IT Security Risk Management Theories: Framework vs. Independent

Introduction: The Evolving Cyber Threat Landscape

Over the last several years, a wide variety of theories have emerged in the world of information technology about the best security protocols. This is because the underlying nature of the threat has become more frequent and is constantly evolving. A good example can be seen within the U.S. government itself: the total number of cyber attacks against government infrastructure increased by 39% in 2010, reaching 107,439 reported cases (Montablano, 2011). This is significant because it illustrates how the overall type of threat is changing.

As a result, a number of different theories have been presented to address the shifts occurring from this hazard. To fully understand what is taking place requires comparing and contrasting these theories with each other. Together, these elements provide the greatest insights into how the nature of risk management is changing.

The Framework Theory of IT Security

The Framework Theory is concerned with examining a number of major elements that could have an impact upon an organization's security procedures. The most notable include: identifying, assessing, treating, and monitoring the various risks (Jones, 2007, pp. 30–38).

Identifying involves determining what specific threats are facing an organization. To accomplish this, staff must consider a number of different factors, including establishing compliance standards and regulations, environment mapping, risk identification, and risk ownership (Jones, 2007, pp. 30–38).

Assessing is the process of examining specific threats and determining what kind of danger each poses to the organization. This includes factors such as risk reduction planning, risk modeling, and testing (Jones, 2007, pp. 30–38). This step is important because it provides a means of analyzing the overall nature of the risks involved.

Treating refers to how the organization mitigates the underlying nature of a threat and prevents it from spreading to other systems. This involves several elements used in conjunction with one another, including prioritizing risk mitigation efforts and engaging in effective risk treatment (Jones, 2007, pp. 30–38). These factors are significant because they illustrate how threats are approached and addressed in practice.

Monitoring for various risks involves studying the effects of threats that have been isolated while also identifying new ones. The key elements during this phase include risk monitoring and reporting (Jones, 2007, pp. 30–38). This step is important because it ensures that an organization adapts to the challenges it faces and remains vigilant for emerging threats.

What this highlights is how the Framework Theory can be used to establish guidelines for a security protocol inside an organization. However, it does not provide immediately actionable steps to address specific threats. The theory's strength lies in offering basic criteria for any kind of security protocol and should therefore be utilized to create a general strategy.

The Independent Theory is designed to take the most effective security procedures and implement them into one basic strategy. A number of different elements are utilized as part of this security protocol, including the use of mapping and safeguards through layering. Mapping is when an IT administrator integrates different computer systems together to observe how much data is being retrieved, stored, and processed (McCumber, 2008). This tool provides an organization with a strategy for monitoring unusual activity across its network.