Advanced ICT
Consultants & Auditors LLP.
Risk Assessment PRACTICE CONSULTANTS EXPERTS PROFESSIONALS

Enterprise IT security risk assessments are performed to allow organizations to assess, identify and modify their overall security posture and to enable security, operations, organizational management and other personnel to collaborate and view the entire organization from an attacker’s perspective. This process is required to obtain organizational management’s commitment to allocate resources and implement the appropriate security solutions.

A comprehensive enterprise security risk assessment also helps determine the value of the various types of data generated and stored across the organization. Without valuing the various types of data in the organization, it is nearly impossible to prioritize and allocate technology resources where they are needed the most. To accurately assess risk, management must identify the data that are most valuable to the organization, the storage mechanisms of said data and their associated vulnerabilities.

As systems have become more complex, integrated and connected to third parties, the security and controls budget quickly reaches its limitations. Therefore, to ensure best use of the available resources, IT should understand the relative significance of different sets of systems, applications, data, storage and communication mechanisms. To meet such requirements, organizations should perform security risk assessments that employ the enterprise risk assessment approach and include all stakeholders to ensure that all aspects of the IT organization are addressed, including hardware and software, employee awareness training, and business processes.

IT Risk Assessments Tasks

The following are common tasks that are often performed in an enterprise security risk assessment:

  • Identify business needs and changes to requirements that may affect overall IT and security direction.
  • Review adequacy of existing security policies, standards, guidelines and procedures.
  • Analyze assets, threats and vulnerabilities, including their impacts and likelihood.
  • Assess physical protection applied to computing equipment and other network components.
  • Conduct technical and procedural review and analysis of the network architecture, protocols and components to ensure that they are implemented according to the security policies.
  • Review and check the configuration, implementation and usage of remote access systems, servers, firewalls and external network connections, including the client Internet connection.
  • Review logical access and other authentication mechanisms.
  • Review current level of security awareness and commitment of staff within the organization.
  • Review agreements involving services or products from vendors and contractors.
  • Develop practical technical recommendations to address the vulnerabilities identified, and reduce the level of security risk.
 

Organizational Value

Institutionalizing a practical risk assessment program is important to supporting an organization’s business activities and provides several benefits:

  • Risk assessment programs help ensure that the greatest risks to the organization are identified and addressed on a continuing basis. Such programs help ensure that the expertise and best judgments of personnel, both in IT and the larger organization, are tapped to develop reasonable steps for preventing or mitigating situations that could interfere with accomplishing the organization’s mission.
  • Risk assessments help personnel throughout the organization better understand risks to business operations. They also teach them how to avoid risky practices, such as disclosing passwords or other sensitive information, and recognize suspicious events. This understanding grows, in part, from improved communication among business managers, system support staff and security specialists.
  • Risk assessments provide a mechanism for reaching a consensus as to which risks are the greatest and what steps are appropriate for mitigating them. The processes used encourage discussion and generally require that disagreements be resolved. This, in turn, makes it more likely that business managers will understand the need for agreed-upon controls, feel that the controls are aligned with the organization’s business goals and support their effective implementation. Executives have found that controls selected in this manner are more likely to be effectively adopted than controls that are imposed by personnel outside of the organization.
  • A formal risk assessment program provides an efficient means for communicating assessment findings and recommending actions to business unit managers as well as to senior corporate officials. Standard report formats and the periodic nature of the assessments provide organizations a means of readily understanding reported information and comparing results between units over time.

Process

The objective of a risk assessment is to understand the existing system and environment, and identify risks through analysis of the information/data collected. Several types of information that are often collected include:

  • Security requirements and objectives
  • System or network architecture and infrastructure, such as a network diagram showing how assets are configured and interconnected
  • Information available to the public or accessible from the organization’s web site
  • Physical assets, such as hardware, including those in the data center, network, and communication components and peripherals (e.g., desktop, laptop, PDAs)
  • Operating systems, such as PC and server operating systems, and network management systems
  • Data repositories, such as database management systems and files
  • A listing of all applications and Platforms
  • Network details, such as supported protocols and network services offered
  • Security systems in use, such as access control mechanisms, change control, antivirus, spam control and network monitoring
  • Security components deployed, such as firewalls and intrusion detection systems
  • Processes, such as a business process, computer operation process, network operation process and application operation process
  • Identification, Authentication, and Authorization mechanisms
  • Government laws and regulations pertaining to minimum security control requirements
  • Documented or informal policies, procedures and guidelines

Ultimately, enterprise security risk assessments performed with measurably appropriate care are an indispensable part of prioritizing security concerns. Carrying out such assessments informally can be a valuable addition to a security issue tracking process, and formal assessments are of critical importance when determining time and budget allocations in large organizations.

In contrast, taking a haphazard approach to security concern prioritization can lead to disaster, particularly if a problem falls into a high-risk category and then ends up neglected. IT-specific benefits of performing an enterprise security risk assessment include:

  • Providing an objective approach for IT security expenditure budgeting and cost estimation
  • Enabling a strategic approach to IT security management by providing alternative solutions for decision making and consideration
  • Providing a basis for future comparisons of changes made in IT security measures

IT Risk Assessment Outcome

Specifically, an enterprise security risk assessment is intended to be suitable for the following, which could be specific to any organization:

  • A way to ensure that security risks are managed in a cost-effective manner
  • A process framework for the implementation and management of controls to ensure that the specific security objectives of an organization are met
  • A definition of new information security management processes
  • Use by management to determine the status of information security management activities
  • Use by internal and external auditors to determine the degree of compliance with the policies, directives and standards adopted by the organization
  • For implementation of business-enabling information security
  • To provide relevant information about information security to customers
 

Overall, an organization must have a solid base for its information security framework. The risks and vulnerabilities to the organization will change over time; however, if the organization continues to follow its framework, it will be in a good position to address any new risks and/or vulnerabilities that arise.

ADVANCED ICT » Consultants and Auditors LLP.