IT Risk Assessment

1.   About IT Risk Assessment:

Risk in the context of security is the likelihood of threat source exploiting a vulnerability and corresponding business impact. IT Risk Assessment is the process of identifying and assessing risk, reducing it to an acceptable level, and ensuring it remains at that level.

The ultimate purpose of IT Risk Assessment is to mitigate risk to prevent security incidents and compliance failures. IT Risk Assessment is one of the best tool/method which helps to provide Holistic Security Solution to the organization.

2.   Benefits of IT Risk Assessment:

Regular IT Risk Assessment and analysis offer below mentioned benefits;

1.   Understanding  Risk Profile

IT Risk Assessment help  to understand the Risk from different level such as;

a. Physical Damage (Fire, Water, Vandalism, Power Loss, and Natural Disaster);

b. Human Interaction (Accidental or intentional action or inaction that can disrupt productivity);

c. Equipment Malfunction (Failure of System and Peripheral Devices);

d. Inside and Outside Attack (Hacking, Cracking and Attacking)Misuse of Data (Sharing Trade Secrets, Fraud, Espionage, and Theft) 

        e. Loss of Data (Intentional or unintentional loss of information to                                unauthorized parties)

        f. Application Error (Computation Error, input error, and software defects 

2.   Identifying and Remediating Vulnerabilities

IT Risk Assessment help  to identify existing vulnerability in the system which includes in (People / Process and Technology) and help  to remediate as soon as possible.

3.   Inventorying IT and Data Assets

IT Risk Assessment help  to Inventorying IT and Data Assets. With the help of this information organization can able to categorize IT Data and Assets as per their value and importance.

4.   Mitigating Costs

Regular IT Risk Assessment can help to eliminate unnecessary security spending. Eliminating risk accurately enable  to balance cost against benefits.

5.   Complying with Legal Requirements

IT Risk Assessment help  to comply with legal requirements.

 

3.   Resources Needed to Conduct IT Risk Assessment:

At least two members are needed to conduct the IT Risk Assessment. Among them one member should be Information Security Officer. Maximum 30 days (depends on the size) are needed to conduct the IT Risk Assessment up to Access Risk Phase. Responding to Risk and Monitor the Risk are lifetime process.  

During the assessment if organization's existing infrastructure / human resources is not sufficient to find out the vulnerability of the system at that time Assessment team needs third person / vendor as a penetration tester.

During the IT Risk Assessment process Risk Assessment team may need to take interview of multiple concern officers to get the required information.

 

4.   Process To Conduct IT Risk Assessment:

Top management’s approval is mandatory to conduct the IT Risk Assessment effectively. Once the approval is granted. IT Risk Assessment team will do the following things;

·      Frame Risk

Here, Risk Assessment Team frame the Risk. What type of IT and IT Assets are going to cover? What is the acceptable level of Risk? What Process will be followed? What are the responsibilities of team members? are discussed in this phase.

·      Access Risk

Here, Risk Assessment Team access the risk. Based on experience, tools, analysis Risk team access the risk.

·      Respond to Risk

Here, Risk Assessment Team respond to the risk which have found in earlier phase. Responding to the Risk is lifetime process so it’s keep on going. Multiple parties involvement are needed to Respond the Risk.

·      Monitor the Risk

Here, Risk Assessment Team monitor the effectiveness of the risk assessment and access the risk if any changes/update/upgrade are found.

5.   Suitable Framework for us to Conduct IT Risk Assessment:

There are so many framework to conduct IT Risk assessment such as;

·      NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments

·      Facilitated Risk Analysis Process (FRAP) Quantitative Method

·      The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

·      Failure Modes and Effect Analysis (FMEA)

6.   About NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments:

NIST-SP 800-30, Revision 1, Guide for Conducting Risk Assessment, is specific to information systems threats and how they relate to information security risk. It lays out the following steps.

1.    Prepare for the assessment;

2.    Conduct the assessment;

a.    Identify threat sources and events;

b.    Identify vulnerability and predisposing conditions;

c.     Determine likelihood of occurrence;

d.    Determine magnitude of impact;

e.    Determine Risk;

3.    Communicate Result;

4.    Maintain Assessment.

The NIST risk management methodology is mainly focused on computer systems and IT Security issues.

7.   Conclusion:

IT Risk Assessment help us to inventorying IT and Data Assets; Categorizing it based on its value and criticality; Find out vulnerability on the IT and Data Assets; Understand the existing security mechanism to protect the system from Vulnerability; Remediation to the Vulnerability; and Suggest best Security mechanism.