Risk is, in essence, the likelihood of something going wrong and damaging your organization
or information assets. Due to the ramifications of such risk, an organization should try to
reduce the risk to an acceptable level. This process is known as information risk
management. Risk to an organization and its information assets, similar to threats, comes in
many different forms. Some of the most common risks and/or threats are
• Physical damage. Fire, water, vandalism, power loss, and natural disasters.
• Human interaction. Accidental or intentional action or inaction that can disrupt
productivity.
• Equipment malfunctions. Failure of systems and peripheral devices.
• Internal or external attacks. Hacking, cracking, and attacking.
• Misuse of data. Sharing trade secrets; fraud, espionage, and theft.
• Loss of data. Intentional or unintentional loss of information through destructive
means.
• Application error. Computation errors, input errors, and buffer overflows.
The idea of risk management is that threats of any kind must be identified, classified, and
evaluated to calculate their damage potential [17]. This is easier said than done.