Maturing Risk Management

Course 8: Maturing Risk Management In management science terms, maturing a process or practice means taking positive steps over time to make it more reliable, repeatable and efficient.

In practice, this means getting better every day, while showing the measurements that demonstrate improvement and suggest other opportunities to improve.

As we saw in chapters one and two risk management for information intensive organizations works best when using evidence-based reasoning to identify, characterize, and take actions as necessary to resolve the issues. Course eight will bring together numerous threads that are intrinsically related to managing the risks associated with information systems. Also, we know that cyber attack is a risk for all organizations.

In this course, we will focus on bringing these ideas together in a context of continuous maturity modeling, measuring and monitoring. Risk alignment works best at the strategic long-term level of planning. By contrast risk maturation can be most effective when considered in day-to-day business operations. This is sometimes called operationalizing one's approach to risk management and maturation. Operationalizing risk management asks us to take the life cycle models about systems, software and data and connect or pivot them around business operations. We'll take on the view of the workers who use the business logic and the systems or the people who oversee the robotics and internet of things on the factory or warehouse floor and see how each of the different security disciplines brings something to them. This course has five modules. Module one focuses on change management and reveals how this detailed administratively intense process plays a primary role in protecting information systems. We'll also look at its vital contributions to incident response and remediation. Module two shows how physical security design principles are used to monitor and control the flow of physical objects in and out of various security zones. This module also considers the operational effects of safety planning and preparation on people and property, as well as availability and integrity of systems and information. Module three provides a different attitude and mindset about empowering and enabling the people in the organization to become more effective contributors and proponents of its information security. Security training programs have failed to help people complete their job safely and securely. New concepts such as micro chaining demonstrates that security education and awareness can add value to the security process. Module four shows us that system security assessment should be an ongoing task. Security has always involved continuous vigilance and integrity. Formal and informal audits demonstrate just how effective an organization's security controls are.

As its process of maturing those controls continues to improve their performance. Module five brings many of these ideas and concepts together through business continuity and disaster recovery planning. The emphasis will be the operational support of these tasks, both in the planning and execution stages. We've prepared the foundations so you can bring concepts covered thus far into a cohesive daily operational context. Course 8 Learning Objectives After completing this course, the participant will be able to: L8.1 – Identify operational aspects of change management. L8.2 – Summarize physical security considerations. L8.3 – Design a security education and awareness strategy. L8.4 – Recognize common security assessment activities. L8.5 – Classify the components of a business continuity plan and disaster recovery plan. Course Agenda Module 1: Participate in Change Management (Domain 1 – Security Operations and Administration) Module 2: Physical Security Considerations (Domain 1 – Security Operations and Administration) Module 3: Collaborate in Security Awareness and Training (Domain 1 – Security Operations and Administration) Module 4: Perform Security Assessment Activities (Domain 3 – Risk Identification, Monitoring and Analysis) Module 5: Understand and Support the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) (Domain 4 – Incident Response and Recovery) Who Should Take This Course: Beginners Experience Required: No prior experience required