Problem
For a company that collects and store personal information on its clients (personal financial and medical information, information regarding clients' insurance coverages, employment etc.).Recognizing the significant inherent risk associated with any potential unauthorized access to this personal information and the increased risk profile arising from work from home arrangements due to COVID, assess this risk on a priority basis using the bowtie model
Address the following questions with regard to this BowtieMethod exercise:
A. What is the "Hazard" underpinning this risk? (recall that in this context a "Hazard" pertains to perilousactivities or conditions that arise in connection with the pursuitof organizational objectives)?
B. What is the potentialprimary "Loss Event" ? (i.e., loss of control over the Hazard)?
C. Identify 3 potential Threats/"Root Causes" that might give rise to the Loss Event.For each threat, identify 1-3 Preventative Controls that you might put in place in order to prevent each threat from triggering the Loss Event. Provide one example of a potential Escalation Factor for one of your identified controls(something that could materially undermine the effectiveness of the Preventative Control).
D. Identify 3 potential Outcomes/Consequences that might arise from the Loss Event if it were to happen. For each outcome, identify1-3 Mitigating Controlsthat you might put in place in order to help mitigate the potential severity/impact of the Loss Event on that Outcome. Provide one example of a potential Escalation Factor for one of your identified controls (something that could materially undermine the effectiveness of the Mitigating Control).
E. Identify 2 potential DetectiveControls/KRIs that you might considerfor inclusion in your
Information Security Risk "Dashboard" and describe how they would align with at least 3 of the "KRI Desirable Attributes" outlined in Module 1 of this program.
• Summarize the key results into a BowtieMethod diagram (see below).
• Describe how you might then use this analysisas part of your ongoingrisk management program.