Information SEcurity > Introduction to Security > Risk Management in an infoSec

Risk Management

Risk Assessment is the process of identifying, analyzing, and evaluating potential threats and vulnerabilities that could negatively impact an organization’s assets, systems, or operations. It is a core component within an information security program.

Objectives of Risk Assessment

• To identify threats (e.g., cyberattacks, system failures)
• To recognize vulnerabilities (e.g., weak passwords, outdated software)
• To evaluate potential impact and likelihood
• To prioritize risks based on severity
• To recommend controls or mitigation strategies

Step in Risk Assessment

• Identify Assets Example: Customer data, servers, software systems
• Identify Threats Example: Malware, insider threats, natural disasters
• Identify Vulnerabilities Example: Unpatched systems, lack of user training
• Assess Impact and Likelihood Rate each risk based on how likely it is to occur and how severe the consequences would be.
• Determine Risk Level Use a risk matrix (Low, Medium, High) to categorize.
• Recommend Controls Example: Install firewalls, conduct regular backups, implement user training

Asset	Threat	Vulnerability	Impact	Likelihood	Risk Level
Customer Data	Phishing Attack	Lack of user training	High	High	High
Web Server	DDoS Attack	No traffic monitoring	High	Medium	Medium

Identifying Threats

A threat is anything that can compromise the confidentiality, integrity or availability of an information system. 

A cyberthreat is a threat that exploits a digital vulnerability. For example, a denial of service (DoS) attack is a cyberthreat in which cybercriminals overwhelm part of a company's information system with traffic, causing it to crash. 

Threats can also be physical. Natural disasters, physical or armed assaults and even systemic hardware failures are considered threats to a company's information system.

Identifying vulnerabilities

A vulnerability is any weakness in the information technology (IT) infrastructure that adversaries might exploit to gain unauthorized access to data. For example, hackers can take advantage of bugs in a computer program to introduce malware or malicious code into an otherwise legitimate app or service.

Human users can also constitute vulnerabilities in an information system. For example, cybercriminals might manipulate users into sharing sensitive information through social engineering attacks such as phishing.

Incident response planning

An incident response plan (IRP) typically guides an organization's efforts in responding to incidents.

Computer security incident response teams (CSIRT) often create and execute IRPs with the participation of stakeholders from across the organization. Members of the CSIRT might include the chief information security officer (CISO), chief AI officer (CAIO), security operations center (SOC), IT staff and representatives from legal, risk management and other nontechnical disciplines.

IRPs detail the mitigation steps that an organization takes when a significant threat is detected. While IRPs vary based on the organizations that craft them and the threats they target, common steps include:

• Assemble the security team, virtually or in person.
• Verify the source of the threat.
• Act to contain the threat and halt it as soon as possible.
• Determine what, if any, damage has occurred.
• Notify interested parties within the organization, stakeholders and strategic partners.

 

Prev

Information Security Programs

Next

Tools in Information Security

Feedback

Submit