this
case the identification of the risk is important.

References:
Bromiley, P., McShane, M., Nair, A., & Rustambekov, E. (2015).
Enterprise risk management: Review, critique, and research
directions. Long range planning, 48(4), 265-276.
Hillson, D., & Murray-Webster, R. (2017). Understanding and
managing risk attitude. Routledge.
Lodge, D. M., Simonin, P. W., Burgiel, S. W., Keller, R. P., Bossenbroek,
J. M., Jerde, C. L., ... & Chadderton, W. L. (2016). Risk analysis and
bioeconomics of invasive species to inform policy and
management. Annual Review of Environment and Resources, 41.
Mechler, R. (2016). Reviewing estimates of the economic efficiency of
disaster risk management: opportunities and limitations of using risk-
based cost–benefit analysis. Natural Hazards, 81(3), 2121-2147.
Modarres, M. (2016). Risk analysis in engineering: techniques, tools,
and trends. CRC press.
Sadgrove, K. (2016). The complete guide to business risk
management. Routledge.
Slovic, P. (2016). The perception of risk. Routledge.
Wehn, U., Rusca, M., Evers, J., & Lanfranchi, V. (2015). Participation in
flood risk management and the potential of citizen observatories: A
governance analysis. Environmental Science & Policy, 48, 225-236.

THANK YOU