Security Risk Assessments
Security risk assessments that add value.
Our Approach
Security Assessment Preparation
The first step is always preparing. This step ensures context for the security risk assessment. Our preparation usually begins very early in our relationship and includes:
- Purpose of the assessment
- Scope of the assessment
- Uncovers any assumptions or constraints
- Any potential inputs or factors to consider while conducting the assessment
- Identify the analytic approach
Conducting Security Risk Assessments
The outcome of this step is to provide you with a list of security risks that can be prioritized and used to inform a meaningful risk response. Completing a risk assessment has many steps and tasks. Those tasks in summary are:
- Identify security threat sources that are relevant to your organization or industry
- Identify threat events that might come from the threat sources
- Identify security vulnerabilities in your organization that could be exploited by threat sources
- Determination likelihood that threat sources would initiate specific threat events
- Determination of impact to the organization resulting from the exploitation of security vulnerabilities
- Determination of actual security risk as a combination of likelihood of vulnerability exploitation and impact of exploitation
Security Risk Assessment Reporting
At the conclusion of the security risk assessment we report on the results of the risk assessment and ensure that you can understand the results. Our goal is ensure that decision makers have the appropriate risk-related information needed to inform and guide risk decisions. In addition to preparing a report, based on the organizational communication style we can also prepare executive briefings, prepare risk memos, or risk dashboards.
Recent Blog Posts
Risk Assessments in Everyday Life
By: Kristof Holm As an IT security professional, specializing in risk assessment, I often consciously think about risk in everyday life, sometimes this is good like when a friend asks whether I’d like to go cliff jumping or sky-diving in Mexico. Other times not so...
The First 101 Days as a New CISO – A Chief Information Security Officer’s Playbook
By: Justin Fimlaid If you are a new CISO or starting a new Security Leadership gig, your first few months on the job are critical to your ongoing success in your new role. In the first few months you'll be judged, tested by your organization and staff, and put on a...
Organizational Structure’s Impact on Information Security
If you are a member of your organization’s executive team, then you are likely well-versed with various information security responsibilities, either by choice or by regulation. If your organization is in the private sector, then within this suite of responsibility...