The cost of cybercrime

Recent statistics do not leave room for any doubt: the current level of cyberthreat is higher than ever, and all businesses are at constant risk.

Check Point Research revealed that in the third quarter of 2022 global attacks increased by 28% compared to the same period in 2021, and that the number of average weekly attacks per organisation worldwide reached over 1130.

Purplesec announced that by 2025 cybercrimes will cost $10.5 trillion annually. Currently, an average malware attack costs a company over $2.5 million.

Every day, bad actors become more skilled and are coming up with always more sophisticated methods to steal money and data. Information security risk assessment is a good way to prevent them from attacking your business.

What is information security risk assessment?

Information security risk assessment allows you to understand your organisation’s security posture, the risks it is facing every day and the ways of preventing any attacks from happening. It helps you establish which information and systems within your business are most vulnerable, and what is the estimated cost of a potential attack or of a system that goes down.

As indispensable in creating a safe and sound IT environment, IT security risk assessments should be conducted regularly (for example once a year or every six month) and at times of major changes within your organisation (when you introduce new technologies, merge or re-organise your company).

What is an ISO 27001 risk assessment?

IT security risk assessment is such a crucial part of every organisation’s security posture, that some security frameworks became mandatory. One of them is ISO/IEC27001 – an international standard on how to manage information security. Published by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission in 2005, it contains security requirements and best practices for the successful information security management system (ISMS), helping organisations around the world to keep their assets secured. Risk assessment is a very important part of it.

Another good framework that helps organisations better manage their cybersecurity risks and protect their data is NIST (National Institute of Standards and Technology) Cybersecurity Framework. While IOS 27001 is mandatory, NIST CFS is voluntary.

What are the major risk factors in information security?

According to Deloitte, there are three main risk factors that can impact security risk management:

• Employee data, which should be safeguarded in the same way as customer data,
• Technology adoption, which is often done too quickly and not securely enough,
• Organisational culture, which should always reflect the values of the company.

All of them should be taken into consideration when creating a successful cybersecurity risk assessment.

How to perform a successful IT risk assessment

There are five steps needed to perform a successful IT risk assessment:

1. Determine the scope and get everyone on board

To start, you need to know your scope. The goal will rarely be the security assessment of the entire organisation – more likely you will be keen to divide the task into smaller chunks, like checking the security of a particular part of the company, a specific location, or an app that you are developing.

Once you know the scope, it is crucial to get all the people involved on board. They should be aware of the importance of such an assessment and should know the steps needed to get it done.

2. Identify your risks: security threats and vulnerabilities

When it comes to identifying your risks, it is crucial to start with mapping your assets. Otherwise, it will be difficult to know how to protect them. Create an inventory of assets, establishing which of them are most important.

Now it’s the time to identify the actual threats: ways cybercriminals can cause harm to your most important assets. To do that, you can use some knowledge bases of tactics and techniques used by cybercriminals and based on real-work observation, like MITRE ATT&CK.

3. Analyse the risks

Once you know what kind of threats your organisation is facing, you need to consider the likelihood of them happening and their consequences.

4. Evaluate the risk

Already know which risks are most likely to happen? See how you can mitigate them by creating a risk management plan. There are three things you can do to mitigate your risks:

• avoid doing the risky activity,
• share some of the security responsibilities with a third party,
• implement new security methods to reduce the likelihood of those risks happening.

5. Document

The last task which should always be a part of every IT security risk assessment is the documentation of all identified risks in a risk register. Such a document should be reviewed and updated regularly, so that it constitutes the most current database of risks your organisation is facing every day.

Choosing the right partner

Conducting a cybersecurity risk assessment is a time-consuming and complex task, yet it is one of the most important ones to be done regularly. The lack of it may result in financial and reputational loses, which are extremely difficult to make up for.

If your organisation does not have enough resources allocated to the risk assessments, it is best to consult your situation with experienced cybersecurity partners that can help you kick-start the process and improve your security posture as soon as possible.