This phase entails considering the different methods of attaining the goals that were identified in the systems requirements phase. Positive and negative aspects of each possible plan of attack must be determined. Finally, the chosen course of action should be transformed into a detailed plan for providing security across your network. Risk Analysis Risk analysis is a critical task that occurs during the initial two phases of the process model. Sensitivity assessment defines the various needs determined in the systems requirement phase as they relate to the value of your network's assets.
Risk assessment is the most significant activity of the overall risk analysis.
It is used to define threats against the network, vulnerability of the network, and the risk levels that result from the postulated exploitation of network vulnerabilities by the defined threats against the network. Certain simple inquiries facilitate the assessment of a network's susceptibility to a risk becoming a reality. For example, risks to your network include the lack of a daily backup and disaster recovery plan, anti-virus software, intrusion detection methods, access control software, firewalls, password practices, encryption and strong authentication. Economic assessment approximates the expected value of a loss, in the case that any of the defined risks become a reality and the network's security is compromised. During this stage, actual system specifications are created that detail the exact operation of the system.