text:
Origin and function of meiosis
From Wikipedia, the free encyclopedia
Jump to: navigation, search
The origin and function of meiosis are fundamental to understanding the evolution of sexual reproduction in eukaryotes. There is no current consensus among biologists on the questions of how sex in Eukaryotes arose in evolution, what basic function sexual reproduction serves, and why it is maintained, given the basic two-fold cost of sex. It is clear that it evolved over 1.2 billion years ago, and that almost all species which are descendents of the original sexually reproducing species are still sexual reproducers, including plants, fungi, and animals.
Meiosis is a key event of the sexual cycle in Eukaryotes. It is the stage of the life cycle when a cell gives rise to two haploid cells (gametes) each having half as many chromosomes. Two such haploid gametes, arising from different individual organisms, fuse by the process of fertilization, thus completing the sexual cycle.
Meiosis is ubiquitous among eukaryotes. It occurs in single-celled organisms such as yeast, as well as in multicellular organisms, such as humans. Eukaryotes arose from prokaryotes more than 2.2 billion years ago[1] and the earliest eukaryotes were likely single-celled organisms. To understand sex in eukaryotes, it is necessary to understand (1) how meiosis arose in single celled eukaryotes, and (2) the function of meiosis.
Contents
[hide]
1 Origin of meiosis
1.1 From prokaryotic sex
1.2 From mitosis
1.3 Coevolution with mitosis
2 Function
2.1 Stress induced sex
2.2 DNA repair
2.3 Genetic diversity
3 See also
4 References
Origin of meiosis[edit]
There are two conflicting theories on how meiosis arose. One is that meiosis evolved from prokaryotic sex as eukaryotes evolved from prokaryotes.[2] The other is that meiosis arose from mitosis.[3]
From prokaryotic sex[edit]
In prokaryotic sex, DNA from one prokaryote is released into the surrounding medium, is then taken up by another prokaryote and its information integrated into the DNA of the recipient prokaryote. In modern prokaryotes the donor DNA is transferred by conjugation, transduction or transformation. Transformation is hypothesized to be the ancestral mechanism,[4] in which DNA from one prokaryote is released into the surrounding medium and then taken up by another prokaryotic cell. One theory on how meiosis arose is that it evolved from transformation.[4] According to this view, the evolutionary transition from prokaryotic sex to eukaryotic sex was continuous.
Transformation, like meiosis, is a complex process requiring the function of numerous gene products. A key similarity between prokaryotic sex and eukaryotic sex is that DNA originating from two different individuals (parents) join up so that homologous sequences are aligned with each other, and this is followed by exchange of genetic information (a process called genetic recombination). After the new recombinant chromosome is formed it is passed on to progeny.
When genetic recombination occurs between DNA molecules originating from different parents, the recombination process is catalyzed in prokaryotes and eukaryotes by enzymes that have similar functions and that are evolutionarily related. One of the most important enzymes catalyzing this process in bacteria is referred to as RecA, and this enzyme has two functionally similar counterparts that act in eukaryotic meiosis, RAD51 and DMC1.[5]
The evolution of meiosis from transformation happened as eukaryotes evolved through endosymbiosis between an anaerobic host cell, most likely to be an archaeon[6][7] and an internalized aerobic bacterium, most likely to be a descendant of α-proteobacterium, a likely ancestor of extant mitochondria.[8] A genomic analysis on 630 orthologous groups hints a close evolutionary relationship between alpha-proteobacterial and eukaryotic proteins,[9] suggesting there was indeed genetic transfer and, therefore, transformation between the two cells. Furthermore, in extant organisms, the RecA gene orthologs which are crucial for meiotic recombination have a high sequence similarity to that of the RecA gene in proteobacteria or cyanobacteria. This indicates a gene flow involving RecA gene or its orthologs from pre-mitochondrial bacteria to ancestral eukaryotes.[10] Since the ancestors of eukaryotes were then homogenized to be able to undergo transformation, the genes needed for transformation, including RecA found in eubacteria and Rad51 family found in archaea, were likely descended to early eukaryotes as well and mutated into the ancestral meiotic genes.
Support for the theory that meiosis arose from prokaryotic transformation comes from the increasing evidence that early diverging lineages of eukaryotes have the core genes for meiosis. This implies that the precursor to meiosis was already present in the prokaryotic ancestor of eukaryotes. For instance the common intestinal parasite Giardia intestinalis, a simple eukaryotic protozoan was, until recently, thought to be descended from an early diverging eukaryotic lineage that lacked sex. However, it has since been shown that G. intestinalis contains within its genome a core set of genes that function in meiosis, including five genes that function only in meiosis.[11] In addition, G. intestinalis was recently found to undergo a specialized, sex-like process involving meiosis gene homologs.[12] This evidence, and other similar examples, suggest that a primitive form of meiosis, was present in the common ancestor of all eukaryotes, an ancestor that arose from an antecedent prokaryote.[4][13]
From mitosis[edit]
Mitosis is the normal process in eukaryotes for cell division, duplicating chromosomes and segregating one of the two copies into each of the two daughter cells, and contrast with meiosis. The mitosis theory states that meiosis evolved from mitosis.[3] On this theory, early eukaryotes evolved mitosis first, became established and only then did meiosis and sexual reproduction arise.
Support for the idea that meiosis arose from mitosis is the observation that some features, such as the meiotic spindles that draw chromosome sets into separate daughter cells upon cell division, and processes regulating cell division, employ the same, or similar, molecular machinery. Yet there is no compelling evidence for a period in the early evolution of eukaryotes during which meiosis and accompanying sexual capability did not yet exist.
In addition, as noted by Wilkins and Holliday,[3] there are four novel steps needed in meiosis that are not present in mitosis. These are: (1) pairing of homologous chromosomes, (2) extensive recombination between homologs; (3) suppression of sister chromatid separation in the first meiotic division; and (4) avoiding chromosome replication during the second meiotic division. Although the introduction of these steps seems to be complicated, Wilkins and Holliday argue that only one new step, homolog synapsis, that was particularly initiated in the evolution of meiosis from mitosis. Meanwhile, two of the other novel features appear to be simply modified, and extensive recombination could have evolved later.[3]
Coevolution with mitosis[edit]
If meiosis arose from prokaryotic transformation, during the early evolution of eukaryotes, mitosis and meiosis could have evolved in parallel, with both processes using common molecular components, where mitosis evolved from the molecular machinery used by prokaryotes for DNA replication and segregation, and meiosis evolved from the prokaryotic sexual process of transformation, but meiosis also made use of the evolving molecular machinery for DNA replication and segregation.
Function[edit]
Stress induced sex[edit]
Abundant evidence indicates that facultative sexual eukaryotes tend to undergo sexual reproduction under stressful conditions. For instance, the budding yeast Saccharomyces cerevisiae (a single-celled fungus) reproduces mitotically (asexually) as diploid cells when nutrients are abundant, but switches to meiosis (sexual reproduction) under starvation conditions.[14] The unicellular green alga, Chlamydomonas reinhardtii grows as vegetative cells in nutrient rich growth medium, but depletion of a source of nitrogen in the medium leads to gamete fusion, zygote formation and meiosis.[15] The fission yeast Schizosaccharomyces pombe, treated with H2O2 to cause oxidative stress, substantially increases the proportion of cells which undergo meiosis.[16] The simple multicellular eukaryote Volvox carteri undergoes sex in response to oxidative stress[17] or stress from heat shock.[18] These examples, and others, suggest that, in simple single-celled and multicellular eukaryotes, meiosis is an adaptation to respond to stress.
Prokaryotic sex also appears to be an adaptation to stress. For instance, transformation occurs near the end of logarithmic growth, when amino acids become limiting in Bacillus subtilis,[19] or in Haemophilus influenzae when cells are grown to the end of logarithmic phase.[20] In Streptococcus mutans and other streptococci, transformation is associated with high cell density and biofilm formation.[21] In Streptococcus pneumoniae, transformation is induced by the DNA damaging agent mitomycin C.[22] These, and other, examples indicate that prokaryotic sex, like meiosis in simple eukaryotes, is an adaptation to stressful conditions. This observation suggests that the natural selection pressures maintaining meiosis in eukaryotes are similar to the selective pressures maintaining prokaryotic sex. This similarity suggests continuity, rather than a gap, in the evolution of sex from prokaryotes to eukaryotes.
Stress is, however, a general concept. What is it specifically about stress that needs to be overcome by meiosis? And what is the specific benefit provided by meiosis that enhances survival under stressful conditions?
DNA repair[edit]
In one theory, meiosis is primarily an adaptation for repairing DNA damage. Environmental stresses often lead to oxidative stress within the cell, which is well known to cause DNA damage through the production of reactive forms of oxygen, known as reactive oxygen species (ROS). DNA damages, if not repaired, can kill a cell by blocking DNA replication, or transcription of essential genes.
When only one strand of the DNA is damaged, the lost information (nucleotide sequence) can ordinarily be recovered by repair processes that remove the damaged sequence and fill the resulting gap by copying from the opposite intact strand of the double helix. However, ROS also cause a type of damage that is difficult to repair, referred to as double-strand damage. One common example of double-strand damage is the double-strand break. In this case, genetic information (nucleotide sequence) is lost from both strands in the damaged region, and proper information can only be obtained from another intact chromosome homologous to the damaged chromosome. The process that the cell uses to accurately accomplish this type of repair is called recombinational repair.
Meiosis is distinct from mitosis in that a central feature of meiosis is the alignment of homologous chromosomes followed by recombination between them. The two chromosomes which pair are referred to as non-sister chromosomes, since they did not arise simply from the replication of a parental chromosome. Recombination between non-sister chromosomes at meiosis is known to be a recombinational repair process that can repair double-strand breaks and other types of double-strand damage.[2] In contrast, recombination between sister chromosomes cannot repair double-strand damages arising prior to the replication which produced them. Thus on this view, the adaptive advantage of meiosis is that it facilitates recombinational repair of DNA damage that is otherwise difficult to repair, and that occurs as a result of stress, particularly oxidative stress.[23][24] If left unrepaired, this damage would likely be lethal to gametes and inhibit production of viable progeny.
Even in multicellular eukaryotes, such as humans, oxidative stress is a problem for cell survival. In this case, oxidative stress is a byproduct of oxidative cellular respiration occurring during metabolism in all cells. In humans, on average, about 50 DNA double-strand breaks occur per cell in each cell generation.[25] Meiosis, which facilitates recombinational repair between non-sister chromosomes, can efficiently repair these prevalent damages in the DNA passed on to germ cells, and consequently prevent loss of fertility in humans. Thus with the theory that meiosis arose from prokaryotic sex, recombinational repair is the selective advantage of meiosis in both single celled eukaryotes and muticellular eukaryotes, such as humans.
An argument against this hypothesis is that adequate repair mechanisms including those involving recombination already exist in prokaryotes.[26] Prokaryotes do have DNA repair mechanism enriched with recombinational repair,[27] and the existence of prokaryotic life in severe environment indicates the extreme efficiency of this mechanism to help them survive many DNA damages related to the environment. This implies that an extra costly repair in the form of meiosis would be unnecessary. However, most of these mechanisms cannot be as accurate as and is possibly more mutagenic than the repair mechanism provided by meiosis. They primarily do not require a second homologous chromosome for the recombination that promotes a more extensive repair. Thus, despite the efficiency of recombinational repair involving sister chromatids, the repair still needs to be improved, and another type of repair is required.[28] Moreover, due to the more extensive homologous recombinational repair in meiosis in comparison to the repair in mitosis, meiosis as a repair mechanism can accurately remove any damage that arises at any stage of the cell cycle more than mitotic repair mechanism can do [29] and was, therefore, naturally selected. In contrast, the sister chromatid in mitotic recombination could have been exposed to similar amount of stress, and, thus, this type of recombination, instead of eliminating the damage, could actually spread the damage[28] and decrease fitness.
Genetic diversity[edit]
On the other view, stress is a signal to the cell that the environment is becoming adverse. Under this new condition, it may be beneficial to produce progeny that differ from the parent in their genetic make up. Among these varied progeny, some may be more adapted to the changed condition than their parents. Meiosis generates genetic variation in the diploid cell, in part by the exchange of genetic information between the pairs of chromosomes after they align (recombination). Thus, on this view,[30] the advantage of meiosis is that it facilitates the generation of genomic diversity among progeny, allowing adaptation to adverse changes in the environment.
However, in the presence of a fairly stable environment, individuals surviving to reproductive age have genomes that function well in their current environment. They raise the question of why such individuals should risk shuffling their genes with those of another individual, as occurs during meiotic recombination? Considerations such as this have led many investigators to question whether genetic diversity is the adaptive advantage of sex.
See also[edit]
DNA repair
Giardia
Oxidative stress
Asexual reproduction, ways to avoid the two-fold cost of sexual reproduction
Apomixis
Parthenogenesis
References[edit]
Jump up ^ Retallack GJ, Krull ES, Thackeray GD, Parkinson D (2013-09-01). "Problematic urn-shaped fossils from a Paleoproterozoic (2.2 Ga) paleosol in South Africa". Precambrian Research. 235: 71–87. Bibcode:2013PreR..235...71R. doi:10.1016/j.precamres.2013.05.015.
^ Jump up to: a b Bernstein H, Bernstein C, Michou RE (2011). "Meiosis as an Evolutionary Adaptation for DNA Repair". In Kruman I. DNA repair. InTech. doi:10.5772/1751. ISBN 978-953-307-697-3.
^ Jump up to: a b c d Wilkins AS, Holliday R (January 2009). "The evolution of meiosis from mitosis". Genetics. 181 (1): 3–12. doi:10.1534/genetics.108.099762. PMC 2621177  . PMID 19139151.
^ Jump up to: a b c Bernstein H, Bernstein C (2010). "Evolutionary origin of recombination during meiosis". BioScience. 60 (7): 498–505. doi:10.1525/bio.2010.60.7.5.
Jump up ^ Villeneuve AM, Hillers KJ (September 2001). "Whence meiosis?". Cell. 106 (6): 647–50. doi:10.1016/s0092-8674(01)00500-1. PMID 11572770.
Jump up ^ Cox CJ, Foster PG, Hirt RP, Harris SR, Embley TM (December 2008). "The archaebacterial origin of eukaryotes". Proceedings of the National Academy of Sciences of the United States of America. 105 (51): 20356–61. Bibcode:2008PNAS..10520356C. doi:10.1073/pnas.0810647105. PMC 2629343  . PMID 19073919.
Jump up ^ Spang A, Saw JH, Jørgensen SL, Zaremba-Niedzwiedzka K, Martijn J, Lind AE, van Eijk R, Schleper C, Guy L, Ettema TJ (May 2015). "Complex archaea that bridge the gap between prokaryotes and eukaryotes". Nature. 521 (7551): 173–9. Bibcode:2015Natur.521..173S. doi:10.1038/nature14447. PMC 4444528  . PMID 25945739.
Jump up ^ Gray MW, Burger G, Lang BF (March 1999). "Mitochondrial evolution". Science. 283 (5407): 1476–81. Bibcode:1999Sci...283.1476G. doi:10.1126/science.283.5407.1476. PMID 10066161.
Jump up ^ Gabaldón T, Huynen MA (August 2003). "Reconstruction of the proto-mitochondrial metabolism". Science. 301 (5633): 609. doi:10.1126/science.1085463. PMID 12893934.
Jump up ^ Lin Z, Kong H, Nei M, Ma H (July 2006). "Origins and evolution of the recA/RAD51 gene family: evidence for ancient gene duplication and endosymbiotic gene transfer". Proceedings of the National Academy of Sciences of the United States of America. 103 (27): 10328–33. Bibcode:2006PNAS..10310328L. doi:10.1073/pnas.0604232103. PMC 1502457  . PMID 16798872.
Jump up ^ Ramesh MA, Malik SB, Logsdon JM (January 2005). "A phylogenomic inventory of meiotic genes; evidence for sex in Giardia and an early eukaryotic origin of meiosis". Current Biology. 15 (2): 185–91. doi:10.1016/j.cub.2005.01.003. PMID 15668177.
Jump up ^ Poxleitner MK, Carpenter ML, Mancuso JJ, Wang CJ, Dawson SC, Cande WZ (March 2008). "Evidence for karyogamy and exchange of genetic material in the binucleate intestinal parasite Giardia intestinalis". Science. 319 (5869): 1530–3. Bibcode:2008Sci...319.1530P. doi:10.1126/science.1153752. PMID 18339940.
Jump up ^ Malik SB, Pightling AW, Stefaniak LM, Schurko AM, Logsdon JM (August 2007). Hahn MW, ed. "An expanded inventory of conserved meiotic genes provides evidence for sex in Trichomonas vaginalis". PLoS One. 3 (8): e2879. Bibcode:2008PLoSO...3.2879M. doi:10.1371/journal.pone.0002879. PMC 2488364  . PMID 18663385.
Jump up ^ Herskowitz I (December 1988). "Life cycle of the budding yeast Saccharomyces cerevisiae". Microbiological Reviews. 52 (4): 536–53. PMC 373162  . PMID 3070323.
Jump up ^ Sager R, Granick S (July 1954). "Nutritional control of sexuality in Chlamydomonas reinhardi". The Journal of General Physiology. 37 (6): 729–42. doi:10.1085/jgp.37.6.729. PMC 2147466  . PMID 13174779.
Jump up ^ Bernstein C, Johns V (April 1989). "Sexual reproduction as a response to H2O2 damage in Schizosaccharomyces pombe". Journal of Bacteriology. 171 (4): 1893–7. doi:10.1128/jb.171.4.1893-1897.1989. PMC 209837  . PMID 2703462.
Jump up ^ Nedelcu AM, Michod RE (November 2003). "Sex as a response to oxidative stress: the effect of antioxidants on sexual induction in a facultatively sexual lineage". Proceedings: Biological Sciences. 270 Suppl 2 (Suppl 2): S136–9. doi:10.1098/rsbl.2003.0062. PMC 1809951  . PMID 14667362.
Jump up ^ Kirk DL, Kirk MM (January 1986). "Heat shock elicits production of sexual inducer in Volvox". Science. 231 (4733): 51–4. Bibcode:1986Sci...231...51K. doi:10.1126/science.3941891. PMID 3941891.
Jump up ^ Anagnostopoulos C, Spizizen J (May 1961). "Requirements for Transformation in Bacillus Subtilis". Journal of Bacteriology. 81 (5): 741–6. PMC 279084  . PMID 16561900.
Jump up ^ Goodgal SH, Herriott RM (July 1961). "Studies on transformations of Hemophilus influenzae. I. Competence". The Journal of General Physiology. 44 (6): 1201–27. doi:10.1085/jgp.44.6.1201. PMC 2195138  . PMID 13707010.
Jump up ^ Aspiras MB, Ellen RP, Cvitkovitch DG (September 2004). "ComX activity of Streptococcus mutans growing in biofilms". FEMS Microbiology Letters. 238 (1): 167–74. doi:10.1016/j.femsle.2004.07.032. PMID 15336418.
Jump up ^ Claverys JP, Prudhomme M, Martin B (2006). "Induction of competence regulons as a general response to stress in gram-positive bacteria". Annual Review of Microbiology. 60: 451–75. doi:10.1146/annurev.micro.60.080805.142139. PMID 16771651.
Jump up ^ Bernstein H, Byerly HC, Hopf FA, Michod RE (September 1985). "Genetic damage, mutation, and the evolution of sex". Science. 229 (4719): 1277–81. Bibcode:1985Sci...229.1277B. doi:10.1126/science.3898363. PMID 3898363.
Jump up ^ Michod RE, Bernstein H, Nedelcu AM (May 2008). "Adaptive value of sex in microbial pathogens". Infection, Genetics and Evolution. 8 (3): 267–85. doi:10.1016/j.meegid.2008.01.002. PMID 18295550. http://www.hummingbirds.arizona.edu/Faculty/Michod/Downloads/IGE%20review%20sex.pdf
Jump up ^ Vilenchik MM, Knudson AG (October 2003). "Endogenous DNA double-strand breaks: production, fidelity of repair, and induction of cancer". Proceedings of the National Academy of Sciences of the United States of America. 100 (22): 12871–6. Bibcode:2003PNAS..10012871V. doi:10.1073/pnas.2135498100. PMC 240711  . PMID 14566050.
Jump up ^ Lenormand T, Engelstädter J, Johnston SE, Wijnker E, Haag CR (October 2016). "Evolutionary mysteries in meiosis". Philosophical Transactions of the Royal Society of London. Series B, Biological Sciences. 371 (1706): 050831. bioRxiv 050831  . doi:10.1098/rstb.2016.0001  . PMC 5031626  . PMID 27619705.
Jump up ^ Marcon E, Moens PB (August 2005). "The evolution of meiosis: recruitment and modification of somatic DNA-repair proteins". BioEssays. 27 (8): 795–808. doi:10.1002/bies.20264. PMID 16015600.
^ Jump up to: a b Hörandl E, Hadacek F (December 2013). "The oxidative damage initiation hypothesis for meiosis". Plant Reproduction. 26 (4): 351–67. doi:10.1007/s00497-013-0234-7. PMC 3825497  . PMID 23995700.
Jump up ^ Bernstein, H., C. Bernstein, and R. E. Michod (2012). "DNA repair as the primary adaptive function of sex in bacteria and eukaryotes". International Journal of Medical and Biological Frontiers. 18. ISSN 1081-3829. CS1 maint: Multiple names: authors list (link)
Jump up ^ Otto SP, Gerstein AC (August 2006). "Why have sex? The population genetics of sex and recombination". Biochemical Society Transactions. 34 (Pt 4): 519–22. doi:10.1042/BST0340519. PMID 16856849.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Origin_and_function_of_meiosis&oldid=815643223"
Categories:
Mitosis
DNA repair
Meiosis
Hidden categories:
CS1 maint: Multiple names: authors list
Articles created via the Article Wizard
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
தமிழ்
Edit links
This page was last edited on 16 December 2017, at 03:25.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

key: html

type: local

value: div

attrs: id class

values: mw-page-base noprint

values: mw-head-base noprint

value: a

attrs: id class lang

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

attrs: href title

attrs: href class title

values: /wiki/Eukaryotes mw-redirect Eukaryotes

values:
/wiki/Two-fold_cost_of_sex
mw-redirect
Two-fold cost of sex

values: /wiki/Plants mw-redirect Plants

values: /wiki/Fungi mw-redirect Fungi

values: /wiki/Animals mw-redirect Animals

values:
/wiki/Giardia_intestinalis
mw-redirect
Giardia intestinalis

values:
/wiki/Homologous_chromosomes
mw-redirect
Homologous chromosomes

values:
/wiki/Double-strand_breaks
mw-redirect
Double-strand breaks

values:
nofollow
external text
//doi.org/10.5772%2F1751

values:
nofollow
external text
//doi.org/10.1534%2Fgenetics.108.099762

attrs: alt src title width height srcset data-file-width data-file-height

values:
/wiki/PubMed_Identifier
mw-redirect
PubMed Identifier

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/19139151

values:
nofollow
external text
//doi.org/10.1525%2Fbio.2010.60.7.5

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/11572770

values:
nofollow
external text
//doi.org/10.1073%2Fpnas.0810647105

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/19073919

values:
nofollow
external text
//doi.org/10.1038%2Fnature14447

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/25945739

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/10066161

values:
nofollow
external text
//doi.org/10.1126%2Fscience.1085463

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/12893934

values:
nofollow
external text
//doi.org/10.1073%2Fpnas.0604232103

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/16798872

values:
nofollow
external text
//doi.org/10.1016%2Fj.cub.2005.01.003

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/15668177

values:
nofollow
external text
//doi.org/10.1126%2Fscience.1153752

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/18339940

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/18663385

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/3070323

values:
nofollow
external text
//doi.org/10.1085%2Fjgp.37.6.729

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/13174779

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/2703462

values:
nofollow
external text
//doi.org/10.1098%2Frsbl.2003.0062

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/14667362

values:
nofollow
external text
//doi.org/10.1126%2Fscience.3941891

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/3941891

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/16561900

values:
nofollow
external text
//doi.org/10.1085%2Fjgp.44.6.1201

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/13707010

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/15336418

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/16771651

values:
nofollow
external text
//doi.org/10.1126%2Fscience.3898363

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/3898363

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/18295550

values:
nofollow
external text
//doi.org/10.1073%2Fpnas.2135498100

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/14566050

values:
nofollow
external text
//doi.org/10.1101/050831

values:
nofollow
external text
//doi.org/10.1098%2Frstb.2016.0001

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/27619705

values:
nofollow
external text
//doi.org/10.1002%2Fbies.20264

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/16015600

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/23995700

values:
nofollow
external text
//www.worldcat.org/issn/1081-3829

values: Category:CS1 maint: Multiple names: authors list

values:
nofollow
external text
//doi.org/10.1042%2FBST0340519

values:
nofollow
external text
//www.ncbi.nlm.nih.gov/pubmed/16856849

values: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

values: Category:Articles created via the Article Wizard

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

values:
/wiki/Origin_and_function_of_meiosis
View the content page [ctrl-alt-c]
c

values: Discussion about the content page [ctrl-alt-t]

values: p-namespaces navigation vectorTabs p-namespaces-label

values:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

values: Past revisions of this page [ctrl-alt-h]

values: p-views navigation vectorTabs p-views-label

values:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

values:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

values:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

values:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

values:
uls-settings-trigger
Language settings
0
button
true

values: குன்றல் பகுப்பு தோற்றம் மற்றும் செயற்பாடு – Tamil

values: /static/images/wikimedia-button-1.5x.png 1.5x, /static/images/wikimedia-button-2x.png 2x

values: /static/images/poweredby_mediawiki_132x47.png 1.5x, /static/images/poweredby_mediawiki_176x62.png 2x

values:
suggestions
display: none; font-size: 13px;

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Origin_and_function_of_meiosis rootpage-Origin_and_function_of_meiosis skin-vector action-view


text:
IT risk
From Wikipedia, the free encyclopedia
Jump to: navigation, search
Information technology risk, IT risk, IT-related risk, or Cyber Risk is any risk related to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.
Assessing the probability of likelihood of various types of event/incident with their predicted impacts or consequences should they occur is a common way to assess and measure IT risks.[1] Alternative methods of measuring IT risk typically involve assessing other contributory factors such as the threats, vulnerabilities, exposures, and asset values[2][3].
Contents
[hide]
1 Definitions
1.1 ISO
1.2 Committee on National Security Systems
1.3 NIST
1.4 Risk management insight
1.5 ISACA
2 Measuring IT risk
3 IT risk management
4 IT risk laws and regulations
4.1 United Nations
4.2 OECD
4.3 European Union
4.4 Council of Europe
4.5 USA
5 Standards organizations and standards
5.1 Short description of standards
5.1.1 ISO
5.1.2 BSI
5.1.3 Information Security Forum
6 See also
7 References
8 External links
Definitions[edit]
ISO[edit]
IT risk: the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization. It is measured in terms of a combination of the probability of occurrence of an event and its consequence.[4]
Committee on National Security Systems[edit]
The Committee on National Security Systems of United States of America defined risk in different documents:
From CNSS Instruction No. 4009 dated 26 April 2010[5] the basic and more technical focused definition:
Risk - Possibility that a particular threat will adversely impact an IS by exploiting a particular vulnerability.
National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 1000,[6] introduces a probability aspect, quite similar to NIST SP 800-30 one:
Risk - A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting impact
National Information Assurance Training and Education Center defines risk in the IT field as:[7]
The loss potential that exists as the result of threat-vulnerability pairs. Reducing either the threat or the vulnerability reduces the risk.
The uncertainty of loss expressed in terms of probability of such loss.
The probability that a hostile entity will successfully exploit a particular telecommunications or COMSEC system for intelligence purposes; its factors are threat and vulnerability.
A combination of the likelihood that a threat shall occur, the likelihood that a threat occurrence shall result in an adverse impact, and the severity of the resulting adverse impact.
the probability that a particular threat will exploit a particular vulnerability of the system.
NIST[edit]
Many NIST publications define risk in IT context in different publications: FISMApedia[8] term[9] provide a list. Between them:
According to NIST SP 800-30:[10]
Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization.
From NIST FIPS 200[11]
Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.
NIST SP 800-30[10] defines:
IT-related risk
The net mission impact considering:
the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and
the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to:
Unauthorized (malicious or accidental) disclosure, modification, or destruction of information
Unintentional errors and omissions
IT disruptions due to natural or man-made disasters
Failure to exercise due care and diligence in the implementation and operation of the IT system.
Risk management insight[edit]
IT risk is the probable frequency and probable magnitude of future loss.[12]
ISACA[edit]
ISACA published the Risk IT Framework in order to provides an end-to-end, comprehensive view of all risks related to the use of IT. There,[13] IT risk is defined as:
The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise
According to Risk IT,[13] IT risk has a broader meaning: it encompasses not just only the negative impact of operations and service delivery which can bring destruction or reduction of the value of the organization, but also the benefit\value enabling risk associated to missing opportunities to use technology to enable or enhance business or the IT project management for aspects like overspending or late delivery with adverse business impact
Measuring IT risk[edit]
This section is written like a manual or guidebook. Please help rewrite this section from a descriptive, neutral point of view, and remove advice or instruction. (December 2010) (Learn how and when to remove this template message)
You can't effectively and consistently manage what you can't measure, and you can't measure what you haven't defined.[12][14]
It is useful to introduce related terms, to properly measure IT risk.
Information security event
An identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant.[4]
Occurrence of a particular set of circumstances[15]
The event can be certain or uncertain.
The event can be a single occurrence or a series of occurrences. :(ISO/IEC Guide 73)
Information security incident
is indicated by a single or a series of unwanted information security events that have a significant probability of compromising business operations and threatening information security[4]
An event [G.11] that has been assessed as having an actual or potentially adverse effect on the security or performance of a system.[16]
Impact[17]
The result of an unwanted incident [G.17].(ISO/IEC PDTR 13335-1)
Consequence[18]
Outcome of an event [G.11]
There can be more than one consequence from one event.
Consequences can range from positive to negative.
Consequences can be expressed qualitatively or quantitatively (ISO/IEC Guide 73)
The risk R is the product of the likelihood L of a security incident occurring times the impact I that will be incurred to the organization due to the incident, that is:[19]
R = L × I
The likelihood of a security incident occurrence is a function of the likelihood that a threat appears and the likelihood that the threat can successfully exploit the relevant system vulnerabilities.
The consequence of the occurrence of a security incident are a function of likely impact that the incident will have on the organization as a result of the harm the organization assets will sustain. Harm is related to the value of the assets to the organization; the same asset can have different values to different organizations.
So R can be function of four factors:
A = Value of the assets
T = the likelihood of the threat
V = the nature of vulnerability i.e. the likelihood that can be exploited (proportional to the potential benefit for the attacker and inversely proportional to the cost of exploitation)
I = the likely impact, the extent of the harm
If numerical values (money for impact and probabilities for the other factors), the risk can be expressed in monetary terms and compared to the cost of countermeasures and the residual risk after applying the security control. It is not always practical to express this values, so in the first step of risk evaluation, risk are graded dimensionless in three or five steps scales.
OWASP proposes a practical risk measurement guideline[19] based on:
Estimation of Likelihood as a mean between different factors in a 0 to 9 scale:
Threat agent factors
Skill level: How technically skilled is this group of threat agents? No technical skills (1), some technical skills (3), advanced computer user (4), network and programming skills (6), security penetration skills (9)
Motive: How motivated is this group of threat agents to find and exploit this vulnerability? Low or no reward (1), possible reward (4), high reward (9)
Opportunity: What resources and opportunity are required for this group of threat agents to find and exploit this vulnerability? full access or expensive resources required (0), special access or resources required (4), some access or resources required (7), no access or resources required (9)
Size: How large is this group of threat agents? Developers (2), system administrators (2), intranet users (4), partners (5), authenticated users (6), anonymous Internet users (9)
Vulnerability Factors: the next set of factors are related to the vulnerability involved. The goal here is to estimate the likelihood of the particular vulnerability involved being discovered and exploited. Assume the threat agent selected above.
Ease of discovery: How easy is it for this group of threat agents to discover this vulnerability? Practically impossible (1), difficult (3), easy (7), automated tools available (9)
Ease of exploit: How easy is it for this group of threat agents to actually exploit this vulnerability? Theoretical (1), difficult (3), easy (5), automated tools available (9)
Awareness: How well known is this vulnerability to this group of threat agents? Unknown (1), hidden (4), obvious (6), public knowledge (9)
Intrusion detection: How likely is an exploit to be detected? Active detection in application (1), logged and reviewed (3), logged without review (8), not logged (9)
Estimation of Impact as a mean between different factors in a 0 to 9 scale
Technical Impact Factors; technical impact can be broken down into factors aligned with the traditional security areas of concern: confidentiality, integrity, availability, and accountability. The goal is to estimate the magnitude of the impact on the system if the vulnerability were to be exploited.
Loss of confidentiality: How much data could be disclosed and how sensitive is it? Minimal non-sensitive data disclosed (2), minimal critical data disclosed (6), extensive non-sensitive data disclosed (6), extensive critical data disclosed (7), all data disclosed (9)
Loss of integrity: How much data could be corrupted and how damaged is it? Minimal slightly corrupt data (1), minimal seriously corrupt data (3), extensive slightly corrupt data (5), extensive seriously corrupt data (7), all data totally corrupt (9)
Loss of availability How much service could be lost and how vital is it? Minimal secondary services interrupted (1), minimal primary services interrupted (5), extensive secondary services interrupted (5), extensive primary services interrupted (7), all services completely lost (9)
Loss of accountability: Are the threat agents' actions traceable to an individual? Fully traceable (1), possibly traceable (7), completely anonymous (9)
Business Impact Factors: The business impact stems from the technical impact, but requires a deep understanding of what is important to the company running the application. In general, you should be aiming to support your risks with business impact, particularly if your audience is executive level. The business risk is what justifies investment in fixing security problems.
Financial damage: How much financial damage will result from an exploit? Less than the cost to fix the vulnerability (1), minor effect on annual profit (3), significant effect on annual profit (7), bankruptcy (9)
Reputation damage: Would an exploit result in reputation damage that would harm the business? Minimal damage (1), Loss of major accounts (4), loss of goodwill (5), brand damage (9)
Non-compliance: How much exposure does non-compliance introduce? Minor violation (2), clear violation (5), high-profile violation (7)
Privacy violation: How much personally identifiable information could be disclosed? One individual (3), hundreds of people (5), thousands of people (7), millions of people (9)
If the business impact is calculated accurately use it in the following otherwise use the Technical impact
Rate likelihood and impact in a LOW, MEDIUM, HIGH scale assuming that less than 3 is LOW, 3 to less than 6 is MEDIUM, and 6 to 9 is HIGH.
Calculate the risk using the following table
Overall Risk Severity
Impact
HIGH Medium High Critical
MEDIUM Low Medium High
LOW None Low Medium
LOW MEDIUM HIGH
Likelihood
IT risk management[edit]
Risk Management Elements
Main article: IT risk management
IT risk management can be considered a component of a wider enterprise risk management system.[20]
The establishment, maintenance and continuous update of an Information security management system (ISMS) provide a strong indication that a company is using a systematic approach for the identification, assessment and management of information security risks.[21]
Different methodologies have been proposed to manage IT risks, each of them divided into processes and steps.[22]
The Certified Information Systems Auditor Review Manual 2006 produced by ISACA, an international professional association focused on IT Governance, provides the following definition of risk management: "Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization."[23]

The NIST Cybersecurity Framework encourages organizations to manage IT risk as part the Identify (ID) function: [24]
Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.
ID.RA-1: Asset vulnerabilities are identified and documented
ID.RA-2: Cyber threat intelligence and vulnerability information is received from information sharing forums and source
ID.RA-3: Threats, both internal and external, are identified and documented
ID.RA-4: Potential business impacts and likelihoods are identified
ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk
ID.RA-6: Risk responses are identified and prioritized
Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders
ID.RM-2: Organizational risk tolerance is determined and clearly expressed
ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis
IT risk laws and regulations[edit]
In the following a brief description of applicable rules organized by source.[25]
United Nations[edit]
United Nations issued the following:
UN Guidelines concerning computerized personal data files of 14 December 1990 Generic data processing activities using digital processing methods. Nonbinding guideline to UN nations calling for national regulation in this field
OECD[edit]
OECD issued the following:
Organisation for Economic Co-operation and Development (OECD) Recommendation of the Council concerning guidelines governing the protection of privacy and trans-border flows of personal data (23 September 1980)
OECD Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security (25 July 2002). Topic: General information security. Scope: Non binding guidelines to any OECD entities (governments, businesses, other organisations and individual users who develop, own, provide, manage, service, and use information systems and networks). The OECD Guidelines state the basic principles underpinning risk management and information security practices. While no part of the text is binding as such, non-compliance with any of the principles is indicative of a serious breach of RM/RA good practices that can potentially incur liability.
European Union[edit]
The European Union issued the following, divided by topic:
Privacy
Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data provide an internal regulation which is a practical application of the principles of the Privacy Directive described below. Furthermore, article 35 of the Regulation requires the Community institutions and bodies to take similar precautions with regard to their telecommunications infrastructure, and to properly inform the users of any specific risks of security breaches.
Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data require that any personal data processing activity undergoes a prior risk analysis in order to determine the privacy implications of the activity, and to determine the appropriate legal, technical and organisation measures to protect such activities;is effectively protected by such measures, which must be state of the art keeping into account the sensitivity and privacy implications of the activity (including when a third party is charged with the processing task) is notified to a national data protection authority, including the measures taken to ensure the security of the activity. Furthermore, article 25 and following of the Directive requires Member States to ban the transfer of personal data to non-Member States, unless such countries have provided adequate legal protection for such personal data, or barring certain other exceptions.
Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC; and Commission Decision 2004/915/EC of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries. Topic: Export of personal data to third countries, specifically non-E.U. countries which have not been recognised as having a data protection level that is adequate (i.e. equivalent to that of the E.U.). Both Commission Decisions provide a set of voluntary model clauses which can be used to export personal data from a data controller (who is subject to E.U. data protection rules) to a data processor outside the E.U. who is not subject to these rules or to a similar set of adequate rules.
International Safe Harbor Privacy Principles (see below USA and International Safe Harbor Privacy Principles )
Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector
National Security
Directive 2006/24/EC of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (‘Data Retention Directive’). Topic: Requirement for the providers of public electronic telecommunications service providers to retain certain information for the purposes of the investigation, detection and prosecution of serious crime
Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection. Topic: Identification and protection of European Critical Infrastructures. Scope: Applicable to Member States and to the operators of European Critical Infrastructure (defined by the draft directive as ‘critical infrastructures the disruption or destruction of which would significantly affect two or more Member States, or a single Member State if the critical infrastructure is located in another Member State. This includes effects resulting from cross-sector dependencies on other types of infrastructure’). Requires Member States to identify critical infrastructures on their territories, and to designate them as ECIs. Following this designation, the owners/operators of ECIs are required to create Operator Security Plans (OSPs), which should establish relevant security solutions for their protection
Civil and Penal law
Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems. Topic: General decision aiming to harmonise national provisions in the field of cyber crime, encompassing material criminal law (i.e. definitions of specific crimes), procedural criminal law (including investigative measures and international cooperation) and liability issues. Scope: Requires Member States to implement the provisions of the Framework Decision in their national legal frameworks. Framework decision is relevant to RM/RA because it contains the conditions under which legal liability can be imposed on legal entities for conduct of certain natural persons of authority within the legal entity. Thus, the Framework decision requires that the conduct of such figures within an organisation is adequately monitored, also because the Decision states that a legal entity can be held liable for acts of omission in this regard.
Council of Europe[edit]
Council of Europe Convention on Cybercrime, Budapest, 23.XI.2001, European Treaty Series-No. 185. Topic: General treaty aiming to harmonise national provisions in the field of cyber crime, encompassing material criminal law (i.e. definitions of specific crimes), procedural criminal law (including investigative measures and international cooperation), liability issues and data retention. Apart from the definitions of a series of criminal offences in articles 2 to 10, the Convention is relevant to RM/RA because it states the conditions under which legal liability can be imposed on legal entities for conduct of certain natural persons of authority within the legal entity. Thus, the Convention requires that the conduct of such figures within an organisation is adequately monitored, also because the Convention states that a legal entity can be held liable for acts of omission in this regard.
USA[edit]
United States issued the following, divided by topic:
Civil and Penal law
Amendments to the Federal Rules of Civil Procedure with regard to electronic discovery. Topic: U.S. Federal rules with regard to the production of electronic documents in civil proceedings. The discovery rules allow a party in civil proceedings to demand that the opposing party produce all relevant documentation (to be defined by the requesting party) in its possession, so as to allow the parties and the court to correctly assess the matter. Through the e-discovery amendment, which entered into force on 1 December 2006, such information may now include electronic information. This implies that any party being brought before a U.S. court in civil proceedings can be asked to produce such documents, which includes finalised reports, working documents, internal memos and e-mails with regard to a specific subject, which may or may not be specifically delineated. Any party whose activities imply a risk of being involved in such proceedings must therefore take adequate precautions for the management of such information, including the secure storage. Specifically: The party must be capable of initiating a ‘litigation hold’, a technical/organisational measure which must ensure that no relevant information can be modified any longer in any way. Storage policies must be responsible: while deletion of specific information of course remains allowed when this is a part of general information management policies (‘routine, good-faith operation of the information system’, Rule 37 (f)), the wilful destruction of potentially relevant information can be punished by extremely high fines (in one specific case of 1.6 billion US$). Thus, in practice, any businesses who risk civil litigation before U.S. courts must implement adequate information management policies, and must implement the necessary measures to initiate a litigation hold.
Privacy
Gramm–Leach–Bliley Act (GLBA)
USA PATRIOT Act, Title III
Health Insurance Portability and Accountability Act (HIPAA) From an RM/RA perspective, the Act is particularly known for its provisions with regard to Administrative Simplification (Title II of HIPAA). This title required the U.S. Department of Health and Human Services (HHS) to draft specific rule sets, each of which would provide specific standards which would improve the efficiency of the health care system and prevent abuse. As a result, the HHS has adopted five principal rules: the Privacy Rule, the Transactions and Code Sets Rule, the Unique Identifiers Rule, the Enforcement Rule, and the Security Rule. The latter, published in the Federal Register on 20 February 2003 (see: http://www.cms.hhs.gov/SecurityStandard/Downloads/securityfinalrule.pdf), is specifically relevant, as it specifies a series of administrative, technical, and physical security procedures to assure the confidentiality of electronic protected health information. These aspects have been further outlined in a set of Security Standards on Administrative, Physical, Organisational and Technical Safeguards, all of which have been published, along with a guidance document on the basics of HIPAA risk management and risk assessment <http://www.cms.hhs.gov/EducationMaterials/04_SecurityMaterials.asp>. European or other countries health care service providers will generally not be affected by HIPAA obligations if they are not active on the U.S. market. However, since their data processing activities are subject to similar obligations under general European law (including the Privacy Directive), and since the underlying trends of modernisation and evolution towards electronic health files are the same, the HHS safeguards can be useful as an initial yardstick for measuring RM/RA strategies put in place by European health care service providers, specifically with regard to the processing of electronic health information. HIPAA security standards include the following:
Administrative safeguards:
Security Management Process
Assigned Security Responsibility
Workforce Security
Information Access Management
Security Awareness and Training
Security Incident Procedures
Contingency Plan
Evaluation
Business Associate Contracts and Other Arrangements
Physical safeguards
Facility Access Controls
Workstation Use
Workstation Security
Device and Media Controls
Technical safeguards
Access Control
Audit Controls
Integrity
Person or Entity Authentication
Transmission Security
Organisational requirements
Business Associate Contracts & Other Arrangements
Requirements for Group Health Plans
International Safe Harbor Privacy Principles issued by the US Department of Commerce on July 21, 2000 Export of personal data from a data controller who is subject to E.U. privacy regulations to a U.S. based destination; before personal data may be exported from an entity subject to E.U. privacy regulations to a destination subject to U.S. law, the European entity must ensure that the receiving entity provides adequate safeguards to protect such data against a number of mishaps. One way of complying with this obligation is to require the receiving entity to join the Safe Harbor, by requiring that the entity self-certifies its compliance with the so-called Safe Harbor Principles. If this road is chosen, the data controller exporting the data must verify that the U.S. destination is indeed on the Safe Harbor list (see safe harbor list)
Sarbanes–Oxley Act
FISMA
Standards organizations and standards[edit]
International standard bodies:
International Organization for Standardization - ISO
Payment Card Industry Security Standards Council
Information Security Forum
The Open Group
United States standard bodies:
National Institute of Standards and Technology - NIST
Federal Information Processing Standards - FIPS by NIST devoted to Federal Government and Agencies
UK standard bodies
British Standard Institute
Short description of standards[edit]
The list is chiefly based on:[25]
ISO[edit]
ISO/IEC 13335-1:2004 - Information technology—Security techniques—Management of information and communications technology security—Part 1: Concepts and models for information and communications technology security management http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39066. Standard containing generally accepted descriptions of concepts and models for information and communications technology security management. The standard is a commonly used code of practice, and serves as a resource for the implementation of security management practices and as a yardstick for auditing such practices. (See also http://csrc.nist.gov/publications/secpubs/otherpubs/reviso-faq.pdf)
ISO/IEC TR 15443-1:2005 – Information technology—Security techniques—A framework for IT security assurance reference:http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39733 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Security assurance – the Technical Report (TR) contains generally accepted guidelines which can be used to determine an appropriate assurance method for assessing a security service, product or environmental factor
ISO/IEC 15816:2002 - Information technology—Security techniques—Security information objects for access control reference:http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=29139 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Security management – Access control. The standard allows security professionals to rely on a specific set of syntactic definitions and explanations with regard to SIOs, thus avoiding duplication or divergence in other standardisation efforts.
ISO/IEC TR 15947:2002 - Information technology—Security techniques—IT intrusion detection framework reference:http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=29580 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Security management – Intrusion detection in IT systems. The standard allows security professionals to rely on a specific set of concepts and methodologies for describing and assessing security risks with regard to potential intrusions in IT systems. It does not contain any RM/RA obligations as such, but it is rather a tool for facilitating RM/RA activities in the affected field.
ISO/IEC 15408-1/2/3:2005 - Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model (15408-1) Part 2: Security functional requirements (15408-2) Part 3: Security assurance requirements (15408-3) reference: http://isotc.iso.org/livelink/livelink/fetch/2000/2489/Ittf_Home/PubliclyAvailableStandards.htm Topic: Standard containing a common set of requirements for the security functions of IT products and systems and for assurance measures applied to them during a security evaluation. Scope: Publicly available ISO standard, which can be voluntarily implemented. The text is a resource for the evaluation of the security of IT products and systems, and can thus be used as a tool for RM/RA. The standard is commonly used as a resource for the evaluation of the security of IT products and systems; including (if not specifically) for procurement decisions with regard to such products. The standard can thus be used as an RM/RA tool to determine the security of an IT product or system during its design, manufacturing or marketing, or before procuring it.
ISO/IEC 17799:2005 - Information technology—Security techniques—Code of practice for information security management. reference: http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=39612&ICS1=35&ICS2=40&ICS3= (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Standard containing generally accepted guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization, including business continuity management. The standard is a commonly used code of practice, and serves as a resource for the implementation of information security management practices and as a yardstick for auditing such practices. (See also ISO/IEC 17799)
ISO/IEC TR 15446:2004 – Information technology—Security techniques—Guide for the production of Protection Profiles and Security Targets. reference: http://isotc.iso.org/livelink/livelink/fetch/2000/2489/Ittf_Home/PubliclyAvailableStandards.htm Topic: Technical Report (TR) containing guidelines for the construction of Protection Profiles (PPs) and Security Targets (STs) that are intended to be compliant with ISO/IEC 15408 (the "Common Criteria"). The standard is predominantly used as a tool for security professionals to develop PPs and STs, but can also be used to assess the validity of the same (by using the TR as a yardstick to determine if its standards have been obeyed). Thus, it is a (nonbinding) normative tool for the creation and assessment of RM/RA practices.
ISO/IEC 18028:2006 - Information technology—Security techniques—IT network security reference: http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=40008 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Five part standard (ISO/IEC 18028-1 to 18028-5) containing generally accepted guidelines on the security aspects of the management, operation and use of information technology networks. The standard is considered an extension of the guidelines provided in ISO/IEC 13335 and ISO/IEC 17799 focusing specifically on network security risks. The standard is a commonly used code of practice, and serves as a resource for the implementation of security management practices and as a yardstick for auditing such practices.
ISO/IEC 27001:2005 - Information technology—Security techniques—Information security management systems—Requirements reference: http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=42103 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Standard containing generally accepted guidelines for the implementation of an Information Security Management System within any given organisation. Scope: Not publicly available ISO standard, which can be voluntarily implemented. While not legally binding, the text contains direct guidelines for the creation of sound information security practices The standard is a very commonly used code of practice, and serves as a resource for the implementation of information security management systems and as a yardstick for auditing such systems and/or the surrounding practices. Its application in practice is often combined with related standards, such as BS 7799-3:2006 which provides additional guidance to support the requirements given in ISO/IEC 27001:2005 <http://www.bsiglobal.com/en/Shop/Publication-Detail/?pid=000000000030125022&recid=2491>
ISO/IEC 27001:2013, the updated standard for information security management systems.
ISO/IEC TR 18044:2004 – Information technology—Security techniques—Information security incident management reference: http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=35396 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Technical Report (TR) containing generally accepted guidelines and general principles for information security incident management in an organization.Scope: Not publicly available ISO TR, which can be voluntarily used.While not legally binding, the text contains direct guidelines for incident management. The standard is a high level resource introducing basic concepts and considerations in the field of incident response. As such, it is mostly useful as a catalyst to awareness raising initiatives in this regard.
ISO/IEC 18045:2005 - Information technology—Security techniques—Methodology for IT security evaluation reference: http://isotc.iso.org/livelink/livelink/fetch/2000/2489/Ittf_Home/PubliclyAvailableStandards.htm Topic: Standard containing auditing guidelines for assessment of compliance with ISO/IEC 15408 (Information technology—Security techniques—Evaluation criteria for IT security) Scope Publicly available ISO standard, to be followed when evaluating compliance with ISO/IEC 15408 (Information technology—Security techniques—Evaluation criteria for IT security). The standard is a ‘companion document’, which is thus primarily of used for security professionals involved in evaluating compliance with ISO/IEC 15408 (Information technology—Security techniques—Evaluation criteria for IT security). Since it describes minimum actions to be performed by such auditors, compliance with ISO/IEC 15408 is impossible if ISO/IEC 18045 has been disregarded.
ISO/TR 13569:2005 - Financial services—Information security guidelines reference: http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=37245 (Note: this is a reference to the ISO page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Standard containing guidelines for the implementation and assessment of information security policies in financial services institutions. The standard is a commonly referenced guideline, and serves as a resource for the implementation of information security management programmes in institutions of the financial sector, and as a yardstick for auditing such programmes. (See also http://csrc.nist.gov/publications/secpubs/otherpubs/reviso-faq.pdf)
ISO/IEC 21827:2008 - Information technology—Security techniques—Systems Security Engineering—Capability Maturity Model (SSE-CMM): ISO/IEC 21827:2008 specifies the Systems Security Engineering - Capability Maturity Model (SSE-CMM), which describes the essential characteristics of an organization's security engineering process that must exist to ensure good security engineering. ISO/IEC 21827:2008 does not prescribe a particular process or sequence, but captures practices generally observed in industry. The model is a standard metric for security engineering practices.
BSI[edit]
BS 25999-1:2006 - Business continuity management Part 1: Code of practice Note: this is only part one of BS 25999, which was published in November 2006. Part two (which should contain more specific criteria with a view of possible accreditation) is yet to appear. reference: http://www.bsi-global.com/en/Shop/Publication-Detail/?pid=000000000030157563. Topic: Standard containing a business continuity code of practice. The standard is intended as a code of practice for business continuity management, and will be extended by a second part that should permit accreditation for adherence with the standard. Given its relative newness, the potential impact of the standard is difficult to assess, although it could be very influential to RM/RA practices, given the general lack of universally applicable standards in this regard and the increasing attention to business continuity and contingency planning in regulatory initiatives. Application of this standard can be complemented by other norms, in particular PAS 77:2006 - IT Service Continuity Management Code of Practice <http://www.bsi-global.com/en/Shop/Publication-Detail/?pid=000000000030141858>.The TR allows security professionals to determine a suitable methodology for assessing a security service, product or environmental factor (a deliverable). Following this TR, it can be determined which level of security assurance a deliverable is intended to meet, and if this threshold is actually met by the deliverable.
BS 7799-3:2006 - Information security management systems—Guidelines for information security risk management reference: http://www.bsi-global.com/en/Shop/Publication-Detail/?pid=000000000030125022&recid=2491 (Note: this is a reference to the BSI page where the standard can be acquired. However, the standard is not free of charge, and its provisions are not publicly available. For this reason, specific provisions cannot be quoted). Topic: Standard containing general guidelines for information security risk management.Scope: Not publicly available BSI standard, which can be voluntarily implemented. While not legally binding, the text contains direct guidelines for the creation of sound information security practices. The standard is mostly intended as a guiding complementary document to the application of the aforementioned ISO 27001:2005, and is therefore typically applied in conjunction with this standard in risk assessment practices
Information Security Forum[edit]
Standard of Good Practice
See also[edit]
Computer portal
Computer Security portal
Business_and_economics portal
Asset (computer security)
Availability
BS 7799
BS 25999
Committee on National Security Systems
Common Criteria
Confidentiality
Cyber-security regulation
Data Protection Directive
Electrical disruptions caused by squirrels
Exploit (computer security)
Factor analysis of information risk
Federal Information Security Management Act of 2002
Gramm–Leach–Bliley Act
Health Insurance Portability and Accountability Act
Information security
Information Security Forum
Information technology
Integrity
International Safe Harbor Privacy Principles
ISACA
ISO
ISO/IEC 27000-series
ISO/IEC 27001:2013
ISO/IEC 27002
IT risk management
Long-term support
National Information Assurance Training and Education Center
National Institute of Standards and Technology
National security
OWASP
Patriot Act, Title III
Privacy
Risk
Risk factor (computing)
Risk IT
Sarbanes–Oxley Act
Standard of Good Practice
Threat (computer)
Vulnerability
References[edit]
Jump up ^ "Risk is a combination of the likelihood of an occurrence of a hazardous event or exposure(s) and the severity of injury or ill health that can be caused by the event or exposure(s)" (OHSAS 18001:2007)
Jump up ^ "3 Types Of Cybersecurity Assessments - Threat Sketch". Threat Sketch. 2016-05-16. Retrieved 2017-10-07.
Jump up ^ "Information Security Assessment Types". danielmiessler.com. Retrieved 2017-10-07.
^ Jump up to: a b c ISO/IEC, "Information technology -- Security techniques-Information security risk management" ISO/IEC FIDIS 27005:2008
Jump up ^ CNSS Instruction No. 4009 dated 26 April 2010
Jump up ^ National Information Assurance Certification and Accreditation Process (NIACAP) by National Security Telecommunications and Information Systems Security Committee
Jump up ^ "Glossary of Terms". Retrieved 23 May 2016.
Jump up ^ a wiki project devoted to FISMA
Jump up ^ FISMApedia Risk term
^ Jump up to: a b NIST SP 800-30 Risk Management Guide for Information Technology Systems
Jump up ^ FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems
^ Jump up to: a b FAIR: Factor Analysis for Information Risks Archived 2014-11-18 at the Wayback Machine.
^ Jump up to: a b ISACA THE RISK IT FRAMEWORK ISBN 978-1-60420-111-6 (registration required)
Jump up ^ Technical Standard Risk Taxonomy ISBN 1-931624-77-1 Document Number: C081 Published by The Open Group, January 2009.
Jump up ^ "Glossary". Retrieved 23 May 2016.
Jump up ^ "Glossary". Retrieved 23 May 2016.
Jump up ^ "Glossary". Retrieved 23 May 2016.
Jump up ^ "Glossary". Retrieved 23 May 2016.
^ Jump up to: a b "OWASP Risk Rating Methodology". Retrieved 23 May 2016.
Jump up ^ ISACA THE RISK IT FRAMEWORK (registration required)
Jump up ^ Enisa Risk management, Risk assessment inventory, page 46
Jump up ^ Katsicas, Sokratis K. (2009). "35". In Vacca, John. Computer and Information Security Handbook. Morgan Kaufmann Publications. Elsevier Inc. p. 605. ISBN 978-0-12-374354-1.
Jump up ^ ISACA (2006). CISA Review Manual 2006. Information Systems Audit and Control Association. p. 85. ISBN 1-933284-15-3. External link in |publisher= (help)
Jump up ^ Keller, Nicole (2013-11-12). "Cybersecurity Framework". NIST. Retrieved 2017-10-07.
^ Jump up to: a b Risk Management / Risk Assessment in European regulation, international guidelines and codes of practice Conducted by the Technical Department of ENISA Section Risk Management in cooperation with: Prof. J. Dumortier and Hans Graux www.lawfort.be June 2007
External links[edit]
Internet2 Information Security Guide: Effective Practices and Solutions for Higher Education
Risk Management - Principles and Inventories for Risk Management / Risk Assessment methods and tools, Publication date: Jun 01, 2006 Authors:Conducted by the Technical Department of ENISA Section Risk Management
Clusif Club de la Sécurité de l'Information Français
800-30 NIST Risk Management Guide
800-39 NIST DRAFT Managing Risk from Information Systems: An Organizational Perspective
FIPS Publication 199, Standards for Security Categorization of Federal Information and Information
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems
800-37 NIST Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach
FISMApedia is a collection of documents and discussions focused on USA Federal IT security
Retrieved from "https://en.wikipedia.org/w/index.php?title=IT_risk&oldid=804201685"
Categories:
Computer security
Data security
IT risk management
Information technology management
Risk analysis
Security
Security compliance
Hidden categories:
Webarchive template wayback links
CS1 errors: external links
Wikipedia articles needing style editing from December 2010
All articles needing style editing
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
አማርኛ
Magyar
Русский
Українська
Edit links
This page was last edited on 7 October 2017, at 12:57.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view

values: mw-page-base noprint

values: mw-head-base noprint

attrs: id class style

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

value: b

value: p

value: sup

values:
/wiki/Asset_(computing)
mw-redirect
Asset (computing)

values: Edit section: Committee on National Security Systems

attrs: alt src width height srcset data-file-width data-file-height

values:
plainlinks metadata ambox ambox-style
presentation

values:
/wiki/Threat_agent
mw-redirect
Threat agent

values:
wikitable
margin:auto; text-align: center;

attrs: alt src width height class srcset data-file-width data-file-height

values: Edit section: IT risk laws and regulations

values:
/wiki/National_Security
mw-redirect
National Security

values:
nofollow
https://www.law.cornell.edu/rules/frcp/
external text

values:
/wiki/USA_PATRIOT_Act,_Title_III
mw-redirect
USA PATRIOT Act, Title III

values: Edit section: Standards organizations and standards

values:
/wiki/British_Standard_Institute
mw-redirect
British Standard Institute

values: Edit section: Short description of standards

values:
/wiki/ISO/IEC_15408
mw-redirect
ISO/IEC 15408

values:
/wiki/ISO/IEC_17799
mw-redirect
ISO/IEC 17799

values:
/wiki/ISO/IEC_27001
mw-redirect
ISO/IEC 27001

values: Edit section: Information Security Forum

values:
/wiki/Standard_of_Good_Practice
mw-redirect
Standard of Good Practice

values: display:table-cell;padding:0.2em 0.2em 0.2em 0.3em;vertical-align:middle

values:
/wiki/Portal:Computer_Security
mw-redirect
Portal:Computer Security

values: margin:0.5em 0 0.5em 1em;border:solid #aaa 1px

values: div-col columns column-count column-count-2

values: -moz-column-count: 2; -webkit-column-count: 2; column-count: 2;

values:
nofollow
external text
http://niatec.info/GetFile.aspx?pid=567

values:
nofollow
external text
http://fismapedia.org/index.php

values:
nofollow
http://www.isaca.org/
external text

values:
nofollow
external text
https://www.nist.gov/cyberframework

values: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

values:
nofollow
https://www.clusif.asso.fr/
external text

values: Category:Webarchive template wayback links

values: Category:Wikipedia articles needing style editing from December 2010

values: Category:All articles needing style editing

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

values:
/wiki/IT_risk
View the content page [ctrl-alt-c]
c

values:
/w/index.php?title=IT_risk&action=edit
Edit this page [ctrl-alt-e]
e

values: Featured content – the best of Wikipedia

values: Find background information on current events

values: portal navigation p-navigation p-navigation-label

values: Guidance on how to use and edit Wikipedia

values: About the project, what you can do, where to find things

values: A list of recent changes in the wiki [ctrl-alt-r]

values: portal navigation p-interaction p-interaction-label

values: List of all English Wikipedia pages containing links to this page [ctrl-alt-j]

values: Recent changes in pages linked from this page [ctrl-alt-k]

values:
/wiki/Wikipedia:File_Upload_Wizard
Upload files [ctrl-alt-u]
u

values: A list of all special pages [ctrl-alt-q]

values: Permanent link to this revision of the page

values: Link to connected data repository item [ctrl-alt-g]

values: Printable version of this page [ctrl-alt-p]

values: መረጃ ቴክኖሎጂ ደህንነት ስጋት – Amharic

values: Kockázat (informatikai biztonság) – Hungarian

values: Ризик (інформаційна безпека) – Ukrainian

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-IT_risk rootpage-IT_risk vector-nav-directionality skin-vector action-view