Insider threats: the major challenge to security risk management

Security risk management is by definition, a subjective and complex exercise and it takes time to perform properly. Human resources are fundamental assets for any organization, and as any other asset, they have inherent vulnerabilities that need to be handled, i.e. managed and assessed. However, the nature that characterize the human behavior and the organizational environment where they develop their work turn these task extremely difficult, hard to accomplish and prone to errors. Assuming security as a cost, organizations are usually focused on the efficiency of the security mechanisms implemented that enable them to protect against external attacks, disregarding the insider risks, which are much more difficult to assess. All these demands an interdisciplinary approach in order to combine technical solutions with psychology approaches in order to understand the organizational staff and detect any changes in their behaviors and characteristics. This paper intends to discuss some methodological challenges to evaluate the insider threats and its impacts, and integrate them in a security risk framework, that was defined according to the security standard ISO/IEC_JTC1, to support the security risk management process.

Systematic design analysis and risk management on engineered nanoparticles occupational exposure

The production of nanotechnology-based products is increasing, along with the conscience of the possible harmful effects of some nanomaterials. The “safety-by-design” approaches are getting attention as helpful tools to develop safer products and production processes. The Systematic Design Analysis Approach could help to identify the solutions to control the workplace risks by defining the emission and exposure scenarios and the possible barriers to interrupt them. By applying this approach in a photocatalytic ceramic tiles development project it was possible to identify relevant nanoparticles emission scenarios and related barriers, and defining possible ways to reduce it.

The concept of risk management in the renewable sector.

This study explores the perception of risk and the level of risk management implementation in the renewable sector. Risk management is emerging as a key issue due to the loss of confidence amongst banks, causing the attainment of financing to be difficult over the next few years. To attract financing, there is a fundamental requirement to manage risk in a way that minimizes the probability of a negative financial impact on the project. Miller and Lessard (2001) argue that successful projects are not selected but shaped with risk resolution in mind. Rather than evaluating projects at the outset based on projections of the full set of benefits, costs and risks over their lifetime, successful developers start with project ideas that have the potential of becoming viable. Therefore, this study bridges the gap that exists within the renewable sector in relation to risk management literature. This study succeeds through a detailed comparative case study analysis where two developers and two financiers were questioned through qualitative semi-structured interviews on the concept of risk management and its level implementation within the industry. It is believed that the growth in financed renewable energy projects depends on the adequate design and implementation of risk management to mitigate inherent project risks. However, this study revealed that are certain types of developers in existence within the renewable sector, which underestimate the magnitude of risk and view the development of projects as a ‘money racket’. Therefore, it can be concluded that perception of risk will also differ, causing risk and uncertainty to vary from project to project, resulting in investment reluctance to be associated with certain projects. The study originality lies in how it demonstrates to developers the concept of risk management, outlining the simplicity and benefits of implementing it in project development. Finally, this study contributes to the knowledge by enhancing the awareness and understanding of the presence and nature of risk in a RE project environment.

Risk Management Induction & Awareness (PDF 324 KB)

What You Need to Know

Farm-Level Analysis of Risk Management Proposals, March 2000

This paper presents a detailed report of the representative farm analysis (summarized in FAPRI Policy Working Paper #01-00). At the request of several members of the Committee on Agriculture, Nutrition, and Forestry of the U.S. Senate, we have continued to analyze the impacts of the Farmers’ Risk Management Act of 1999 (S. 1666) and the Risk Management for the 21st Century Act (S. 1580). Earlier analysis reported in FAPRI Policy Working Paper #04-99 concentrated on the aggregate net farm income and government outlay impacts. The representative farm analysis is conducted for several types of farms, including both irrigated and non-irrigated cotton farms in Tom Green County, Texas; dryland wheat farms in Morton County, North Dakota and Sumner County, Kansas; and a corn farm in Webster County, Iowa. We consider additional factors that may shed light on the differential impacts of the two plans. 1. Farm-level income impacts under alternative weather scenarios. 2. Additional indirect impacts, such as a change in ability to obtain financing. 3. Implications of within-year price shocks. Our results indicate that farmers who buy crop insurance will increase their coverage levels under S. 1580. Farmers with high yield risk find that the 65 percent coverage level maximizes expected returns, but some who feel that they obtain other benefits from higher coverage will find that the S. 1580 subsidy schedule significantly lowers the cost of obtaining the additional coverage. Farmers with lower yield risk find that the increased indemnities from additional coverage will more than offset the increase in producer premium. In addition, because S. 1580 extends its increased premium subsidy percentages to revenue insurance products, farmers will have an increased incentive to buy revenue insurance. Differences in the ancillary benefits from crop insurance under the baseline and S. 1580 would be driven by the increase in insurance participation and buy-up. Given the same levels of insurance participation and buy-up, the ancillary benefits under the two scenarios would be the same.

Risk management under a two-factor model of the term structure of interest rates

This paper presents several applications to interest rate risk managementbased on a two-factor continuous-time model of the term structure of interestrates previously presented in Moreno (1996). This model assumes that defaultfree discount bond prices are determined by the time to maturity and twofactors, the long-term interest rate and the spread (difference between thelong-term rate and the short-term (instantaneous) riskless rate). Several newmeasures of ``generalized duration" are presented and applied in differentsituations in order to manage market risk and yield curve risk. By means ofthese measures, we are able to compute the hedging ratios that allows us toimmunize a bond portfolio by means of options on bonds. Focusing on thehedging problem, it is shown that these new measures allow us to immunize abond portfolio against changes (parallel and/or in the slope) in the yieldcurve. Finally, a proposal of solution of the limitations of conventionalduration by means of these new measures is presented and illustratednumerically.

A reflection about the social and technological aspects in flood risk management - the case of the Italian Civil Protection

The right of a person to be protected from natural hazards is a characteristic of the social and economical development of the society. This paper is a contribution to the reflection about the role of Civil Protection organizations in a modern society. The paper is based in the inaugural conference made by the authors on the 9th Plinius Conference on Mediterranean Storms. Two major issues are considered. The first one is sociological; the Civil Protection organizations and the responsible administration of the land use planning should be perceived as reliable as possible, in order to get consensus on the restrictions they pose, temporary or definitely, on the individual free use of the territory as well as in the entire warning system. The second one is technological: in order to be reliable they have to issue timely alert and warning to the population at large, but such alarms should be as "true" as possible. With this aim, the paper summarizes the historical evolution of the risk assessment, starting from the original concept of "hazard", introducing the concepts of "scenario of event" and "scenario of risk" and ending with a discussion about the uncertainties and limits of the most advanced and efficient tools to predict, to forecast and to observe the ground effects affecting people and their properties. The discussion is centred in the case of heavy rains and flood events in the North-West of Mediterranean Region.

Risk management systems in society

Kirjoitus perustuu 24.9.1996 pidettyyn esitelmään yhteiskunnan riskien hallintaa käsittelevässä seminaarissa.

Three essays in risk management in financial institutions

The choice to adopt risk-sensitive measurement approaches for operational risks: the case of Advanced Measurement Approach under Basel II New Capital Accord This paper investigates the choice of the operational risk approach under Basel II requirements and whether the adoption of advanced risk measurement approaches allows banks to save capital. Among the three possible approaches for operational risk measurement, the Advanced Measurement Approach (AMA) is the most sophisticated and requires the use of historical loss data, the application of statistical tools, and the engagement of a highly qualified staff. Our results provide evidence that the adoption of AMA is contingent on the availability of bank resources and prior experience in risk-sensitive operational risk measurement practices. Moreover, banks that choose AMA exhibit low requirements for capital and, as a result might gain a competitive advantage compared to banks that opt for less sophisticated approaches. - Internal Risk Controls and their Impact on Bank Solvency Recent cases in financial sector showed the importance of risk management controls on risk taking and firm performance. Despite advances in the design and implementation of risk management mechanisms, there is little research on their impact on behavior and performance of firms. Based on data from a sample of 88 banks covering the period between 2004 and 2010, we provide evidence that internal risk controls impact the solvency of banks. In addition, our results show that the level of internal risk controls leads to a higher degree of solvency in banks with a major shareholder in contrast to widely-held banks. However, the relationship between internal risk controls and bank solvency is negatively affected by BHC growth strategies and external restrictions on bank activities, while the higher regulatory requirements for bank capital moderates positively this relationship. - The Impact of the Sophistication of Risk Measurement Approaches under Basel II on Bank Holding Companies Value Previous research showed the importance of external regulation on banks' behavior. Some inefficient standards may accentuate risk-taking in banks and provoke a financial crisis. Despite the growing literature on the potential effects of Basel II rules, there is little empirical research on the efficiency of risk-sensitive capital measurement approaches and their impact on bank profitability and market valuation. Based on data from a sample of 66 banks covering the period between 2008 and 2010, we provide evidence that prudential ratios computed under Basel II standards predict the value of banks. However, this relation is contingent on the degree of sophistication of risk measurement approaches that banks apply. Capital ratios are effective in predicting bank market valuation when banks adopt the advanced approaches to compute the value of their risk-weighted assets.

Potential impact of single-risk-factor versus total risk management for the prevention of cardiovascular events in Seychelles.

OBJECTIVE: To assess the prevalence of cardiovascular (CV) risk factors in Seychelles, a middle-income African country, and compare the cost-effectiveness of single-risk-factor management (treating individuals with arterial blood pressure >/= 140/90 mmHg and/or total serum cholesterol >/= 6.2 mmol/l) with that of management based on total CV risk (treating individuals with a total CV risk >/= 10% or >/= 20%).METHODS: CV risk factor prevalence and a CV risk prediction chart for Africa were used to estimate the 10-year risk of suffering a fatal or non-fatal CV event among individuals aged 40-64 years. These figures were used to compare single-risk-factor management with total risk management in terms of the number of people requiring treatment to avert one CV event and the number of events potentially averted over 10 years. Treatment for patients with high total CV risk (>/= 20%) was assumed to consist of a fixed-dose combination of several drugs (polypill). Cost analyses were limited to medication.FINDINGS: A total CV risk of >/= 10% and >/= 20% was found among 10.8% and 5.1% of individuals, respectively. With single-risk-factor management, 60% of adults would need to be treated and 157 cardiovascular events per 100 000 population would be averted per year, as opposed to 5% of adults and 92 events with total CV risk management. Management based on high total CV risk optimizes the balance between the number requiring treatment and the number of CV events averted.CONCLUSION: Total CV risk management is much more cost-effective than single-risk-factor management. These findings are relevant for all countries, but especially for those economically and demographically similar to Seychelles.