Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
Reassessing the Concepts of Security Risk Management
Application security refers to the precautions taken throughout an application's life cycle to protect against vulnerabilities that may arise due to flaws in the application's design, development, deployment, upgrade, or maintenance. These flaws can occur at any point in the application's life cycle, including design, development, deployment, upgrade, or maintenance.
These precautions are designed to eliminate the possibility of exceptions occurring inside an application's security policy or the system behind it. Applications have no control over the kind of resources made available; they can only regulate how those resources are utilized. This is the only power they have. Since this addresses the core of the problem, implementing reliable processes for application software development and coding is the most effective kind of security that can be implemented.
Both the Open Web Application Security Project (OWASP) and the Web Application Security Consortium (WASC) have recently publicly updated information on the most current vulnerabilities that impact web-based applications. As a direct consequence, software developers, security testers, and architects will have a much simpler time focusing on enhancing design and implementing mitigation techniques. The OWASP Top 10 has been the de facto industry standard for assessing web applications since it was first published.
Access Control and Management
Access to a place or other resource may be provided or refused case-by-case if the access to that area or resource is controlled. Consuming something, entering it, or utilizing it might all be regarded as different ways of gaining access to the same object. Access to a resource is referred to as "authorization," which is another phrase for permission to do so. Access refers to the process through which a person and an object communicate and share information. In a sentence, an active entity is referred to as a subject, whereas an inactive entity is referred to as an object.
Authentication
When we speak about authentication, we refer to confirming a user's claimed identity before granting them access to a network or computer system. The process of authenticating anything might include verifying the identity of a person or a piece of software, determining where something originated or ensuring that a product is precisely what it claims to be based on its packing and labelling. It is common to practise this procedure to establish whether or not at least one type of identification satisfies the necessary criteria for believability.
Cryptography
Cryptography is the study of ways for safe communication in the face of adversaries and the science and practice of secret writing. Additionally, cryptography refers to the study of methods for secret writing. The focus of this practice is on the construction and analysis of protocols that overcome the influence of adversaries and that are related to various aspects of information security, such as the confidentiality of data, the integrity of data, authenticating users, and not being able to be falsely accused of doing something. In particular, the emphasis of the practice is placed on the process of developing such protocols. In current cryptography, mathematics, computer science, and electrical engineering are all combined into one area; as a result, modern cryptography is an interdisciplinary field.
Confidentiality and safety online
The National Institute of Standards and Technology (NIST) has developed guidelines that companies may follow to implement secure security practices and reduce the number of successful cyber attacks. These guidelines are referred to as "cyber security standards," and the term "cyber security standards" is used to refer to these guidelines. With the assistance of these instructions, which include high-level and specific solutions, cyber security implementation may be simpler and more straightforward. When specific criteria are satisfied, certification in cyber security may be obtained from an organization that has been recognized as meeting those criteria. Obtaining a certification paves the way for various chances, one of which is the purchase of cyber security insurance and many other advantages.
When discussing information technology, "risk" refers to the possibility that something negative may occur and the outcomes resulting from that adverse event. IT risk and IT-related risk are two different names for the same kind of risk, which is any risk that belongs to the information technology industry or affiliated sectors.
The phrase "IT risk" is a relatively new word, and this is because of a growing knowledge that information security is just one aspect of a massive number of hazards that are important to the IT sector and the IT activities it supports. This is because the phrase "IT risk" is relatively new because of this growing knowledge. One of the reasons why the word "IT risk" is still very recent is this. By stating that risk is equal to the likelihood multiplied by the impact or by writing risk as Risk = Likelihood * Impact, we can express risk as the product of the possibility of an event occurring and the effect that the event would have on an IT asset. This can also be expressed by writing risk as Risk = Likelihood * Impact.
Conclusion
Additionally, it is generally accepted that the effect of an incident on an information asset is the result of a vulnerability in the asset as well as the value of the asset to the stakeholders in the asset's ecosystem. This is because the vulnerability is the result of both the value of the asset to the stakeholders in the asset's ecosystem as well as the value of the asset itself. As a consequence of this, the meaning of the phrase "IT risk" may be expanded to cover the following −
The concept of absolute risk may be expressed as danger multiplied by vulnerability and then added to the asset value.
In addition, this may be described as the likelihood that a specific threat would exploit the vulnerabilities of an asset or collection of assets to cause harm to the organization. This might be either an individual asset or a group of assets. It is analyzed with the use of a formula that considers both the possibility that an event will occur and the effect it will have in the event that it does.
99 Views
