Information Asset Risk Assessment Report for Johns Hopkins Healthcare organization

             Information Asset Risk Assessment Report for Johns      

                                Hopkins Healthcare organization

      The project proposal should be a description of the organization that you propose to analyze, with a summary of the scope (e.g., entire organization, key business area, major system, etc.) for the risk assessment you are expected to conduct. The proposal should identify the subject organization with a brief explanation of why you chose the subject for this assignment. The proposal should also describe the research methods to be used and anticipated sources of research information sources.

      You should identify five (5) to six (6) significant articles relevant to your subject organization and to identifying and assessing risks in a context similar to the scope of your report. For a report of this nature, you may expect to find useful sources in both business-focused (e.g., Business Source Premier, Business and Company Resource Center, ABI/Inform) and technically-focused databases (e.g., ACM Digital Library, IEEE, Gartner.com).

Assessment Report Overview

       The analysis will be conducted using only publicly available information (e.g., information obtainable on the Internet, company reports, news reports, journal articles, etc.) and based on judicious, believable extrapolation of that information. Your risk analysis should consider subject organization information assets (computing and networking infrastructure), their vulnerabilities and legitimate, known threats that can exploit those.). The risk analysis should consider legitimate, known threats that pertain to the subject organization. Based on the information gathered, presumed vulnerabilities of the company or organization’s computing and networking infrastructure will be identified. Then, based on the identified threats and vulnerabilities, you will describe the risk profile for the subject organization and suggest recommendations to mitigate the risks.

1.Develop Subject Organization Information: Examples of relevant information includes:

1. Company/Organization name and location
   1. Company/Organization management or basic organization structure
   1. Company/Organization industry and purpose (i.e., the nature of its business)
   1. Company/Organization profile (financial information, standing in its industry, reputation)
   1. Identification of relevant aspects of the company/organization’s computing and network infrastructure, Note: Do not try to access more information through Social Engineering, or through attempted cyber attacks or intrusion attempts.

2.   Analyze Risks

Follow the standard risk assessment methodology used within the U.S. federal government, as described in NIST Special Publication 800-30 (United States. National Institute of Standards and Technology (2002). Risk Management Guide for Information Technology Systems (Special Publication 800-30). Retrieved from: http://csrc.nist.gov/publications/nistpubs/800- 30/sp800-30.pdf