Section: Volume D

Section: Volume D
Explanation/Reference: https://www.esecurityplanet.com/network-security/data-loss-prevention-dlp.html

Determining the business purpose of the application is the first thing that a risk practitioner should do when a shadow IT application is identified in a business owner's business impact analysis (BIA), because it helps to understand the rationale and value of the application, and the potential risks and issues that it may introduce or affect. A shadow IT application is an IT system or application that is used by the business units or employees without the knowledge or approval of the IT department or management. A shadow IT application may offer benefits such as convenience, efficiency, or innovation, but it may also pose risks such as security breaches, data loss, compatibility issues, or regulatory non-compliance. A BIA is a process of analyzing the potential impact of disruption to the critical business functions or processes, and identifying the recovery priorities and requirements. A BIA may reveal the existence of a shadow IT application, as it may be used to support or enable a critical business function or process. Determining the business purpose of the application is the first thing to do, as it helps to evaluate the necessity and suitability of the application, and to plan the appropriate actions to address the shadow IT application. Including the application in the business continuity plan (BCP), segregating the application from the network, and reporting the finding to management are all possible things to do after determining the business purpose of the application, but they are not the first thing to do, as they depend on the results of the evaluation of the application. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 143

* To reduce risk impact, the best course of action is to implement corrective measures, which are actions taken to eliminate or minimize the negative effects of a risk event after it has occurred12.
* Corrective measures can include restoring normal operations, repairing or replacing damaged assets,
* recovering lost data, compensating affected stakeholders, and implementing lessons learned12.
* Corrective measures can reduce risk impact by minimizing the duration, severity, and scope of the consequences of a risk event, as well as preventing recurrence or escalation of similar risks in the future12.
* The other options are not the best course of action to reduce risk impact, but rather different types of risk responses that may have different objectives and effects. For example:
* Creating an IT security policy is an example of a preventive measure, which is an action taken to avoid or reduce the likelihood of a risk event before it occurs12. A preventive measure can reduce risk exposure, but not risk impact.
* Implementing detective controls is an example of a monitoring measure, which is an action taken to identify and measure the occurrence or status of a risk event during or after it occurs12. A monitoring measure can provide timely information and feedback, but not reduce risk impact.
* Leveraging existing technology is an example of a mitigation measure, which is an action taken to reduce the likelihood or impact of a risk event before it occurs12. A mitigation measure can reduce risk exposure, but not necessarily risk impact. References =
* 1: Risk Management Guide for Information Technology Systems, NIST Special Publication 800-30, July 2002
* 2: Project Risk Management Handbook, California Department of Transportation, June 2011