A risk management framework is created by a company to set up a series of rules for its information security practices. These frameworks outline a series of plans and instructions, which can then be tailored directly to the organization that uses them. While a risk management framework is generally used for computer-based security, hybrid or totally non-computer versions are possible with very little modification. In general, the steps of the framework are the same, regardless of the organization setting it up.
The first step of a risk management framework is looking at the system in question. It is important to know details such as the number of users, the types of information stored and the physical methods used for accessing and securing the systems. The more information that a group has about how the system is used, the easier it is to set up specific rules that apply to everyone.
After gathering information, it is necessary to establish a baseline for security. This part of a risk management framework essentially creates a border with secure information on one side and insecure information on the other. At this stage, either everybody can access information or nobody can. Since it is an all-or-nothing distinction, the private section is typically much larger than the public.
Next, the company looks at the users of the information and starts to break them into groups. Different users require access to different types of information; so, one group will need access to some data, but not all data. At this time, it is more important that the groups be precise rather than efficient. Similar groups are easier to merge after the full parameters are established.
The individual groups are paired up with types of information. This matching process is used to create tendencies in the data and prevent users from accessing information that they shouldn’t. Once the groups are established and the proper information assigned, it is possible to look at the groups and find ones that have very similar access. Merging these groups at this point prevents unexpected access and simplifies the monitoring phase.
The last step in a risk management framework is monitoring the system. After the system is operational, unexpected security issues will likely crop up. The monitoring phase keeps track of these issues and helps to fix them before they become a problem. While this phase is continuous after the system goes online, the number of security issues should begin to fall after its initial use. If security issues persist, then there is probably a problem with an earlier step and the framework needs reassessment.
