Risk is the possibility of something negative happening. Information security risk management is all about understanding the risks to information, evaluating those risks, and putting in place tools, people, and processes to mitigate them.
Information Risk Management
Keeping information secure is crucial for any organization. The costs of damage to or disclosure of sensitive data can catapult a company into a precarious financial situation from hefty compliance penalties, litigation fees, and a damaged reputation. The cost of a minute of downtime on critical IT systems is thousands of dollars per minute.
Proper risk management helps companies develop a robust information security posture with well-implemented security governance and appropriate due diligence. You can reduce information security risks to an acceptable level by understanding the seven key elements of information security risk management.
1. Identifying Assets
Assets, in the context of information security, are systems, services, and data essential for specific business processes and tasks. For example:
- An inventory database is an asset that allows a business to properly manage its stock.
- An internal network service (intranet) is important for allowing employees to easily communicate and share information.
- A web server is an asset that ensures a company’s website is online.
- An eCommerce application is an asset that allows a business to sell goods online.
- A white paper is an asset that helps a business generate leads or solve a problem.
Businesses need to protect their information assets. Any item deemed valuable needs protection, and the first step of risk management is to identify all your assets.
To consider whether something is an asset, ask what would happen if the asset was lost, exposed, or damaged? The answer will often be an undesirable business outcome, such as compromised security, monetary loss, or loss of competitive advantage.
2. Valuing Assets
With your information assets identified, it’s important to remember that not all assets need the same level of protection. A breach of archived non-sensitive information is not as costly as a breach of personal customer data.
Asset valuation is a complex topic in its own right, but it, in essence, attempts to assign a dollar value to all of your information assets.
3. Threat Awareness
Threats to information security are actions that can cause unwanted consequences for your assets. Such unwanted consequences include data exposure, lost files, and systems crashing.
Threats aren’t only external actions, such as cyber attacks. Threats can be internal from disgruntled employees. Furthermore, threats to information security include accidents, such as fires and human errors.
4. Understanding Vulnerabilities
A vulnerability is either a direct weakness in an asset or in an organization’s IT infrastructure that can be exploited. A vulnerability could be a software loophole, an administrative error, or the absence of proper protection for assets, such as an endpoint security solution that protects endpoint devices.
5. Know Your Exposure
Exposure is the susceptibility of a particular vulnerability to being exploited by a threat within your IT infrastructure. In other words, exposure is the existing potential for harm to your IT assets. An intuitive example of exposure is leaving an Amazon S3 bucket open. The information inside the bucket is open and accessible, however, it’s not actively being exploited yet.
Good visibility into your organization’s exposure enables you to reduce the surface of possible attacks and put in place the right defenses to mitigate risks. Furthermore, knowing your areas of information exposure is a prerequisite for achieving compliance with regulations, including ISO 27001 and PCI DSS.
6. Measuring Risk
Risk is the likelihood that a given exposure will actually happen, leading to some form of negative outcome for your IT assets. It is a probabilistic assessment that boils down to a simple formula of multiplying a threat by a vulnerability.
With that formula in mind, you can work on managing risk by either neutralizing the threat or protecting against the vulnerability.
7. Implementing Safeguards
Implementing safeguards is the meat of what many laypeople often consider to encompass cybersecurity. A safeguard is a security control, countermeasure, or defense mechanism that either protects against a threat or removes a vulnerability. Safeguards reduce, mitigate, and/or eliminate the risks from particular information security threats.
Some examples of safeguards include:
- Putting in place a Security Information and Event Monitoring (SIEM) solution.
- Applying automated patch management to software
- Reconfiguring your account access controls
- Using anti-virus software
The Cycle of Information Security Risk Management
The distinct elements of information security risk management (assets here are a combination of identification and evaluation) together make up a complete information security risk model. You can view the model as a cycle starting from your assets and making its way back to your assets via all the other elements, as in the below diagram:
Closing Thoughts
The most important thing is to understand these elements and how they interact to make up your organization’s information security risk profile. Implement appropriate information security safeguards and defenses suitable for different assets and their threats, and you’ll achieve the best balance of protection and cost-efficiency.
If you enjoyed this article and you’d like me to write an engaging, well-researched article or blog post for your business, you can email me now by clicking the below button:
Get in Touch