How should I conduct IT risk assessments for my business?

Risk is often a term you associate with insurance, but it has a deep meaning for your business about your information technology. About technology, risk applies to all facets of the technology being utilized – usually in terms of access, availability, and permissions. A core part of a cybersecurity strategy is the analysis of and identifying your overall risk tolerance.  

What is an IT Risk Assessment?

Think of an IT risk assessment as a digital audit of your risk tolerance. It's a way to identify potential threats to your computer systems and data, so you can protect yourself before anything bad happens as well as determine how much risk you are willing to tolerate to accomplish business goals.

Why is it important?

• Peace of mind: Knowing your risks can help you and your team feel secure about preventions in place as well as be ready to remediate any tolerated exposure.
• Protection: By identifying threats, you can take steps to proactively mitigate them.
• Compliance: Some industries require regular risk assessments that are documented and able to be accessed by third-party auditors.

How to Conduct an IT Risk Assessment

• Identify your assets: What's important to your business? This could be customer data, financial information, or your website. This can also include physical items like laptops or mobile devices in employee possession with access to or housing corporate data.
• Assess threats: What could go wrong? Think about things like cyberattacks, hardware failures, theft, and natural disasters.
• Evaluate vulnerabilities: How easy is it for someone to exploit these threats? Threat analysis and thinking ahead of potential exploitation is a key piece of this puzzle.
• Calculate risks: Combine the likelihood of a threat with the potential impact. The impact should be scaled on whether the impact is limited in scope to internal data or if an exploit could expose a larger set of customer data requiring notifications.
• Develop a response plan: What will you do if something goes wrong?  Incident response might include internal teams, external consultants as well as bridging this plan to your business continuity planning.  In most cases, incident response might include taking your entire system off line, so a continuity plan might have to be enacted if the incident response takes an extended amount of time.

Tips for a Successful Assessment

• Involve your team: Everyone should understand the risks and their role in protecting the business. This applies to any organization where principal business functions rely on specific individuals or department heads.
• Prioritize risks: Focus on the most serious threats first. In a situation where you house PI data, the priority should be securing and protecting that data. Breach of PI data is tremendous and it impacts businesses not just financially but it also impacts the reputation of the business.
• Stay updated: Technology changes quickly, so your assessment should be updated regularly. Subscribe to US-CERT and other security newsletters so you always have the latest information about exploits used in the wild and how to protect against them. Make sure you are getting notifications from your vendors about any security news or updates. Especially your router and switch vendors.
• Consider using tools: There are software tools that can help you with the assessment process. A security consultant or MSP could be very helpful in developing a risk assessment of your business. There are routine items that can be done such as Pen tests to continually test your risk factors.

Remember an IT risk assessment is not a one-time thing. It's an ongoing process that helps you stay ahead of the curve and protect your business. Along with your risk assessment, your business continuity plans should be updated to reflect mitigation processes for any identified, tolerable risks. Your Risk Assessment will always evolve as technology evolves. It’s a best practice to analyze risk at a couple of junctures:

1. Whenever a new piece of software or hardware is deployed
2. New permissions are issued to groups or individuals inside of the organization
3. Onboarding of clients with specific regulatory requirements (DOD and HIPPA for example)
4. Quarterly or at minimum, yearly, the risk assessment should be updated and or revisited to ensure completeness