How to Conduct a Cyber Risk Assessment: 5 Steps to Success

Step 2: Identify threats

Once you’ve developed a list of potential threats, the next step is to take your hypothetical threats and compare them against your actual systems and processes to determine their impact and the likelihood that they would actually occur.

We call those threats that have a high probability of occurring with negative consequences vulnerabilities. Vulnerabilities typically come in two forms:

1. Systemic vulnerabilities. These are gaps in your security and information systems that hackers or malware could exploit intentionally to access sensitive data.
2. Environmental vulnerabilities. These are internal and external gaps in your cyber security that could unintentionally or accidentally compromise your data (natural disaster, human error, etc.)

There are several ways to identify vulnerabilities in each category as you’re doing your assessment.

How to identify systemic vulnerabilities

Let’s address systemic vulnerabilities first. Typically, these will be identified through penetration testing, or intentionally trying to exploit your technical systems to gain access and find potential gaps.

However, it’s important to note that running an effective penetration test is as much an art as a science.

Just like identifying threats, penetration tests require experience and outside-the-box thinking to identify all of the potential ways your data could be maliciously accessed. So it’s critical that your tests are done by experts who are up to date on all of the ways that your security controls could be compromised (this changes quickly in today’s world). Get in touch if you want penetration testing help.

Otherwise, your risk analysis may not be as revealing as you want it to be and sensitive information could still be vulnerable.

How to identify environmental vulnerabilities

Studies show that human error accounts for almost 90% of data breaches. So you’ll want to be extra diligent with regards to identifying environmental vulnerabilities.

These vulnerabilities could include negligence on the part of your employees (leaving a laptop open in public or having it stolen all together), or policies around how data is accessed (can data be downloaded onto a zip drive and taken home?).

You’ll also want to review any changes in the cyber environment as they pertain to your industry during this step as well.

A good place to start with this is the National Institute for Standards and Technology (NIST) vulnerability database. This lists any reported vulnerabilities by month and year and will help you stay up to date with new risks.

Suggested reading: We regularly publish cyber-threat analysis reports.
Cyber Threat Intelligence Overview
CNS Cyber Intelligence Report: Trends in Ransomware Attacks against Legal and Accountancy Sector
CNS Cyber Intelligence Report: Threats to UK Financial Services

Step 4: Prioritise risks and actions

Once you’ve identified all of your vulnerabilities, the next step is determining which ones present the greatest risk and what actions you should take to mitigate them.

Fundamentally, there is almost always a cost associated with addressing vulnerabilities. So you need to weigh the cost of preventing that vulnerability against the cost of failure and the likelihood of failure.

When considering damage, think both long-term and short-term. For example, an immediate inability to continue business operations, or fines/lawsuits that may be likely. Long-term, do not underestimate potential reputational damage — something that is not always readily quantifiable, but often more financially impactful in the long run.

How to rank vulnerabilities

Here are a few questions to get you thinking about which vulnerabilities require action and when:

• What is the inherent risk to those assets that are vulnerable?
• What about those assets (information, data, IT infrastructure) is critical to your business?
• Which data would compromise your customers or partners if it were to be exposed?
• What regulations exist around the different types of data you store?
• Are there any fines associated with those regulations?
• How competitive is your market, and how are customers likely to respond to a breach or temporary suspension of services.
• What is your organisation’s stance on risk?

From there, it’s a simple matter of building a scorecard that ranks each vulnerability on a scale of low, medium, or high (you don’t have to be scientific about this — just as long as everyone in your organisation is on the same page).

Step 5: Record and present your findings

The goal of any assessment is to produce a report that records your findings and makes suggestions about actions in a clear and concise way (so that your board can understand why it’s worth spending to address, for instance).

In that respect, we find it’s always best to present the action in the context of damaged businesses outcomes if no action is taken, and the opportunities that effective action will open if taken.

If you need help with this, we’ve produced a board presentation template to help cyber security managers and leaders demonstrate the value of cyber to their board of directors.

Additionally, if you need help identifying potential risks to your organisation, we’re here to help. Our penetration test teams are some of the most highly regarded in the industry and we’d be happy to help you find and contextualise any risks your organisation may be facing. We can then construct an ongoing framework that will let you continue to improve the safety and security of your organisation.

Remember: this risk assessment is just a starting point for your cyber security journey. You need to use the information you uncover to feed an ongoing process that will help you maintain a secure outcome every step of the way.

Changes to the way we work are creating new uncertainties and opportunities. By sharing information and strategic choices, we can make a safer cyber-community overall. Good luck, and start assessing.