IT Risk Audit - Overview

Risks are divided into 3 categories:

	Confidentiality	: - The risk of unauthorised access to data
	Integrity	: - The risk of data being changed or incorrect
	Availability	: - The risk of the service or data not being available when needed

This classification is a common way of representing risks in security standards such as ISO-27001

IT Risk Audit - Confidentiality

The confidentiality risk is gauged by the type of data stored in, or captured by the service.

For instance course & subject information may be a 1, whereas student identity information might be a 7.

Each data type is given a confidentiality level in a central table (Data Confidentiality Classification).

For each service we want to set a Target which is determined by the confidentiality of the data stored, and an Actual which is determined by what controls are in place to protect the data.

Actual is determined by the answers to the following questions. The scores for each control are added up totalling in the Actual .

Note the priority of a service (Service Restoration Priorities) is not taken into consideration when looking at confidentiality as any service is equally vulnerable to hacking regardless of how important it is to the organisation.

IT Risk Audit - Data Confidentiality Classification

By default data is catalogued with the following confidentiality:

IT Risk Audit - Integrity

The integrity requirements for the service depends on the system that is using it. Getting a students name wrong in the student portal may be embarrassing, but it's far more important it is correct when printing their diploma.

For each service we want to set a Target which is determined by answers to the folloiwng questions:

And an Actual which is determined by what controls are in place to protect the data. The score of each control is added up to make the Actual

Integrity Workflow

When the Target and the Actual are known, the following workflow is performed to calculate the residual integrity risk.

The integrity workflow uses the service priority, which is how important the service is to the organisation. More informartion here: Service Restoration Priorities

IT Risk Audit - Availability

Availability, or uptime will vary for each service. The eLearning system might need to be up 24x7, whilst the time sheeting system doesn't have to be as reliable.

For each service we want to set a Target which is determined by answers to the following questions:

And the following is added to the availability target

The Actual which is determined by what controls are in place to keep the service available. The score of each control is added up to make the Actual

When the Target and the Actual are known, the following workflow is performed to calculate the residual availability risk.

The availability workflow uses the service priority, which is how important the service is to the organisation. More informartion here: Service Restoration Priorities

IT Risk Audit - Overall Residual Risk

Once the Confidentiality, the Integrity and the Availability risks are known the highest of the three becomes the overall service residual risk.

Generating Complete Risk Reports

To generate a complete risk report use the Risk Report link in the Reports side menu.

By combining all the services, the service dependencies, the target CIA's, the actual CIA's, the data stored and the priority of each service, ServiceView can generate a complete risk report.

Unlike the "Risk Classification" tab for each service this report takes into count the risks of underpinning services and how that might affect the availability of high priority services.

The first page is a summary of risks and high priority services, then there is a one page report on each service indicating its risk level, a service register documenting each service and its purpose. Following those is an Information Asset Register detailing which IT services store which data types, this is required by law in most countries, and lastly a Technology Asset Register organising service by their technology.

Generating a Report for Risk Data Completion

To create a report for viewing the completion status of the risk data per service, the user needs to logged in as a admin user.

Click on the Admin tab and go to Reports.

On the reports page, click the drop down menu and choose Service Field Population Percentage. Then click generate report.

This will list the service name, complete percent, service owner and technical owner.

The data can then be downloaded into a spread sheet by clicking the download data button in the top right.