Risk Analysis

From CIPedia
Revision as of 00:49, 26 November 2016 by Eluiijf (talk | contribs)
Jump to navigation Jump to search

Definitions

European Definitions

Council Directive 2008/114/EC

The consideration of relevant threat scenarios, in order to assess the vulnerability and the potential impact of disruption or destruction of critical infrastructure. [1]


ENISA

Risk Analysis is the systematic use of information to identify sources and to estimate the risk (refers to ISO/IEC Guide 73). [2]



National Definitions

Australia

Risk analysis is a systematic use of available information to determine how often specified events may occur and the magnitude of their likely consequences. [3]


Process to comprehend the nature of risk and to determine the level of risk. [4]


Austria

Risikoanalyse die Prüfung relevanter Bedrohungsszenarien, um die Schwachstellen und mögliche Auswirkungen einer Störung oder Zerstörung kritischer Infrastrukturen zu bewerten. [5]



Belgium

Risicoanalyse: bestudering van relevante dreigingsscenario’s om de kwetsbaarheid en de mogelijke gevolgen van de verstoring of vernietiging van kritieke infrastructuur te beoordelen. [6]



Analyse de risques: examen des scénarios de menace pertinents destiné à évaluer les vulnérabilités d’infrastructures critiques et les impacts potentiels de leur arrêt ou destruction. [7]



Brazil

Análise de riscos: análise e avaliação das vulnerabilidades das redes e dos sistemas que suportam a oferta de serviços, fundamentadas na hierarquização dos elementos necessários à prestação dos serviços. [8]


Bulgaria

анализ на риска означава отчитане на съответните сценарии за действие при различни заплахи, с цел да се направи оценка на уязвимостта и на потенциалните последици от наруша¬ ването или унищожаването на критична инфраструктура. [9]



Canada

A process to comprehend the nature of a risk and to determine its level. [10]

Processus mis en œuvre pour comprendre la nature d’un risqué et pour déterminer son niveau. [11]


Croatia

Analiza rizika označava razmatranje mogućih scenarija prijetnji kako bi se ocijenile ranjivosti i mogući učinak poremećaja u radu kritične infrastrukture ili njezina uništenja. [12]

Risk analysis indicates consideration of possible scenarios of threats to evaluate the vulnerability and the potential impact of disturbances in the critical infrastructure or its destruction.



Analiza rizika znači razmatranje odgovarajućih scenarija opasnosti kako bi se ocijenile slabosti i mogući učinak poremećaja u radu ili uništenja kritične infrastrukture. [13]



Czech Republic

Proces pochopení povahy rizika a stanovení úrovně rizika. [14]

Process of understanding the nature of risks and establishing a risk level. [15]



Analýzou rizik zvážení relevantních scénářů hrozeb s cílem posoudit zranitelnost a možný dopad narušení nebo zničení kritické infrastruktury. [16]



Denmark

Risikoanalyse: overvejelse af relevante trusselsscenarier for at vurdere sårbarheden og de potentielle konsekvenser af, at kritisk infrastruktur afbrydes eller ødelægges. [17] [18]


Estonia

Riskianalüüs” – asjakohaste ohustsenaariumitega arvestamine, eesmärgiga hinnata haavatavust ning elutähtsate infrastruktuuride kahjustada saamise või hävimise võimalikku mõju. [19]



Finland

Riskianalyysillä asiaa koskevien uhkakuvien tarkastelua elintärkeän infrastruktuurin haavoittuvuuden ja sen vahingoittumisen tai tuhoutumisen mahdollisten seurausten arvioimiseksi. [20]



France

Analyse de risques: examen des scénarios de menace pertinents destiné à évaluer les vulnérabilités d’infrastructures critiques et les impacts potentiels de leur arrêt ou destruction. [21]



Germany

Risikoanalyse die Prüfung relevanter Bedrohungsszenarien, um die Schwachstellen und mögliche Auswirkungen einer Störung oder Zerstörung kritischer Infrastrukturen zu bewerten. [22]



Greece

Ως «ανάλυση κινδύνων» νοείται η ανάλυση των σχετικών σεναρίων περί απειλών, προκειμένου να αξιολογηθούν τα τρωτά σημεία και οι δυνητικές επιπτώσεις της διακοπής λειτουργίας ή της καταστροφής υποδομών ζωτικής σημασίας.[23] [24]

(equals EU definition)



Finland

Riskianalyysi: toiminta, jossa tunnistetaan riskit ja arvioidaan vahinkotapahtuman todennäköisyys sekä odotettavissa olevat vahingot.

Risk analysis is the action for identifying risk and estimating the probability of a damaging event as well as anticipated damages. -unofficial translation- [25]


Hungary

Kockázatelemzés: a vonatkozó fenyegetettségi forgató¬ könyvek vizsgálata a kritikus infrastruktúrák sebezhetősé¬ gének, valamint a megzavarásuk vagy megsemmisítésük által okozott potenciális hatásnak az értékelése céljából. [26]



India

Risk analysis is the process of identifying security risks, determining their magnitude, and identifying areas needing safeguards. [27]



Ireland

Risk analysis means consideration of relevant threat scenarios, in order to assess the vulnerability and the potential impact of disruption or destruction of critical infrastructure. [28]




Italy

Analisi dei rischi: valutazione della vulnerabilita' di una ICE rispetto alle diverse possibili minacce e prevedibili conseguenze del danneggiamento o distruzione della stessa, in termini di effetti negativi esterni e intrinseci. [29] [30]



Latvia

Apdraudējumu analīze ir apsvērumi par attiecīgiem apdraudējuma scenārijiem, lai izvērtētu neaizsargātības pakāpi un ietekmi, ko varētu radīt kritiskās infrastruktūras darbības traucējumi vai tās iznīcināšana. [31]



Lithuania

Rizikos analizė – atitinkamų grėsmės scenarijų nagrinėjimas, siekiant įvertinti ypatingos svarbos infrastruktūros objekto pažeidžiamumą ir veikimo sutrikdymo arba sunaikinimo galimą poveikj. [32]



Luxembourg

Analyse de risques: examen des scénarios de menace pertinents destiné à évaluer les vulnerabilities d'infrastructures critiques et les impacts potentiels de leur arrêt ou destruction. [33] [34]


Malta

Analiżi tar-riskju tfisser il-konsiderazzjoni ta’ xenarji ta’ theddid relevanti, sabiex tiġi valutata l-vulnerabbiltà u limpatt potenzjali ta’ interuzzjoni jew qerda ta’ infrastruttura kritika. [35]



Netherlands

Risk analysis is a method which takes stock of the risk, which risk factors are unacceptable, and which measures can mitigate the risk.

Risicoanalyse is een methode die inventariseert welke risico's er zijn, welke daarvan onacceptabel zijn en welke maatregelen de risico's kunnen reduceren. [36]


Risicoanalyse: bestudering van relevante dreigingsscenario’s om de kwetsbaarheid en de mogelijke gevolgen van de verstoring of vernietiging van kritieke infrastructuur te beoordelen. [37]



Poland

Analiza ryzyka oznacza uwzględnianie stosownych metod postępowania w przypadku zaistnienia zagrożeń, aby ocenić słabe punkty i potencjalne skutki zakłócenia lub zniszczenia infrastruktury krytycznej. [38]



Portugal

Análise de risco, a ponderação dos cenários de ameaça relevantes, a fim de avaliar a vulnerabilidade e o potencial impacto da perturbação ou destruição de uma infra-estrutura crítica. [39]



Romania

Analiză de risc înseamnă analizarea scenariilor de amenințări semnificative, pentru a evalua vulnerabilitatea și impactul potențial al perturbării sau al distrugerii infrastructurii critice. [40]



Slovakia

Analýza rizík je zváženie relevantných scenárov hrozieb s cieľom posúdiť zraniteľné miesta a potenciálny vplyv naru¬ šenia alebo zničenia kritickej infraštruktúry. [41]



Slovenia

Analiza tveganja pomeni obravnavo ustreznih scenarijev nevarnosti, da se ocenijo šibke točke in morebitne posledice okvare ali uničenja kritične infrastrukture. [42]



Spain

Análisis de riesgos, el estudio de hipótesis de amenazas posibles, para evaluar las vulnerabilidades y las posibles repercusiones de la perturbación o destrucción de infraestructuras críticas. [43]



Sweden

Riskanalys: övervägande av relevanta hotbilder, för att bedöma sårbarhet och potentiella konsekvenser av driftsstörning eller förstörelse av kritisk infrastruktur. [44]



Switzerland

Die Risikoanalyse erfasst und beschreibt systematisch die Risiken in einem betrachteten System. [45]

Dazu gehört die Einschätzung der Höhe der Risiken, oft in Form einer Einstufung der betrachteten Szenarien bzgl. ihrer Eintrittswahrscheinlichkeit und Schadensausmasses. Die Risikoanalyse befasst sich mit der Frage «was kann passieren?».

L’analyse des risques recense et décrit de manière systématique les risques dans un système donné. [46]

L’appréciation du niveau des risques, souvent sous forme d’une classification des scénarios considérés en function de leur [Probability|probabilité]] d’occurrence et de l’ampleur des dommages envisagés en fait partie. L’analyse des risques traite de la question «que peut-il arriver?».

L'analisi dei rischi rileva e descrive sistematicamente i rischi in un determinato sistema. [47]

Vi rientra la stima del livello dei rischi, spesso in forma di una classificazione degli scenari considerati in funzione della loro frequenza e dell’�entità dei danni. L'analisi dei rischi cerca di rispondere alla domanda «che cosa potrebbe succedere?».

United Kingdom

Risk analysis means consideration of relevant threat scenarios, in order to assess the vulnerability and the potential impact of disruption or destruction of critical infrastructure. [48]



United States

NIST
The process of identifying risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation, arising through the operation of an information system. [49]


Uruguay

Análisis de riesgo: Método cualitativo o cuantitativo para la evaluación del impacto del riesgo en la toma de decisiones. [50]



Standard Definition

IETF

An assessment process that systematically (a) identifies valuable system resources and threats to those resources, (b) quantifies loss exposures (i.e., loss potential) based on estimated frequencies and costs of occurrence, and (c) (optionally) recommends how to allocate available resources to countermeasures so as to minimize total exposure. [51]


ISO/IEC 27000:2014 and ISO 31000:2009

Process to comprehend the nature of risk and to determine the level of risk (based on the ISO Guide 73:2009) [52] [53]

Level of risk is expressed in terms of the combination of consequences and their likelihood.


See also

Notes

  1. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  2. ↑ ENISA Risk Glossary
  3. ↑ Australian Emergency Management Glossary, Emergency Management Australia (1998)
  4. ↑ Australia AS NZS 5050 (2010)
  5. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  6. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  7. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  8. ↑ REGULAMENTO SOBRE GESTÃO DE RISCO DAS REDES DE TELECOMUNICAÇÕES E USO DE SERVIÇOS DE TELECOMUNICAÇÕES EM SITUAÇÕES DE EMERGÊNCIA E DESASTRES (2012)
  9. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  10. ↑ Derived from ISO 31000:2009
  11. ↑ Vocabulaire de la gestion des urgencies/Emergency Management Emergency Management Vocabulary 281 (2012)
  12. ↑ Zakon o kritičnim infrastrukturama (Critical infrastructure act), 2013, in Official Gazette, No 56/2013 (Croat.)
  13. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  14. ↑ Výkladový slovník kybernetické bezpečnosti (2013)
  15. ↑ Cyber Security Explanatory Glossary (2013)
  16. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  17. ↑ Bekendtgørelse om identifikation og udpegning af europæisk kritisk infrastruktur på energiområdet og vurdering af behovet for bedre beskyttelse (EPCIP-direktivet)
  18. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  19. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  20. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  21. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  22. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  23. ↑ Προεδρικό Διάταγμα 39/2011 της Ελληνικής Δημοκρατίας που αφορά την προσαρμογή της ελληνικής νομοθεσίας προς τις διατάξεις τις οδηγίας 2008/114/ΕΚ του Συμβουλίου της Ευρωπαϊκής Ένωσης.
  24. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  25. ↑ Vocabulary of Comprehensive Security. Helsinki (TSK 47) (2014)
  26. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  27. ↑ India's DGQA Cyber Security Policy (2015)
  28. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  29. ↑ DECRETO LEGISLATIVO 11 aprile 2011 , n. 61 Attuazione della Direttiva 2008/114/CE recante l'individuazione e la designazione delle infrastrutture critiche europee e la valutazione della necessita' di migliorarne la protezione. (11G0101
  30. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  31. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  32. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  33. ↑ Règlement grand-ducal du 12 mars 2012 portant application de la directive 2008/114/CE du Conseil du 8 décembre 2008
  34. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  35. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  36. ↑ Zakboekje Preventie Cybercrime (2008
  37. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  38. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  39. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  40. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  41. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  42. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  43. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  44. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  45. ↑ Leitfaden Schutz kritischer Infrastrukturen 2015 / Glossar der Risikobegriffe, Bundesamt für Bevölkerungsschutz BABS, 29.4.2013
  46. ↑ Guide pour la protection des infrastructures critiques
  47. ↑ Glossario sui rischi, Ufficio federale della protezione della popolazione UFPP, 29.4.2013
  48. ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
  49. ↑ NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013
  50. ↑ Glossary CERTuy
  51. ↑ IETF RFC449 Internet Security Glossary 2
  52. ↑ ISO/IEC 27000:2014, Information technology -- Security techniques -- Information security management systems -- Overview and vocabulary
  53. ↑ ISO/IEC 31000:2009, Risk management -- Principles and guidelines
Retrieved from "https://websites.fraunhofer.de/CIPedia/index.php?title=Risk_Analysis&oldid=6027"