B’Risk adopts a comprehensive enterprise security risk management methodology to identify the potential IS risks faced by the IT organization. The identification covers various areas :- general IT strategic management, policies, procedures, computer operations management, access control management, operating system security management, internal network security management, desktop security, physical security, internet security management et al.

Value add:

 Identification of IT risk prone areas

 Identification of risk events that might impact on IT assets

 Development of action plan for graduation to a secured architecture

 Implementation of comprehensive security and management policies

Information is the lifeblood of all organizations and can exist in many forms. In today's competitive business environment, such information is constantly under threat from many sources. These can be internal, external, accidental, or malicious. With the increased use of new technology to store, transmit, and retrieve information, we have all opened ourselves up to increased numbers and types of threats. Threats could be in any of the following business processes

 General IT Framework

 Software Procurement / Development Process

 Hardware Procurement / Management Process

 Network Management Process

 Disaster Management Process

 Computer operations

 Applications Management Process
There is a need to establish a comprehensive Information Security Policy within all organizations. We need to ensure the confidentiality, integrity, and availability of both vital corporate information and customer information

The process of IS Security Review depends on

 The sophistication of your existing Security system,

 The size of your organization, and

 The complexity of your information systems.

The benefits out of an organized information security review are given as under:

 Reduced operational risk and increased business efficiency

 Assurance that information security is being rationally applied

 Enables Information Security Management to be addressed in practical, cost effective, realistic and comprehensive manner

 Establishes mutual trust between networked sites

 Enhances quality assurance

 Facilitates internal operational control

 Demonstrates a high and appropriate standard of security

 Security awareness amongst staff and managers

 All security relevant information processing and supporting activities are in control

 Management actively focus on information security and its effectiveness

Information security policy definition aims at creating or reviewing an organization specific security policy through the understanding of information security requirements and associated priorities. Similarly Enterprise Security Architecture will develop or review security architecture principles and procedures that can be used to make management and technology decisions consistent with the organization’s security objectives.

Value add:

 Quality manual consisting of security policies and procedures.

 Effective tool for implementing IS Security in the organization.

 Guide for the employees to understand and comply with the security aspects.

A review of the Computerized Application Systems forming part of the Information systems is essential because Application Systems form the backbone for operations. Input, Process, Output and Database controls and procedures are reviewed in detail to provide assurance to the management. This service will evaluate and identify vulnerabilities in the boundary systems from the Physical Access, Logical Access and Network Security fronts.

Value add:

 Confidence on the application system with respect to access and system controls.

 Review of Level of customization.

 Smooth running of operations through business process reengineering.

Application implemented should address all the needs of an organization viz., efficiency, effectiveness, confidentiality, availability, data integrity etc., The most important layer of success of any application implementation is user satisfaction. Apart from the user satisfaction there shall be various security controls related areas which would need to be addressed independently to assure the management and users about the abilities of the application to enable business process.

B’Risk has addressed this need by a comprehensive methodology covering the various needs of pre application usage analysis. The following picture demonstrates a broad coverage of an Independent ERP – Pre Usage Analysis.

A review of the Computerized Application Systems forming part of the Information systems is essential because Application Systems form the backbone of operations. Input, Process, Output and Database controls and procedures are reviewed in detail to provide assurance to the management.

This service will also evaluate and identify vulnerabilities in the boundary systems from the Physical Access, Logical Access and Network Security fronts. The following are certain key focuses of a post ERP implementation review:

 Adequacy of access controls built in the application system in concurrence with the delegation of powers and organization structure

 Adequacy of input controls to ensure that only authentic data is updated into the application system.

 Sufficiency of process controls to enable error free processing and identification of software bugs / glitches. Further analysis of transaction logs, batch processing, reconciliation of records to ensure complete processing.

 Analysis of database controls to identify whether the right database is used and updated apart from security built into the systems from fraudulent modification

 System of output controls for analyzing the storage media, forms, reports distribution with the objective of eliminating the risk of fraud or error.

 Confidence on the application system with respect to access and system controls.

 Review of Level of customization.

 Smooth running of operations through business process reengineering.

A report shall be issued at the end of the assignment giving a detailed list of risks encountered during the review along with an action plan to implement controls to eliminate/reduce the impact of risks.

Are you using your ERP to the best extent?
Computerization was a blessing to the corporate world. Automation has promised to change the world and the way we work. Latest technologies, concepts, software are looking so attractive that we feel everything is going to get simplified.

In the hope that computerization, technology and automation can elevate the way work goes on, managements invest hugely on ERP and other technologies. But even after the implementation it remains unanswered if the management is reaping the benefits. Many a times it is assumed that computerization will automatically start giving results. At B’Risk we believe that it is important to evaluate how well the ERP is performing at the following individual levels:-
a. Is the ERP properly being utilized?
b. Has it increased the efficiency of the processes?
c. Has it helped reduce the time of transaction?
d. Has it made the work simple for the employees?
e. Are the employees satisfied with the ERP?
f. Has it reduced the cost of operations?

Sometimes, ERP is of no use if the business processes are not redesigned / reengineered accordingly. Also, ERP sometimes brings in different variety of security threats and risks. An intelligent, computer savvy fraudster could find ways to breach the system.

B’Risk with its deep experience of aligning business processes and evaluating ERP systems in India and abroad can help diagnose through a comprehensive “Systems Audit” and develop areas of improvement or concern.

B'Risk tailor makes the Systems Audit to suit the client’s specific needs and generate recommendations. Some of the areas of improvement that can be suggested (illustrative only) are as under:
a. Identify the areas where the processes have to be redesigned to match the ERP
b. Identify the areas which are not properly customized to the user needs
c. Identify the modules / features in the ERP which are not being used
d. Identify the manual activities that can be immediately done through ERP
e. Identify the security threats in the system that may be compromised

B'Risk does not stop just by identification of the issue / area, but also develops a practical, realistic, user-friendly recommendation. It also documents the action plan for implementation of the recommendation.

Every modern business needs Business Continuity Plan to ensure continuity of critical operations even when faced with the threat of disruption. Disaster Recovery Plan is needed to bring back the operations to normalcy after a disruption. As a part of IS assurance B'Risk will evaluate how prepared the organization isin case of such threats. This includes a review of the BCP/DRP procedures, backup plan, emergency plan, and recovery plan. A systematic and documented test of such preparedness is also carried out.
Value add:

 Development of a Comprehensive Business Continuity Plan and Disaster Recovery plan for your organization.

 Customer confidence

 Quick recouping of operations to normalcy through BCP after a disruption