Managing Information Risks: Threats, Vulnerabilities, and Responses

257 Pages·2021·15.682 MB·English

by  Saffady, William

Managing Information Risks

Managing Information Risks
Threats, Vulnerabilities, and Responses
William Saffady
ROWMAN&LITTLEFIELD
Lanham•Boulder•NewYork• London
PublishedbyRowman&Littlefield
AnimprintofTheRowman&LittlefieldPublishingGroup,Inc.
4501ForbesBoulevard,Suite200,Lanham,Maryland20706
www.rowman.com
6TinworthStreet,LondonSE115AL,UnitedKingdom
Copyright©2020byTheRowman&LittlefieldPublishingGroup,Inc.
Allrightsreserved.Nopartofthisbookmaybereproducedinanyformorbyany
electronicormechanicalmeans,includinginformationstorageandretrievalsystems,
withoutwrittenpermissionfromthepublisher,exceptbyareviewerwhomayquote
passagesinareview.
BritishLibraryCataloguinginPublicationInformationAvailable
LibraryofCongressCataloging-in-PublicationData
Names:Saffady,William,1944–author.
Title:Managinginformationrisks:threats,vulnerabilities,andresponses/WilliamSaffady.
Description:Lanham:Rowman&Littlefield,2020.|Includesbibliographicalreferencesandindex.|
Summary:“Writtenbyoneoftheforemostrecordsandinformationmanagementleadersinthe
world,thisbookprovidesaclearexplanationandanalysisofthefundamentalprinciplesassociat-
edwithinformationrisk,whichisbroadlydefinedasacombinationofthreats,vulnerabilities,
andconsequencesrelatedtouseofanorganization’sinformationassets.”—Providedbypublish-
er.
Identifiers:LCCN2020000882(print)|LCCN2020000883(ebook)|ISBN9781538135488(cloth)|
ISBN9781538135495(paperback)|ISBN9781538135501(epub)
Subjects:LCSH:Dataprotection.|Computersecurity.|Records—Management.|Databasemanage-
ment.|Riskmanagement.
Classification:LCCHF5548.37.S242020(print)|LCCHF5548.37(ebook)|DDC658.4/038—dc23
LCrecordavailableathttps://lccn.loc.gov/2020000882
LCebookrecordavailableathttps://lccn.loc.gov/2020000883
TMThepaperusedinthispublicationmeetstheminimumrequirementsofAmerican
NationalStandardforInformationSciencesPermanenceofPaperforPrintedLibrary
Materials,ANSI/NISOZ39.48-1992.
Contents
Preface vii
1 RiskTermsandConcepts 1
2 CreationandCollectionofInformation 25
3 LossofInformation 61
4 RetentionofInformation 97
5 RetrievalandDisclosureofInformation 141
6 OwnershipofInformation 189
Index 231
AbouttheAuthor 245
v

Preface
Information risk is an important topic at the nexus of risk management and
information governance, two disciplines with closely aligned objectives.
Risk management is responsible for identifying, analyzing, and controlling
threats to an organization’s assets. Information governance supports this re-
sponsibility by developing effective strategies, policies, and initiatives to
identify,assess,andaddressrisksassociatedwithanorganization’sinforma-
tionassets.Thetwodisciplineshaveacomplementaryrelationship,andthey
mustworktogethertofulfilltheirresponsibilities.
Thisbookisintendedforriskmanagers,informationgovernancespecial-
ists, compliance officers, attorneys, records managers, data scientists, archi-
vists, librarians, and other decision-makers, managers, and analysts who are
involvedinorneedtobeawareofriskmanagementinitiativesrelatedtotheir
organizations’ information assets. The book can also be used as a textbook
bycolleges and universities that offer courses in risk management, informa-
tiongovernance,orrelatedtopicsatthegraduateor advanced undergraduate
level. In particular, the book may be useful for a curriculum that combines
risk management with records management, knowledge management, infor-
mation science, health informatics, information system design, data protec-
tion,andotherinformation-relatedsubjects.
GoogleTrends,awebsitethatanalyzesthepopularityofGooglesearches,
showsasteadylevelofworldwidesearchactivityoverthepastfiveyearsfor
the phrase information risk, with most of the searches originating in the
UnitedStatesandUnitedKingdom.Thelevelofsearchactivityishigherand
therangeofgeographicinterestisbroaderforthetermsinformationandrisk
searched together in a Boolean expression rather than as a phrase. For the
same period, a Google Scholar search for the phrase information risk re-
vii
viii Preface
trieved approximately 11,500 citations, while a search of the two terms in a
Booleanexpressionretrievedover1.3millioncitations.
Googlesearch resultssuggest that information risk is strongly associated
with information technology in general and cybersecurity in particular, but
information risk is not limited to computer data. It encompasses organiza-
tional information assets of any type in any format, including paper and
photographic records as well as digital content stored on premises or by
cloud service providers. Reflecting this broader view, this book discusses
risks related to creation, collection, storage, retention, retrieval, disclosure,
andownershipofinformationinorganizationsofalltypesandsizes.Chapter
1 provides an introduction to risk terms and concepts that are essential for
understanding, assessing, and controlling information risk. Taking a taxo-
nomic approach, the remaining chapters identify and categorize threats and
discussvulnerabilitiesandriskresponsesrelatedtothefollowingtopics:
• Chapter2dealswithrisksassociatedwithcreationandcollectionofinfor-
mation,includingfailuretocollectinformationrequiredbylawsandregu-
lations;unauthorizedcollectionof personalinformation; illegal collection
ofnonpublicinformation;creationorcollectionofinformationwithobjec-
tionable, defamatory, or private content; and creation or collection of
poor-qualityinformation.
• Chapter3discusseslossofinformationduetonaturaldisasters,malicious
humanactions,accidents,andfire.
• Chapter 4 identifies risks associated with retention and destruction of
information, including noncompliance with laws and regulations that re-
quire retention, preservation, or destruction of information; retaining in-
formation longer than necessary; destroying information that needs to be
kept; and media instability and obsolescence problems that affect the us-
abilityofinformation.
• Chapter5discussesrisksassociatedwithinformationretrievalanddisclo-
sure, including retrieval failures, metadata mining, noncompliance with
laws and regulations that mandate information disclosure, failure to pre-
vent unauthorized disclosure of information, prohibitions on cross-border
transfer of information, and noncompliance with data breach notification
laws.
• Chapter 6 deals with risks associated with ownership of information, in-
cluding infringement of intellectual property rights, the impact of the
work-for-hire doctrine, loss of ownership of trade secrets, and data port-
abilitylawsandregulationsthataffectownershipofpersonalinformation.
Eachchapter beginswith abriefoverview that summarizes keyrisksrelated
to the topic at hand, followed by a detailed explanation of each threat, an
assessment of vulnerabilities that the threat can exploit, and a review of