Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10/4/2018
04:30 PM
50%
50%

7 Steps to Start Your Risk Assessment

Risk assessment can be complex, but it's vital for making good decisions about IT security. Here are steps to start you down the path toward a meaningful risk assessment process.
Previous
1 of 8
Next

"Managing risk is one of the most, if not the most important, functions in an organization," says Tony Martin-Vegue, enterprise security management strategist for LendingClub, a peer-to-peer lending company based in San Francisco. "It's really important to have a structured, formalized process for measuring risk, managing risk, and the entire remediation process."

If a formal process is the best way to assess and manage risk, then what sort of process should an organization use? "The most commonly used risk model is the mental model of the person waving their wet finger in the air," says Jack Jones, executive vice president of research and development at RiskLens and chairman of the FAIR Institute. "And mental models are notoriously flawed," he says. The reliance on flawed mental models is one of the many reasons Jones says that the IT industry is horrible at properly assessing risk.

How does an organization go about finding a better model and using it to figure out what their risk is? There are a number of options, from NIST SP 800-30 to aspreadsheet-based model that can be found from a wide variety of sources with a quick Google search to FAIR — Factor Analysis of Information Risk.

Large organizations will have teams dedicated to assessing and re-assessing risk on a regular basis. Small organizations may lack the team, but they will not lack the need to understand what risks IT faces and how those risks are reflected in the rest of the business units.

"I don't feel any organization can even begin to think about what it wants to do from an information security perspective without making some proper attempt at being able to understand the risks that matter most to their organization," says Zulfikar Ramzan, CTO of RSA. "I don't want this to be confused with 'expensive' or 'complex' or, you know, beyond the scope of what I think even a small- to medium-sized organization can do," he explains. "What I really mean here is try to be a bit principled trying to look at it and get a more quantitative assessment."

Getting started on this quantitative path can be confusing, so Dark Reading researched the major frameworks and spoke with Jones, Martin-Vegue, and Ramzan to get their ideas on best initial steps. We found seven steps that apply to a variety of frameworks — and that are applicable no matter where the process takes your organization.

(Image: Alexas_Fotos)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gwskelton
100%
0%
gwskelton,
User Rank: Apprentice
1/3/2019 | 11:37:49 AM
Value of Article and Risk Assessment
Your article was a concise overview of the process of risk assessment.  Many organizations have a difficult time in starting a risk assessment program, following through on all of the necessary steps - identification of assest, threats, controls, and determining what particular controls are worth the expense.  Furthermore, risk assessment is a life-long process that must continue in an ongoing basis, not just once a year or whenever compliance is required.

Thanks again for your overview.

Gordon Skelton, CISSP, CEH, Security+
Security and Analytics, LLC
luzpruitt
50%
50%
luzpruitt,
User Rank: Apprentice
10/28/2018 | 9:34:11 PM
thanks
thanks for sharing
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3506
PUBLISHED: 2021-04-19
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The hi...
CVE-2021-20208
PUBLISHED: 2021-04-19
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
CVE-2021-27458
PUBLISHED: 2021-04-19
If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: Al...
CVE-2020-27241
PUBLISHED: 2021-04-19
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger...
CVE-2021-3497
PUBLISHED: 2021-04-19
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.