DISASTER PREVENTION AND RECOVERY

1. Explain steps involved in risk analysis

1.1. Six step of the risk management process

1.1.1. Identify - to identify risk so that the operations staff becomes aware of potential problems. not only should risk identification be undertaken as early as possible, but it also should be repeated frequently

1.1.2. Analyze and prioritize - enables operations to commit resource to manage the most important risk

1.1.3. Plan and schedule - ensures that these plans are approved and then incorporated into the standard day-to-day processes and infrastructure

1.1.4. Track and report - risk tracking monitors the status of specific risk and the progress in their respective action plan. it also includes monitoring the probability, impact, exposure, and other measures of risk for changes that could alter priority or risk plans and ultimately the availability of the service. Reporting is to ensures that the operation staff, service manager and other stakeholder are aware of the status of top risks and the plans of manage them

1.1.5. Control-is the process of executing risk action plans and their associated status reporting. it also includes initiating change control requests when changes in risk status or risk plans could affect the availability of the service or service level agreement(SLA)

1.1.6. Learn - formalizes the lessons learned and users tool to capture, categorize and index that knowledge in a reusable form that can be shared with others

2. explain risk management process

2.1. the systematic application of management policies, procedures and practices to the tasks of establishing the context, identifying, analysing, assessing, treating, monitoring and communicating

2.2. simple process

2.2.1. identify risk

2.2.2. identify the causes

2.2.3. identify the controls

2.2.4. establish your likelihood and consequence descriptor

2.2.5. establish your risk rating descriptor

2.2.6. add cther controls

2.2.7. make a decision

3. Identify elements in risk analysis

3.1. asset is any data, device, or other component of the environment that supports information-related activities. Assets generally include hardware (e.g. servers and switches), software (e.g. support systems) and confidential information.Assets should be protected from illicit access, use, disclosure, alteration, destruction, and/or theft, resulting in loss to the organization

3.2. threat is a possible danger that might exploit a vulnerability to breach security and therefore cause possible harm.

3.3. vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerabilities are the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw.To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface