Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10/4/2018
04:30 PM
50%
50%

7 Steps to Start Your Risk Assessment

Risk assessment can be complex, but it's vital for making good decisions about IT security. Here are steps to start you down the path toward a meaningful risk assessment process.
Previous
1 of 8
Next

"Managing risk is one of the most, if not the most important, functions in an organization," says Tony Martin-Vegue, enterprise security management strategist for LendingClub, a peer-to-peer lending company based in San Francisco. "It's really important to have a structured, formalized process for measuring risk, managing risk, and the entire remediation process."

If a formal process is the best way to assess and manage risk, then what sort of process should an organization use? "The most commonly used risk model is the mental model of the person waving their wet finger in the air," says Jack Jones, executive vice president of research and development at RiskLens and chairman of the FAIR Institute. "And mental models are notoriously flawed," he says. The reliance on flawed mental models is one of the many reasons Jones says that the IT industry is horrible at properly assessing risk.

How does an organization go about finding a better model and using it to figure out what their risk is? There are a number of options, from NIST SP 800-30 to aspreadsheet-based model that can be found from a wide variety of sources with a quick Google search to FAIR — Factor Analysis of Information Risk.

Large organizations will have teams dedicated to assessing and re-assessing risk on a regular basis. Small organizations may lack the team, but they will not lack the need to understand what risks IT faces and how those risks are reflected in the rest of the business units.

"I don't feel any organization can even begin to think about what it wants to do from an information security perspective without making some proper attempt at being able to understand the risks that matter most to their organization," says Zulfikar Ramzan, CTO of RSA. "I don't want this to be confused with 'expensive' or 'complex' or, you know, beyond the scope of what I think even a small- to medium-sized organization can do," he explains. "What I really mean here is try to be a bit principled trying to look at it and get a more quantitative assessment."

Getting started on this quantitative path can be confusing, so Dark Reading researched the major frameworks and spoke with Jones, Martin-Vegue, and Ramzan to get their ideas on best initial steps. We found seven steps that apply to a variety of frameworks — and that are applicable no matter where the process takes your organization.

(Image: Alexas_Fotos)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gwskelton
100%
0%
gwskelton,
User Rank: Apprentice
1/3/2019 | 11:37:49 AM
Value of Article and Risk Assessment
Your article was a concise overview of the process of risk assessment.  Many organizations have a difficult time in starting a risk assessment program, following through on all of the necessary steps - identification of assest, threats, controls, and determining what particular controls are worth the expense.  Furthermore, risk assessment is a life-long process that must continue in an ongoing basis, not just once a year or whenever compliance is required.

Thanks again for your overview.

Gordon Skelton, CISSP, CEH, Security+
Security and Analytics, LLC
luzpruitt
50%
50%
luzpruitt,
User Rank: Apprentice
10/28/2018 | 9:34:11 PM
thanks
thanks for sharing
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5124
PUBLISHED: 2020-01-25
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.50005. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered fro...
CVE-2019-5146
PUBLISHED: 2020-01-25
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13025.10004. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered fro...
CVE-2019-5147
PUBLISHED: 2020-01-25
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13003.1007. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from...
CVE-2019-5183
PUBLISHED: 2020-01-25
An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002. A specially crafted pixel shader can cause a type confusion issue, leading to potential code execution. An attacker can provide a specially crafted shad...
CVE-2020-5226
PUBLISHED: 2020-01-24
Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapp...