Step-by-Step: How Do You Conduct A Cybersecurity Risk Assessment?

The Cybersecurity and Infrastructure Security Agency (CISA) reports that: 

• 47% of American adults have had their personal information exposed by cybercriminals. 
• 44% of millennials admit to being victims of online crime in the last year. 

You might expect that digital natives would be savvier than older age groups, but the statistics show that even millennials are susceptible to scams. These shocking numbers show why a cybersecurity risk assessment is important for any business. 

Although most IT departments pride themselves on robust security protocols, with the rise in remote working, many of the risks are now out of sight for the internal team. With so many individuals succumbing to online crime, working from home can soon mean that their personal problem also becomes a challenge for your business and its network.

What does a cybersecurity risk assessment analyze?

Your cybersecurity risk assessment analyzes the whole IT environment within your organization to understand the likelihood and potential severity of a variety of different types of cyber attacks on your systems. 

It looks for vulnerabilities in your hardware, software, and data management protocols while challenging the protections and mitigations you have in place. This allows you to identify the areas in which your network is most at risk of being compromised and helps you to preempt and avert the types of attacks that could cause damage to your business.  

The importance of regular cybersecurity security assessments

There is no point in carrying out a single risk assessment and then thinking your job is done. The world of cybercrime is continually evolving and changing. What was a threat one year might be nullified today, but also it will have been replaced by a number of other challenges. Regular assessments help you stay on top of trends and prepare for the latest and most significant risks. 

Not only do criminals keep changing their approach, but regulators also develop new obligations for businesses. A regular risk assessment keeps you up-to-date with compliance matters relating to your IT systems and prepares you for potential attacks. 

How to do a cybersecurity risk assessment

1. Evaluate the scope of the risk assessment

Carrying out a risk assessment on the entirety of your IT infrastructure in one go might be daunting and too complicated to complete in good time. With that in mind, take time to prioritize the areas in which you will conduct the assessment first. 

For example, you might choose to assess just the hardware associated with your network first of all. Once you set this scope for the assessment, you can go over all of these assets and consider the points of contact each piece of hardware has with sources of cybersecurity threats. 

For example, a company laptop that is used for remote working will face risk from the home and public networks to which it connects, as well as from the shadow IT that the user uploads. From this analysis, you can build a picture of where the threats can breach the hardware and enter your network. 

Once you create a scope for hardware assessment, you can move to software and other areas of your IT infrastructure. 

2. Determine asset value and the cost of protection

One way that a cybersecurity risk assessment can help you prioritize your prevention efforts is by not only working out where the most likely threats come from but by assessing which assets are actually worth protecting. 

To discover this, you have to work out the value to the company of your assets. Laptops for employees add a great deal of value to the business because they allow them to complete the work that brings in revenue. The value of an asset is not determined solely by the actual cash amount that it costs but by what it brings to the organization. 

Once you understand the value of the asset, you can then look at the cost to protect it and work out whether the detriment caused by an attack would make it worthwhile. In the example of company laptops, if they were to be out of action, it would probably cause great damage to the company’s operations. However, a web app that doesn’t bring in much revenue might not be worth the cost of advanced protection, and this would determine how you deal with it in the future. 

3. Identify and assess cyber threats

Take a thorough look at the current cybersecurity threats that apply to your organization. Read industry websites and publications, check government websites, and network with other IT security professionals to gain insight into those new threats appearing in the IT ecosystem. 

Understand which threats apply to the assets that fall under the scope of your assessment and consider how they might infiltrate your systems and the damage that they could cause if they were allowed to. 

How might they exploit your assets, and what would happen if they did? By considering the impact of each threat, you can begin to make more effective decisions regarding your security policies in the future. 

4. Identify vulnerabilities

Once you understand what the threats are, you can track down the chinks in your armor that might let them into your network. Think about the vulnerabilities in your systems and highlight which areas you need to protect more robustly.

If you have remote employees, this might be the fact that some of them work from coffee shops using public networks that don’t meet your stringent security standards. Another vulnerability is shadow IT, where employees use programs that IT has not approved to complete their work.  

This can lead to them installing apps that don’t require multi-factor authentication (MFA), for example, and which are more liable to hacking. Another shadow IT vulnerability is where employees hold customer information in a third-party app that does not meet the IT department’s data protection standards. 

5. Prioritize risks

From understanding the value of assets, the threats in the environment, and the vulnerabilities of your individual organization, you can gain a clearer picture of how to prioritize the risks that you must attempt to mitigate. 

Create a risk matrix to help you visualize the threats at hand. This requires you to assign a score to each risk for the potential severity of its impact on your business if it were to happen and for the likelihood of it happening. 

Once you have completed this, you can prioritize risks by dealing first with those that are most likely to happen and which will have the greatest impact. Then you can work through the rest, ending up with those least likely to occur and which would not make as great an impact if they did happen. 

6. Analyze controls

Consider how the controls that you have in place, or those that are being developed, will cope with the threats that you have uncovered in the course of your risk assessment. This will help you understand whether you have adequate protection or whether you need to develop new systems. 

This could relate to technical controls, such as VPNs for remote workers to disguise their IP addresses or firewalls, but it might also apply to non-technical controls, like the creation of IT security policies. 

If shadow IT is a major concern, for example, you could implement a non-technical control in the form of a training program to alert employees to the potential dangers. You can also add a technical control in the form of device monitoring. Vaultry monitors all devices on your network and alerts you to unauthorized software so you can remove it before it causes a problem. 

7. Monitor and review effectiveness

Unfortunately, cybercriminals do not give up easily, and that is why you need to continually monitor your mitigation efforts. Are they still as robust as they were, and are they fit for purpose when faced with new threats? 

Be prepared to be flexible and adjust your approach as you face the changing environment of cyber threats. 

FAQ

What are the different types of cybersecurity risk assessment frameworks?

The cybersecurity frameworks are: 

Framework	What it means
NIST Cybersecurity Framework	This is a repository of best practices for cybersecurity in business in the US.
The Federal Information Security Modernization Act (FISMA)	Relates to protecting federal government agencies and suppliers from cyberattacks.
The General Data Protection Regulation (GDPR)	The European Union’s legislation on data protection, which affects all organizations that collect the data of EU citizens, wherever the company is based.
ISO 27001 and ISO 27002	The international standards for information security management.
Service Organization Control Type 2 (SOC2)	Created by the American Institute of Certified Public Accountants (AICPA) to vet the cybersecurity approaches of vendors and partners relating to data handling.
North American Electric Reliability Corporation – Critical Infrastructure Protection (NERC-CIP)	Standard to help energy companies mitigate the risk of cyber attacks on their systems.
Health Insurance Portability and Accountability Act (HIPAA)	Standards for healthcare organizations to ensure they handle sensitive patient data in the appropriate manner.

Which companies should perform a cybersecurity risk assessment?

Any company that makes use of IT networks and relies on the internet for its business should assess its cybersecurity risk.

Who should perform a cyber risk assessment?

If you have an internal IT department with the capacity to carry out the risk assessment, this should be a job for that team. However, many smaller businesses might have to outsource this task. 

Who should be involved in a cybersecurity risk assessment?

Cybersecurity crosses many boundaries, meaning that it is of importance to the IT department, the security team, senior management, line managers, compliance functions, and human resources. Together, they can work to provide a clear picture of the threats and vulnerabilities in the business. 

References and further reading

• Work from home IT security issues
• Reduce WFH security risk
• Remote work security checklist
• Train employees on cybersecurity
• Create a shadow IT policy