Français
3. Risk reduction actions
Once risk analysis methods have highlighted the vulnerabilities of the information system, the next step is to find solutions that will reduce the risk to an acceptable level. This chapter presents some of these solutions.
3.1 Nature of possible actions
Depending on the stage at which they intervene in the evolution of the threat, risk reduction actions can be prevention, detection, correction or recovery.
Prevention deals with measures to be taken to avoid a disaster. For example:
raising awareness (among legitimate users) ;
deterrence (e.g. a tattoo covering the body of a message with an indelible electronic watermark);
...
The Ultimate Scientific and Technical Reference
This article is included in
Security of information systems
This offer includes:
Knowledge Base
Updated and enriched with articles validated by our scientific committees
Services
A set of exclusive tools to complement the resources
Practical Path
Operational and didactic, to guarantee the acquisition of transversal skills
Doc & Quiz
Interactive articles with quizzes, for constructive reading
Risk reduction actions
Normative aspects
Bibliography
Bibliography
Websites
Federation of Professional Intrusive Testers (FPTI) http://www.fpti.pro/
French Information Systems Security Club (CLUSIF) http://www.clusif.asso.fr
Standards and norms
- Risk management – Vocabulary – Guidelines for use in standards - ISO 73 Guide ISO 73 - 12-09
- Information Technology – Safety technology – Information security management systems –Requirements - ISO CEI 27001 - 10-13
- Information Technology – Safety technology – Code of practice for information security management - ISO CEI 27002 - 09-13
- Information Technology – Safety technology – Guidelines for...
The Ultimate Scientific and Technical Reference
