Risk Management Guide

For calculating the vulnerability of the risk NIST followed several step procedures in characterizing it. After characterizing the risk necessary actions are taken as per the problem. In the first step they analyze the boundaries of the IT system, along with the resources and the information that constitute the system. This first step is called system characterization. Information regarding to the system are collected and analyzed. They use various information gathering techniques to collect information such questionnaire, on site interviews, documentation etc. In step 2 NIST analyzes for threats and what are their sources. From step 2 we will be able to know about a threat statement containing a list of threat-sources that could exploit system vulnerabilities. In step 3 NIST checks for the vulnerabilities that may be caused due to the attacks on the IT structure. The analysis of the threat to an IT system must include an analysis of the vulnerabilities associated with the system environment. The goal of this step is to develop a list of system vulnerabilities (flaws or weaknesses) that could be exploited by the potential threat-sources. In step 4 NIST searches for the control measures to be taken. The goal of this step