ICT 596 - IT Risk Management Report: ABC Company Risk Assessment

This report assesses the IT risk management strategies of ABC Company, a small IT firm developing innovative software. It identifies risks associated with storing codes on a public server, weak passwords, unrestricted internet usage, and inadequate security protocols. The report includes a risk register detailing potential threats like data loss, unauthorized access, and network vulnerabilities. Recommendations include implementing online cloud storage, stronger security measures (antivirus, firewalls), improved network topology, and regular software updates. The analysis emphasizes the need for enhanced data protection, secure databases, and a robust backup and recovery system to mitigate cyber threats and ensure data privacy.

Running head: IT RISK MANAGEMENT
IT Risk Management
(Assessment 3)
Name of the Student
Name of the University

2
IT RISK MANAGEMENT
Table of Contents
Executive Summary.......................................................................................................................3
Risk Assessment............................................................................................................................3
Summary of protection mechanism and recommendations...........................................................6
Further recommendations..............................................................................................................7
References......................................................................................................................................8

3
IT RISK MANAGEMENT
Executive Summary
This report has been focused on the risk management strategies used in the ABC
Company. ABC Company is a small IT company which has been working on an innovative
software that is to be sold in near future. However, codes are stored in a public server over the
internet. The company has been focusing on improving their management functions in order to
provide better managerial skills among employees. The company needs to implement new
software and operating systems with latest patches and use strong passwords for the systems.
However, several important passwords are known by employees of the company. Therefore,
there have been high risks in the workplace environment of the company. The company need
to install network security protocols and star topology for connecting several computers and
servers. Therefore, there is requirement of risk analysis in the organization for minimizing
different risks involved in this case. The use of internet in the Company has not been
restricted, that has been creating cyber-threats to private information of the company. This
report has focused on identifying different risks involved in the ABC Company. A risk register
has been provided that helps in identifying different risks and analyze it properly. The
company needs to implement online loud storage for storing data and information. Various
recommendations have been provided in the report that help in mitigating these risk involved
in the company. The Company needs to install several security protocols including antivirus
and firewalls for securing data and information over the internet. The company needs to use
online database with private facility. The company needs to change the disk storage system of
data and information and implement cloud storage. This might help in providing extra storage
and security to data and information.

4
IT RISK MANAGEMENT
Risk Assessment
Risk assessment deals with the identification of risks in organizations and provide
suitable solutions and framework for risk preventions and risk mitigation. In this case, ABC
Company has been facing various risks due to poor management strategies. The use of the
risks assessment involve various steps including risk identification, assessing risks, risk
controlling and risk mitigation (Hillson & Murray-Webster, 2017). Risk Assessment has
helped in providing smart approach in identifying a crucial role of risks in the projects. Risks
are identified using risk assessment proves and analyzed properly with the management of
proper related schemes. This help in planning various approaches to mitigate these risks in the
project.
20
10
10
10
20
10
20
Cyber Issues Data Recovery Backup Infrastructure issues
Data Loss Network Security Weak passwords
Figure 1: Pie chart showing impact of risks in ABC Company
(Source: Created by Author)

5
IT RISK MANAGEMENT
These steps help in analyzing risks involved in the ABC Company. The company
needs to implement online loud storage for storing data and information. Risk identification
process helps in finding different types of risks involved in the company. The company has
been facing privacy risks in the management (Fiksel, 2015). The passwords of various private
portals and data have been shared with the employees that creates privacy issue. The use of
the internet has not been restricted for the employee. Therefore, this has been creating cyber
threats to the company (Hopkin, 2018). The company has been facing storage issues in their
operations. There have been issues in infrastructure of the ABC Company. The company
needs to implement new software and operating systems with latest patches and use strong
passwords for the systems. The maintenance of hardware and software elements of the
company has not been appropriate. Data used to store on disks in the boxes. Data files and
information are stored in the disk that might get corrupted. The company needs to implement
several private databases where confidential data can be stored and passwords are kept secret.
The company needs to implement new software and operating systems with latest patches and
use strong passwords for the systems. In case, disks got corrupted, all data and information get
lost. Therefore, this have been a high risk for the company. The company needs to implement
new versions of hardware and software for increasing efficiency and security of systems.
Workstations and passwords have been outdated and passwords are not strong and in the name
of the machines. The security instrument of the ABC Company has been poor. The
organization has been deficient in the security of different framework utilized. Thusly, there
has been hazard evaluation done so as to deal with these risks (Harris, 2017).
The investigation of the risks infers that there have been need of security conventions
to be executed in the ABC Company. The organization needs to actualize new programming

6
IT RISK MANAGEMENT
and working frameworks with most recent fixes and utilize solid passwords for the
frameworks. Documents and information and have been in peril because of shaky system
approach. The organization needs to enhance the topology of systems and servers association
(Sadgrove, 2016). The protection of information and data should be anchored legitimately.
Workstations and passwords have been obsolete and passwords are not solid and for the sake
of the machines. The hazard evaluation report has helped in surveying these risks with
legitimate relief methodologies. The best administration of the organization should be
dynamic in actualizing these moderation methodologies in the organization. The organization
needs to execute a few private databases where classified information can be put away and
passwords are kept mystery. The organization need to actualize Cloud stockpiling for
reinforcement and recuperation framework. There have been various cyber-attacks on servers
of the company. The risk register have been mentioned below:

7
IT RISK MANAGEMENT
Oper
ationa
l Risk
no.
Date
Iden
tifie
d
Oper
ationa
l Risk
name
Descr
iption
of
Risk
(inclu
ding
any
identi
fied
‘trigg
ers’)
Impact
or
Conseq
uences
(Identif
y
conseq
uences
1)
Assessment of
Likelihood
Assessment of
Seriousness
Grade (combined Key
Cont
rols
Assessment of
Likelihood
Assessment of
Impact
Mitigation Actions
Action
Owner
C
o
st
Tim
eline
for
miti
gatio
n
actio
n(s)
Date
Actio
n
Com
plete
d
1 Pleas
e fill
Data
Threat
Data
files
and
infor
matio
n are
stored
in the
disk
that
might
get
corru
pted
This
might
create a
huge
loss to
the
ABC
Compa
ny in
the
market.
4 4 H The
comp
any
needs
to
imple
ment
onlin
e
loud
storag
e for
storin
g data
and
infor
matio
n
x
x
x
The
compa
ny
needs
to
imple
ment
online
loud
storag
e for
storing
data
and
inform
ation
The
data
adminis
trator of
the
compan
y is
responsi
ble for
the
change.
$
2
0
0
6
days
Pleas
e fill
2 Please
fill
Unauth
orized
usage
The
employ
ees are
able to
access
various
private
inform
ation
of the
Compa
ny.
This
create
privacy
issues
in the
confide
ntial
data
and
informa
tion of
the
Compa
ny.
3 2 M The
comp
any
needs
to
chang
e the
priva
cy
attrib
ute of
data.
x
x
x
The
compa
ny
needs
to
imple
ment
severa
l
private
databa
ses
where
confid
ential
data
can be
stored
and
passw
ords
are
kept
secret.
The
data
adminis
trator is
responsi
ble for
the
mitigati
on
strategy
.
$
5
0
10
days
Pleas
e fill
3 Please
fill
Techni
cal
issues
The
infrastr
ucture
of the
compa
ny has
been
poor
and
outdate
d.
The
functio
nality
of the
compan
y has
been
degradi
ng with
the use
of old
version
s of
hardwa
re and
softwar
e.
2 2 M The
comp
any
have
to
chang
e the
versio
n of
softw
are
and
hard
ware
used
in the
syste
m.
x
x
x
The
comp
any
needs
to
imple
ment
new
versi
ons
of
hard
ware
and
softw
are
for
incre
asing
The
R&D is
responsi
ble for
implem
enting
this
mitigati
on
strategy
.
$
1
0
0
20
days
Pleas
e fill
1

8
IT RISK MANAGEMENT
effici
ency
and
secur
ity of
syste
ms.

9
IT RISK MANAGEMENT
4 Please
fill
Networ
k issues
The
networ
k
securit
y of the
compa
ny has
been
poor.
The
networ
k has
been
unsecur
e to
cyber-
attacks.
5 5 H The
comp
any
need
to
chang
e the
securi
ty
polici
es.
x
x
x
The
compa
ny
needs
to
imple
ment
firewa
lls and
antivir
us for
securi
ng
online
data
and
inform
ation.
The
research
and
develop
ment
team is
responsi
ble fir
the
implem
entation
of this
mitigati
on
strategy
.
$
7
5
11
days
5 Please
fill
Recove
ry and
backup
There
has
been
no
backup
and
recover
y
system
installe
d in the
compa
ny.
Lack in
backup
and
recover
y
system
might
cause
data
loss to
the
compan
y.
4 4 H The
comp
any
need
to
install
backu
p and
recov
ery
store
point
in the
syste
m.
x
x
x
The
compa
ny
need
to
imple
ment
Cloud
storag
e for
backu
p and
recove
ry
system
.
The
adminis
tration
departm
ent is
responsi
ble for
the
implem
entation
of this
mitigati
on
strategy
.
$
5
0
14
days
Pleas
e fill
6 Please
fill
Topolo
gy
issues
The
core
networ
ks and
servers
of the
compa
ny
have
no
networ
k
securit
y and
also
connec
ted
with a
single
LAN
cable.
This
might
create
issues
in the
networ
k of the
compan
y and
internet
connect
ion
might
be
interrup
ted due
to
single
LAN
cable
connect
ion.
3 3 M The
comp
any
need
to
chang
e
netwo
rk
securi
ty
polici
es
and
topol
ogy
of the
netwo
rk.
x
x
x
The
compa
ny
need
to
install
networ
k
securit
y
protoc
ols
and
star
topolo
gy for
conne
cting
severa
l
compu
ters
and
server
s.
The
manage
ment
team
needs to
implem
ent this
mitigati
on
strategy
in the
compan
y.
$
5
0
9
days
Pleas
e fill
7 Please
fill
Passwo
rd risks
Workst
ations
and
passwo
rds
have
been
outdate
d and
passwo
rds are
not
strong
and in
the
name
Lack in
efficien
cy and
security
breach
in the
machin
es as
machin
e
names
are
used as
passwo
rds.
3 4 H The
comp
any
need
to
chang
e
softw
are
and
opera
ting
syste
m
with
active
x
x
x
The
compa
ny
needs
to
imple
ment
new
softwa
re and
operati
ng
system
s with
latest
patche
The
manage
ment
departm
ent of
the
compan
y is
responsi
ble for
the
implem
entation
of these
mitigati
on
$
1
0
0
7
days
Pleas
e fill

10
IT RISK MANAGEMENT
of the
machin
es.
patch
es
and
chang
e
passw
ords
s and
use
strong
passw
ords
for the
system
s.
strategi
es.

11
IT RISK MANAGEMENT
Summary of protection mechanism and recommendations
The security mechanism of the ABC Company has been poor. The company has been
lacking in the security of various system used. Therefore, there has been risk assessment done
in order to manage these risks (Harris, 2017). The analysis of the risks implies that there have
been need of security protocols to be implemented in the ABC Company. The company needs
to implement new software and operating systems with latest patches and use strong
passwords for the systems. Files and data and have been in danger due to insecure network
policy. The company needs to improve the topology of networks and servers connection
(Sadgrove, 2016). The privacy of data and information needs to be secured properly.
Workstations and passwords have been outdated and passwords are not strong and in the name
of the machines. The risk assessment report has helped in assessing these risks with proper
mitigation strategies. The top management of the company needs to be active in implementing
these mitigation strategies in the company. The company needs to implement several private
databases where confidential data can be stored and passwords are kept secret. The company
need to implement Cloud storage for backup and recovery system. Cyber security has been the
main concern for the ABC Company. Following are the recommendations for the ABC
Company:
Firewalls: Firewalls are software that helps in restricting harmful malware from
entering into the server. It also help in filtering flow of data over the internet. Firewall
provides security to the servers and networks and create a virtual wall over it (Aven, 2016).
Therefore, ABC Company needs to install firewall for restricting malware. The company need
to install network security protocols and star topology for connecting several computers and
servers.

12
IT RISK MANAGEMENT
Antivirus: Antivirus is a software that helps in detecting malware and viruses in the
network and server. Antivirus helps in removing these malwares from the entering into the
network. The company needs to implement new versions of hardware and software for
increasing efficiency and security of systems.
Cloud Storage: The ABC Company needs to implement cloud services for storage and
backup services. The Company needs to store their data and information over the Cloud that
helps in easy use and securing a backup point over the internet (Djemame et al., 2016). This
can be helpful in the maintenance of storage point over the cloud. The company need to
implement Cloud storage for backup and recovery system. The use of the cloud storage has
been helping in maintaining smart approach in the storage functions. The company needs to
implement firewalls and antivirus for securing online data and information. Therefore this will
help in providing security to the data and information stored over the internet.
Further recommendations
There are few more recommendations that can be implemented by the ABC Company
that are listed below:
Topology maintenance: The topology of the connections of servers and network need
to be change in the ABC network. Currently, the company has been using only one LAN cable
for connecting all the servers and networks (Biener, Eling & Wirfs, 2015). The company needs
to change into star topology for connecting various servers and networks. The company needs
to implement firewalls and antivirus for securing online data and information. The topology of
the network needs to be maintained properly in the system so that use of the connection for
implementing computers needs to be smart.