IT System Risk Testing and Protection Solutions

Cybersecurity risk assessment is the process of identifying and evaluating risks for assets that could be affected by cyberattacks. Basically, you identify both internal and external threats; evaluate their potential impact on things like data availability, confidentiality and integrity; and estimate the costs of suffering a cybersecurity incident. With this information, you can tailor your cybersecurity and data protection controls to match your organization’s actual level of risk tolerance.

To get started with IT security risk assessment, you need to answer three important questions:

• What are your organization’s critical information technology assets — that is, the data whose loss or exposure would have a major impact on your business operations?
• What are the key business processes that utilize or require this information?
• What threats could affect the ability of those business functions to operate?

Once you know what you need to protect, you can begin developing strategies. However, before you spend a dollar of your budget or an hour of your time implementing a solution to reduce risk, be sure to consider which risk you are addressing, how high its priority is, and whether you are approaching it in the most cost-effective way.

Conducting a thorough IT security assessment on a regular basis helps organizations develop a solid foundation for ensuring business success.

In particular, it enables them to:

• Identify and remediate IT security gaps
• Prevent data breaches
• Choose appropriate protocols and controls to mitigate risks
• Prioritize the protection of the asset with the highest value and highest risk
• Eliminate unnecessary or obsolete control measures
• Evaluate potential security partners
• Establish, maintain and prove compliance with regulations
• Accurately forecast future needs

The Institute of Risk Management defines a cyber risk as “any risk of financial loss, disruption or damage to the reputation of an organization from some sort of failure of its information technology systems”. Gartner gives a more general definition: “the potential for an unplanned, negative business outcome involving the failure or misuse of IT.”

Examples of cyber risk include:

• Theft of sensitive or regulated information
• Hardware damage and subsequent data loss
• Malware and viruses
• Compromised credentials
• Company website failure
• Natural disasters that could damage servers

When taking stock of cyber risks, it’s important to detail the specific financial damage they could do to the organization, such as legal fees, operational downtime and related profit loss, and lost business due to customer distrust.

Step #1: Identify and Prioritize Assets

Assets include servers, client contact information, sensitive partner documents, trade secrets and so on. Remember, what you as a technician think is valuable might not be what is actually most valuable for the business. Therefore, you need to work with business users and management to create a list of all valuable assets. For each asset, gather the following information.

Step #2: Identify Threats

A threat is anything that could cause harm to your organization. While hackers and malware probably leap to mind.

Step #3: Identify Vulnerabilities

A vulnerability is a weakness that could enable a threat to harm your organization. Vulnerabilities can be identified through analysis, audit reports, the NIST vulnerability database, vendor data, information security test and evaluation (ST&E) procedures, penetration testing, and automated vulnerability scanning tools.

Don’t limit your thinking to software vulnerabilities; there are also physical and human vulnerabilities. For example, having your server room in the basement increases your vulnerability to the threat of flooding, and failure to educate your employees about the danger of clicking on email links increases your vulnerability to the threat of malware.

Step #4: Analyze Controls

Analyze the controls that are either in place or in the planning stage to minimize or eliminate the probability that a threat will exploit a vulnerability. Technical controls include encryption, intrusion detection mechanisms, and identification and authentication solutions. Nontechnical controls include security policies, administrative actions, and physical and environmental mechanisms.

Both technical and nontechnical controls can further be classified as preventive or detective. As the name implies, preventive controls attempt to anticipate and stop attacks; examples include encryption and authentication devices. Detective controls are used to discover threats that have occurred or are in process; they include audit trails and intrusion detection systems.

Step #5: Determine the Likelihood of an Incident

Assess the probability that a vulnerability might actually be exploited, taking into account the type of vulnerability, the capability and motivation of the threat source, and the existence and effectiveness of your controls. Rather than a numerical score, many organizations use the categories high, medium and low to assess the likelihood of an attack or other adverse event.

Step #6: Assess the Impact a Threat Could Have

Analyze the impact that an incident would have on the asset that is lost or damaged.

Step #7: Prioritize the Information Security Risks

For each threat/vulnerability pair, determine the level of risk to the IT system.

Step #8: Recommend Controls

Using the risk level as a basis, determine the actions needed to mitigate the risk.

Step #9: Document the Results

The final step in the risk assessment process is to develop a risk assessment report to support management in making appropriate decisions on budget, policies, procedures and so on. For each threat, the report should describe the corresponding vulnerabilities, the assets at risk, the impact to your IT infrastructure, the likelihood of occurrence and the control recommendations.