IT Risk Management: Security Risks in VIC Government Systems

This report provides a comprehensive analysis of IT risk management within the VIC government's information system. It begins by illustrating current security risks and concerns, followed by a detailed diagram analysis and risk classification, categorizing risks into high, medium, medium-low, and low exposure areas. The report then compares and ranks accidental and deliberate threats, highlighting their potential impact. Key security challenges, including modeling, regulatory, organizational, and system/data challenges, are discussed. The report differentiates between risk and uncertainty, and concludes with a focus on risk mitigation and management strategies to enhance the security posture of the VIC information system. The analysis incorporates various sources to support the findings, providing a well-rounded assessment of the topic.

Running head: IT RISK MANAGEMENT
IT Risk Management
Name of the student:
Student ID:
Name of the University:
Author’s note:

1IT RISK MANAGEMENT
Table of Contents
1. Illustration of Current Security Risks and Concerns of VIC Government..................................2
2. Diagram Analysis and Risk Classification..................................................................................3
2.1 Analysis of the Security Risks and Concerns of VIC Government Diagram........................3
2.2 Classification of the Risk and Identifying their Exposure Area............................................5
3. Comparison and Ranking of Threats...........................................................................................7
3.1 Comparing the Accidental and Deliberate Threats................................................................7
3.2 Ranking Threats for VIC Information System......................................................................8
4. Security Challenges of VIC information system.........................................................................9
5. Risk vs. Uncertainty in VIC information system.......................................................................10
6. Risk Mitigation and Management in VIC Information System.................................................12
References......................................................................................................................................13

2IT RISK MANAGEMENT
1. Illustration of Current Security Risks and Concerns of VIC Government
The VIC government has formed the project for implementing the effective and smart processing
of the report and its generation. The implementation of the VIC information system would imply
the development of the effective and smart processing of the operations. The development of the
effective and smart processing would imply the faster processing of the operations. The security
risks and concerns for VIC government due to the implication of the information system had
been pointed in the diagram below,
Figure 1: Security Risks and Concerns of VIC Government

3IT RISK MANAGEMENT
(Source: Created by the author in Ms-Visio)
2. Diagram Analysis and Risk Classification
2.1 Analysis of the Security Risks and Concerns of VIC Government Diagram
The information system development would be helpful for the integration of the
operations and formation of the effective and smart processing for VIC government. The VIC
information system had been employed for integrating the operations of the organization and
formation of the effective and smart data management. However, there are some privacy and
security risks that have impacted on the operations of the organization to develop the systematic
and effective processing of the operations. The risk analysis had shown the impact of some
functions and operations of the VIC government organization.
VIC Government: The VIC government is the primary component of the diagram for
the risk analysis of the information system. The VIC government would comprise of the users
that can actually use the information system for developing the effective and smart processing.
The VIC government would form the effective and smart processing of the information and
system integration.
Information system development: The development of the information system would
be helpful for integrating the smart processing of the development model for the organization.
The system development had helped VIC for forming the effective and smart deployment of the
operations. It would help in forming the continuation of the operations in form of the
development models. The effective and smart processing would have to face the development of
the effective processing in the organization. The factors of risk have crucial impact on the
development of the information system.

4IT RISK MANAGEMENT
Risk Analysis System: The risk analysis had shown the increment of the operational
processing and it had formed the major issues in the development of the information system in
the organization. The analysis would form the effective issues in the formation of the risk
factors. The factors of the risk include the development of the analysis that would include the
formation of the issues in the operations of the risk. The analysis of the risk would be developed
for forming the effective and smart risk management system. The risk analysis would form the
improved processing of the operations and systematic development of the strategies. The
exploitation of the risk factors would result in forming the threats of privacy concerns, data
thefts, system errors, and privacy issues. The VIC organization would have to face the major
issues in the development of the effective and smart operations for the risk analysis.
External and Internal Risk: The internal and external risk analysis had resulted in
effecting the development of the information system for VIC government. The external and
internal risk would form the major hindrances for the development of the operations of VIC
government. The external risks in the project can be defined as the factors of the risk that can
affect the operations of the project including the development of the systematic processing of the
operations. The external risks of the VIC information system implementation are cyber crimes,
theft, and user generated errors. The incremental development of the operations would form the
allowance of the some major internal risk factors for VIC government. The internal risk factors
would form the development of the major issues in the implication of the organization
processing. The factors of internal risk are design issues, denial of service, unauthorized access,
and technical issues. These factors would tend to develop hindrances in the operations of the
project.

5IT RISK MANAGEMENT
Risk Assessment: The risk assessment plays a significant role in the development of the
effective risk analysis process. Risk assessment consists of four steps,
Step 1: Identification of the risk is the first step of the risk assessment process. It involves
the process of identifying the factors of risk that can affect the information processing of VIC
government. The identification of the risk factors would form the base for building the risk
assessment process.
Step 2: Risk Analysis is done for ensuring that the activities of the risk assessment would
help in developing the effective and smart processing. The improvement of the operations would
be also responsible for carrying out the analysis of the factors of risk and development.
Step 3: Risk Evaluation is the process of evaluating the risk factors and its impact for
developing some strategies to sort out the risk. The negative risk factors would be mitigated and
their impact would be reduces by the help of some strategies developed. The positive risk factors
would be exploited for forming the effective and smart operations in the organization.
Step 4: Documentation of the risk that involves the development of a proper report for the
analysis of the factors of risk. The proper documentation would help in building the primary
analysis of the risk and its assessment process for future reference.
2.2 Classification of the Risk and Identifying their Exposure Area
The VIC information system had been employed for integrating the operations of the
organization and formation of the effective and smart data management. However, there are
some privacy and security risks that have impacted on the operations of the organization to
develop the systematic and effective processing of the operations. The risk analysis had shown

6IT RISK MANAGEMENT
the impact of some functions and operations of the VIC government organization. The various
risks of the implementing information system in VIC government are cyber crimes, theft, user
generated errors, design issues, denial of service, unauthorized access, and technical issues.
These factors can be divided into four sections with respect to the intensity of their impact on the
processes of VIC information system. The sections are high, medium, medium-low, and low risk
exposure areas. The following table would classify the risk in terms of these four categories,
Risk Type Explanation Example
High risk
exposure
areas
The high risk exposure areas have vital and critical
effect on the improvement of the operations in the
association. The risk elements would shape the
significant impact on the advancement of the
operations.
Examples of high risk
exposure areas are privacy
concerns, theft of data, and
security vulnerabilities
Medium
risk
exposure
areas
The medium risk exposure areas would be shaped
for the risk factors that have medium effect on the
operations of the data framework. The medium risk
presentation regions are dealt with for diminishing
the effect on the operations of the data arrangement
of VIC Government.
Examples of medium risk
exposure areas are
Intrusion, technical errors,
Design errors, and
Malwares.
Medium
low risk
exposure
areas
The medium low risk exposure areas try not to have
significant effect on the operations of data
arrangement of the VIC association. These risk
introduction territories are not strong for the
Examples of medium low
risk exposure areas are
denial of service and

7IT RISK MANAGEMENT
incorporation of the data preparing. spamming
Low risk
exposure
areas
The low risk exposure areas are the minimum
powerful factor for affecting the operations of the
data handling of VIC government. The handling of
these risk components would take minimal measure
of time and their effect on the VIC association is
minimum.
Examples of low risk
exposure areas are user
generated issues and errors
of social engineering.
3. Comparison and Ranking of Threats
3.1 Comparing the Accidental and Deliberate Threats
The accidental threats are developed due to some faults and are not done with any intentions
(Alcorn, Good and Pain, 2013). Some examples of the accidental threats are system flaws,
unknown file deletion, accidental data compromise, and natural disasters. The deliberate threat is
a result of some purposely carved out of activities for harming the operations of the organization
(Ali et al., 2014). Some examples of deliberate threat are theft of storage system device, virus
and malware attack, hacking and cyber crimes, and deliberate data compromise. The following
diagram would show the accidental and deliberate threat of VIC information system,

8IT RISK MANAGEMENT
Figure 2: Accidental Vs Deliberate Threats for VIC information system
(Source: Steinberg, 2016, pp.-334)
3.2 Ranking Threats for VIC Information System
Rank: 1st
Threat Type: Deliberate
Examples: Theft of Storage System Device, Virus and Malware Attack, Hacking and Cyber
Crimes, and Deliberate Data Compromise
Threat
s
Hacking and
Cyber Crimes
Deliberate Data
Compromise
Virus and
Malware attack
Theft of Storage
system device
A
C
C
I
D
E
N
T
A
L
D
E
L
I
B
E
R
A
T
E
System Flaws
Unknown File
Deletion
Accidental Data
Compromise
Natural
Disasters

9IT RISK MANAGEMENT
Explanation of the Rank: The deliberate threat is a result of some purposely carved out of
activities for harming the operations of the organization and hence its impact is very high.
Rank: 2nd
Threat Type: Accidental
Examples: System Flaws, Unknown File Deletion, Accidental Data Compromise, and Natural
Disasters
Explanation of the Rank: The accidental threats are developed due to some faults and are not
done with any intentions and hence their impact is not very high.
Table 1: Threat ranking for VIC information system
(Source: Steinberg, 2016, pp.-340)
4. Security Challenges of VIC information system
Challenges Explanation
Modeling
Challenges
As per Mans et al. (2013), the demonstrating challenges are caused because
of the ramifications of the mistakes in the planning of the framework and it
had shaped the issue in execution and operational speed of the data
preparing. The data framework improvement would need to confront the
issue of framework contrariness and development issues.
Regulatory
Challenges
As opined by Varshney (2014), the administrative issues of the VIC data is
vital and pivotal as the hazard evaluation is to a great extent subject to the
advancement for hurting the issues of the reconciliation and development of

10IT RISK MANAGEMENT
the enhanced procedures. The development of the successful and basic
operation would bring about shaping the main considerations for the
difficulties to the VIC government.
Organizational
Challenges
The framework advancement would be inferred for building up the
procedures of the operational improvement. As per Sharma et al. (2013),
the authoritative difficulties would be created for coordinating the
constrained and demeanor of the operational preparing. The advancement
of the powerful and shrewd operations would be slacked because of these
issues and operations.
System and Data
Challenges
The framework and information difficulties would be inferred for the
improvement of the data handling and it would be suggested for the
advancement of the issues in the operations of the framework information
and difficulties. As indicated by Silbey (2013), the information and
framework difficulties would bring about shaping the issues of the data
handling.
Table 2: Security Challenges of VIC information system
5. Risk vs. Uncertainty in VIC information system
Factor of comparison Risk Uncertainty
Description Risk can be characterized as
the factor that causes the
uneven deviation of the
Rasmussen (2013) have
pointed that uncertainty of
vulnerability has restricted and

11IT RISK MANAGEMENT
operational yield from the
normal result (Covello et al.,
2013).
limit affect on the operations.
Result The result for the risk can be
certain or negative contingent
on the idea of the operations.
The result for the uncertainty
could possibly have affect on
the operations relying on the
idea of the operations.
Probability High likelihood of event and
would have significant effect
on the operations
Low likelihood of event and
would have significant effect
on the operations
System of control The arrangement of control is
framed for incorporating the
advancement of the operation
and it would be shaped by
inferring the risk
administration process. The
risk administration would help
in controlling the effect of the
risk factors for the VIC
Government.
Nonappearance of any
appropriate control of
operations that bring about
causing the uncertainty
vulnerability a noteworthy
issue. Some earlier strides can
be taken for tolerating the
progressions caused by
vulnerability
Table 3: Risk vs. Uncertainty for VIC information system
(Source: Rasmussen, 2013, pp.-163)

12IT RISK MANAGEMENT
6. Risk Mitigation and Management in VIC Information System
The 5 step procedure process, analysis approach, investigation approach and strategy approach
would be helpful for developing the risk mitigation and management for VIC information
system. These procedures have been pointed in the diagram below,
Figure 4: Risk Mitigation and Management for VIC Information System
(Source: Bommer, Crowley & Pinho, 2015, pp.-646)
Risk Assessment for VIC Information System
Investigation Approach
Structure Approach
Responsive Approach
Analysis Approach
Selecting the best option
Analysing the options
5 step procedure process
1. Avoid
2. Accept or Assume
3. Transfer
4. Control
5. Monitor or Watch
Strategy approach
*) Determining appropriate risk management
*) Developing strategy for high-level
mitigation
*) Identifying steps and actions required for
implementing the mitigation strategy
*) Developing contingency plan of action

13IT RISK MANAGEMENT
References
Alcorn, A.M., Good, J. and Pain, H., (2013, July). Deliberate system-side errors as a potential
pedagogic strategy for exploratory virtual learning environments. In International
Conference on Artificial Intelligence in Education (pp. 483-492). Springer Berlin
Heidelberg
Ali, E., Denis, A. F., Kujur, F. E., & Chaudhary, M. (2014). Risk Management Strategies for
Accidental Risk Occurrence on Construction Sites–A Case Study of Allahabad. Journal
of Academia and Industrial Research (JAIR),3(2), 89.
Bommer, J. J., Crowley, H., & Pinho, R. (2015). A risk-mitigation approach to the management
of induced seismicity. Journal of Seismology, 19(2), 623-646.
Covello, V. T., Lave, L. B., Moghissi, A. A., & Uppuluri, V. R. R. (Eds.). (2013). Uncertainty in
risk assessment, risk management, and decision making (Vol. 4). Springer Science &
Business Media.
Lam, J. (2014). Enterprise risk management: from incentives to controls. John Wiley & Sons.
Mans, R. S., van der Aalst, W. M., Vanwersch, R. J., & Moleman, A. J. (2013). Process mining
in healthcare: Data challenges when answering frequently posed questions. In Process
Support and Knowledge Representation in Health Care (pp. 140-153). Springer Berlin
Heidelberg.
Nowak, B. (2013). A 5-step strategy for harnessing global information growth.Information
Management, 47(4), 42.

14IT RISK MANAGEMENT
Perera, R., & Nand, P. (2015, April). A multi-strategy approach for lexicalizing linked open data.
In International Conference on Intelligent Text Processing and Computational
Linguistics (pp. 348-363). Springer International Publishing.
Rakow, T., Heard, C. L., & Newell, B. R. (2015). Meeting Three Challenges in Risk
Communication Phenomena, Numbers, and Emotions. Policy Insights from the
Behavioral and Brain Sciences, 2(1), 147-156.
Rasmussen, S. (2013). Risk and uncertainty. In Production Economics (pp. 163-180). Springer
Berlin Heidelberg.
Sharma, B., Ingalls, R. G., Jones, C. L., & Khanchi, A. (2013). Biomass supply chain design and
analysis: basis, overview, modeling, challenges, and future. Renewable and Sustainable
Energy Reviews, 24, 608-627.
Silbey, S. S. (2013). Organizational Challenges to Regulatory Enforcement and Compliance A
New Common Sense about Regulation. The Annals of the American Academy of Political
and Social Science, 649(1), 6-20.
Steinberg, A. N. (2016). A model for threat assessment. In Fusion Methodologies in Crisis
Management (pp. 313-340). Springer International Publishing.
Sun, Y., & Han, J. (2013). Mining heterogeneous information networks: a structural analysis
approach. ACM SIGKDD Explorations Newsletter, 14(2), 20-28.
Varshney, U. (2014). The Regulatory Issues Affecting Mobile Financial Systems: Promises,
Challenges, and a Research Agenda. Communications of the Association for Information
Systems, 34(1), 75.