What is a risk assessment?

Introduction

While government regulations are strict when it comes to financial institutions, there are a few things that can be done without examination input. Risk assessments are a great way to gauge how vulnerable your network is when it comes to cybersecurity attacks from social engineering, malware, and ransomware.

Sometimes, risk assessments are compared to IT audits, but there are a few differences between the two. While both are important, risk assessments only scratch the surface level of what vulnerability management should be, but it is a good starting point for many smaller organizations. Regardless, it is sometimes crucial to get both.

What is a risk assessment?

Risk assessments are a method of checking controls and various network areas for compliance with various frameworks. These frameworks include NIST, FFIEC, CIS, HIPAA, and more. While not as in-depth as an IT audit, it is usually done before an IT audit is performed, considering it is a simple surface-level glance of internal security landscapes.

A risk assessment will usually go over a few reviews, sometimes with the assistance of automated tools or scanners. They will check for security patches, updates, and various other things that may or may not be implemented in the case of vulnerabilities. Since new risks and vulnerabilities pop up every day, it’s a good idea to get a risk assessment one or two times a year, depending on the size of the organization.

A risk assessment will usually include the following:

• Assessment of an organization’s physical, technical, and operational assets and scoring based on Confidentiality, Integrity, and Availability (CIA) values to determine sensitivity and criticality levels.
• Threat evaluation based on the CIA values. Each threat will include the “Likelihood” of occurrence and how detrimental the risk may be on the organization (Impact).
• Inherent risk levels, determined if no security controls are in place for certain aspects. All assets add up to an Inherent Risk score, from how critical they are, to how many potential threats there are.
• Control analysis with security analysts, verifying controls you have in place to protect your assets through interviews with internal staff or outsourced IT.
• With input from an analyst, a Residual Risk can be determined for your organization. This is the risk that is left over after controls are implemented. It revolves around the “acceptable” level of risk for the organization, determining how critical they are versus the cost of doing business.
• Risk mitigation guidance should be used with the organization, helping you understand the Residual Risk and the threats that come with it. With this guidance and information through reports and recommendations, the organization will b e able to improve security controls and minimize residual risk.

The Difference Between IT Audits and Risk Assessments

As said above, there are a few key differences between IT audits and risk assessments. There are many similarities, but you can think of a risk assessment as a prerequisite of an IT audit. The assessments don’t go as deep as an IT audit and is more of a surface-level consideration of controls that are in place. Fortunately, these services aren’t very expensive and can sometimes be done by the organizations themselves.

An IT audit is a bit deeper than a risk assessment. Where a risk assessment is mostly internal and a surface level of things in place, an IT audit is both internal and external. The audit will have dedicated information security analysts who go over each security control like firewalls, security patches, and more. They will be examined and scrutinized by the analyst while also performing penetration tests in some cases.

Conclusion

Risk assessments are an important part of an organization’s cybersecurity posture. It should be done once or twice a year, just to be make sure that all of the risk is at a normal or manageable level. These assessments are surface-level scans and examinations of security controls, making sure that specific defenses are up and that vulnerabilities are kept out.

Alternatively, an IT audit is much deeper than a risk assessment. While a risk assessment should be done before an IT audit, the assessment won’t go as far as the audit. It is an internally focused review of these controls, where an audit will examine internal and external controls at a much more detailed level. The risk assessment can be done by the organization, but it’s always a good idea to reach out to a third party for such things.