Security Risk Assessment

Security Risk Assessment is the continuous process of discovering, correcting, and preventing potential security exposures. The risk assessment phase is an integral part of a risk management process designed to provide appropriate levels of security for information systems.

Through a risk assessment, one seeks to understand the current system and environment and identify risks through analysis of the information/data collected. By default, all relevant information should be considered regardless of storage format.

Different types of information that are often collected include:

  • Security requirements and objectives
  • System/network architecture and infrastructure, such as a network diagram showing how assets are configured and interconnected
  • Information available to the public or accessible from the organization’s website
  • Physical assets, such as data center, network, and communication components and peripherals (e.g., desktop, laptop, PDAs)
  • PC and Server Operating systems
  • Data repositories, such as database management systems and files
  • Network details, such as supported protocols and network services offered
  • Security systems in use, such as access control mechanisms, change control, antivirus, spam control, and network monitoring
  • Security components deployed, such as firewalls and intrusion detection systems
  • Government laws and regulations pertaining to minimum security control requirements
  • Documented or informal policies, procedures, and guidelines