RISK MANAGEMENT OF INFORMATION SYSTEMS: STAGES OF THE RISK MANAGEMENT PROCESS

Abstract

The use of information systems (IS) is associated with a certain set of risks. Any assessment of information security risks begins with an inspection of the information system, identification of information resources and a description of information processing technologies. Risk, as a rule, means the possibility that a certain goal will not be achieved during the implementation of the project of automation of the enterprise. The analysis of risk factors is preceded by: planning measures to reduce the impact of risk factors on the outcome of the project and decision-making at various stages of the process of creating an information system. Risk analysis is a procedure for identifying information security (IS) risk factors and assessing their severity. IS risk analysis includes risk assessment and methods to reduce risks or reduce the associated adverse effects. The analysis first identifies the relevant factors and assesses their severity; the completeness of the identified factors increases the quality and accuracy of the predicted risks [1]. All entities that participate and make decisions in the process of enterprise automation (customer – enterprise and system integrator – supplier), carry out risk analysis, each one from his own position. Therefore, it is necessary to take economically justified protection measures when the possible damage is unacceptably large. To monitor the effectiveness of information security, periodic reassessment of risks is necessary, from the point of view of information security. Resources on the likelihood of such a breach and as part of business risks and handled in a similar manner. Thus, the overall risk assessment allows to implement the necessary measures at the level of departments, projects, specific risks or at the level of the organization as a whole. Upon completion of the overall risk assessment, risk processing is performed, which involves the adoption of one or more appropriate options that reduce the likelihood of risks and their impact on the information system.