Managing Risk and Information Security: Protect to Enable

by Malcolm Harkins

How we manage the risks: Intel’s internal information risk management focus areas. Source: Intel Corporation, 2012 Oversight. This area focuses on making informed risk decisions and reviewing risks. It includes committees and review boards that set strategic direction, and review key risk areas such as ethics, compliance, and corporate investigations. Monitoring. We monitor (sense) risk through external and internal sources. External sources include industry research and analysis. Internal sources include internal partners who inform us of new business risks or legal requirements. These internal sources also include our own security technology sensors. Engagements. We participate in industry workgroups and in partnerships and dialogues with trusted peer organizations. These external engagements provide a valuable risk-sensing function and help us influence key security initiatives. I’ll discuss our external partnerships in more detail in Chapter 4. Operations. This area encompasses day-to-day risk management activities and processes, including risk assessments, incident response, and exercises such as war games. Strategic. Our strategic planning function interfaces with the other four components of governance. It includes our emerging threat analysis and long-range security architecture planning. Our information risk governance structure is designed to support this balanced approach to risk management. It includes a large number of formal and informal partnerships and stru...