Research On Enterprise Information Security Risk Management Under The Framework Of COSO

The Internet has penetrated into every aspect of people’s life and enterprise operation,which makes information security risk management more and more important in enterprise risk management and attracts more and more attention from people.Phishing email attack,as the most direct and effective way,has become one of the most important forms of network attacks.It poses a very serious threat to the network security of the current enterprise.Once it is breached,it will cause sensitive data leakage,operation system loss and other hazards.This paper takes the stolen email of Sohu Company in May 2022 as an example by using the five elements theory of COSO framework.This paper firstly uses case analysis to analyze the problems existing in the information security risk management of Sohu company in this incident: the email management system is not effectively implemented,the staff’s email security awareness is weak,the email security protection mechanism is inadequate,the email system operation process monitoring is insufficient and the lack of normal phishing email drill mechanism.Then comparative analysis method and factor analysis method are used to analyze the reasons for the failure of Sohu’s information security risk management based on the five elements theory of COSO framework.It is found that the main reasons are: In the control environment,there is no attention to the mailbox security risk of the corporate culture atmosphere,and information security human resources management is lacking and information security organizational structure design is unreasonable;In terms of risk assessment,the enterprise did not reasonably determine the risks involved in the mailbox,and did not adopt appropriate risk coping strategies in the event of mailbox theft;In terms of control activities,Sohu’s mailbox security risk governance model is not strictly implemented,mailbox management approval and authorization control is insufficient,and the mailbox security system also has certain defects;In terms of information and communication,the content of the information that can be transmitted by the mailbox is not clear,and the communication and report of the information are not timely,active and mere formality.In terms of supervision,Sohu company mailbox security internal control supervision system is not perfect,mailbox system operation in the process of monitoring there are also deficiencies.Finally,based on the five elements theory of COSO framework,this paper proposes corresponding optimization strategies according to the causes of the problems.Through the analysis of this paper,it can provide improvement ideas for Sohu’s information security risk management,make the operation and management of Sohu’s internal email system more secure,make up for the risks and security loopholes of Sohu’s internal email system,guide the development of relevant enterprises’ network and information security to be more standardized and standard,and improve the enterprise’s email security management system.Enhance the enterprise information security management level.At the same time,the application of COSO framework in enterprise information security risk management provides constructive reference,provides a new perspective to deal with enterprise information security risk,and enrichis the theoretical system of enterprise information security risk management.