Abstract-The assessment and mitigation of risks related to banking, reservations for e-tickets etc.). This fact is confirmed the availability of the IT infrastructure is becoming increasingly by the increasing importance that Service Level Agreements important in modern organizations. Unfortunately, present stan-(SLAs) are gaining. Currently, SLAs are considered one of dards for Risk Assessment and Mitigation show limitations when evaluating and mitigating availability risks. This is due to the fact the antaliwy o den e and c re expected that they do not fully consider the dependencies between the availability and quality of a given service and are widely used constituents of an IT infrastructure that are paramount in large not only between different organizations but also between units enterprises. These dependencies make the technical problem of of the same company. assessing availability issues very challenging. In this paper we That managing availability risks is particularly important is define a method and a tool for carrying out a Risk Mitigation activity which allows us to assess the global impact of a set of confirmed by the fact that most Risk Management methodrisks and to choose the best set of countermeasures to cope with ologies specifically require, when the mitigation phase takes them. To this end, the presence of a tool is necessary, due to place, the implementation of a plan for Business Continuity the high complexity of the assessment problem. Our approach (Business Continuity Plan, BCP). A BCP describes which can be integrated in present Risk Management methodologies are the countermeasures that have been chosen, the people (e.g. COBIT) to provide a more precise Risk Mitigation activity. We substantiate the viability of this approach by showing that involved and the response procedures they should take in case most of the input required by the tool is available as part of of a disruption event, to guarantee a timely recovery. a standard business continuity plan, and/or by performing a common tool-assisted Risk Management. Contribution In this paper we focus on assessing and mitigating the risks related to the availability of the IT in-I. INTRODUCTION frastructure. This is particularly challenging because of the Information Risk Management is the process of assessing (temporal) dependencies linking the various constituents of the risks an organization's IT infrastructure is exposed to, and an IT infrastructure (machines, processes, assets, etc.) with of developing strategies to manage them. The process of Risk each other. In complex information systems, a failure in a Management is usually divided into two main steps: Risk As-remote component may propagate across the infrastructure and sessment (RA) and Risk Mitigation (RM). The former activity eventually affect the availability of a good deal of the entire identifies potential harmful threats to the information systems, system. Failing to appropriately assess the consequences of while the latter consists of developing and implementing a such propagations will result in inaccurate RA and RMs. clearly). Thus, these methodologies can only be useful to Among the three main security properties of information, identify and fix individual risks an organization is exposed to Confidentiality, Integrity and Availability (CIA), the impor-(see also Section II). On the other hand, these dependencies tance of availability has grown enormously: today, organiza-are considered in more specific assessment methods such tions strongly depend on the availability of their information as the Business Continuity Plans, like in the new standard systems; moreover, availability of IT-related services is contin-BS25999 [16] (see Section II for a detailed overview). These uously growing in importance for enterprise revenues (on-line methods, however, do not specify how to use this information for RM.
As for the availability model presented in REF , this one is meant to be implemented by a tool and used to assess the risks in a continuously changing environment.
Model-Based Mitigation of Availability Risks
2007 2nd IEEE/IFIP International Workshop on Business-Driven IT Management
2007 2nd IEEE/IFIP International Workshop on Business-Driven IT Management
Computer Science Business