Which of the following is the final step in the NIST risk Assessment methodology

Cybersecurity risk assessments help organizations understand, control, and mitigate all forms of cyber risk. It is a critical component of risk management strategy and data protection efforts.

Risk assessments are nothing new and whether you like it or not, if you work in information security, you are in the risk management business. As organizations rely more on information technology and information systems to do business, the digital risk threat landscape expands, exposing ecosystems to new critical vulnerabilities.

The National Institute of Standards and Technology (NIST) has developed a Cybersecurity Framework to provide a base for risk assessment practices.

What is Cyber Risk?

Cyber risk is the likelihood of suffering negative disruptions to sensitive data, finances, or business operations online. Most commonly, cyber risks are associated with events that could result in a data breach.

Cyber risks are sometimes referred to as security threats. Examples of cyber risks include:

• Ransomware
• Data leaks
• Phishing
• Malware
• Insider threats
• Cyberattacks

There are practical strategies that you can take to reduce your cybersecurity risk.

Though commonly used interchangeably, cyber risks and vulnerabilities are not the same. A vulnerability is a weakness that results in unauthorized network access when exploited, and a cyber risk is the probability of a vulnerability being exploited.

Cyber risks are categorized from zero, low, medium, to high-risks. The three factors that impact vulnerability assessments are:

• What is the threat?
• How vulnerable is the system?
• What is the reputational or financial damage if breached or made unavailable?

Using this simple methodology, a high-level calculation of cyber risk in an IT infrastructure can be developed:

Cyber risk = Threat x Vulnerability x Information Value

Imagine you were to assess the risk associated with a cyber attack compromising a particular operating system. This operating system has a known backdoor in version 1.7 of its software that is easily exploitable via physical means and stores information of high value on it. If your office has no physical security, your risk would be high.

However, if you have good IT staff who can identify vulnerabilities and they update the operating system to version 1.8, your vulnerability is low, even though the information value is still high because the backdoor was patched in version 1.8.

A few things to keep in mind is there are very few things with zero risk to a business process or information system, and risk implies uncertainty. If something is guaranteed to happen, it's not a risk. It's part of general business operations.

What is a Cyber Risk Assessment?

Cyber risk assessments are defined by NIST as risk assessments are used to identify, estimate, and prioritize risk to organizational operations, organizational assets, individuals, other organizations, and the Nation, resulting from the operation and use of information systems.

The primary purpose of a cyber risk assessment is to keep stakeholders informed and support proper responses to identified risks. They also provide an executive summary to help executives and directors make informed decisions about security.

The information security risk assessment process is concerned with answering the following questions:

• What are our organization's most important information technology assets?
• What data breach would have a major impact on our business whether from malware, cyber attack or human error? Think customer information.
• Can all threat sources be identified?
• What is the level of the potential impact of each identified threat?
• What are the internal and external vulnerabilities?
• What is the impact if those vulnerabilities are exploited?
• What is the likelihood of exploitation?
• What cyber attacks, cyber threats, or security incidents could impact affect the ability of the business to function?
• What is the level of risk my organization is comfortable taking?

If you can answer those questions, you will be able to make a determination of what to protect. This means you can develop IT security controls and data security strategies for risk remediation. Before you can do that though, you need to answer the following questions:

• What is the risk I am reducing?
• Is this the highest priority security risk?
• Am I reducing the risk in the most cost-effective way?

This will help you understand the information value of the data you are trying to protect and allow you to better understand your information risk management process in the scope of protecting business needs.

Why Perform a Cyber Risk Assessment?

There are a number of reasons you want to perform a cyber risk assessment and a few reasons you need to. Let's walk through them:

Reduction of Long-Term Costs

Identifying potential threats and vulnerabilities, then working on mitigating them has the potential to prevent or reduce security incidents which saves your organization money and/or reputational damage in the long-term.

Provides a Cybersecurity Risk Assessment Template for Future Assessments

Cyber risk assessments aren't one of the processes, you need to continually update them, doing a good first turn will ensure repeatable processes even with staff turnover.

Better Organizational Knowledge

Knowing organizational vulnerabilities gives you a clear idea of where your organization needs to improve.

Avoid Data Breaches

Data breaches can have a huge financial and reputational impact on any organization.

Avoid Regulatory Issues

Customer data that is stolen because you failed to comply with HIPAA, PCI DSS or APRA CPS 234.

Avoid Application Downtime

Internal or customer-facing systems need to be available and functioning for staff and customers to do their jobs.

Data Loss

Theft of trade secrets, code, or other key information assets could mean you lose business to competitors.

Beyond that, cyber risk assessments are integral to information risk management and any organization's wider risk management strategy.

Who Should Perform a Cyber Risk Assessment?

Ideally, organizations should have dedicated in-house teams processing risk assessments. This means having IT staff with an understanding of how your digital and network infrastructure works, executives who understand how information flows, and any proprietary organizational knowledge that may be useful during the assessment.

Organizational transparency is key to a thorough cyber risk assessment.

Small businesses may not have the right people in-house to do a thorough job and will need to outsource assessment to a third party. Organizations are also turning to cybersecurity software to monitor their cybersecurity score, prevent breaches, send security questionnaires and reduce third-party risk.

How to Perform a Cyber Risk Assessment

We'll start with a high-level overview and drill down into each step in the next sections. Before you start assessing and mitigating risks, you need to understand what data you have, what infrastructure you have, and the value of the data you are trying to protect.

You may want to start by auditing your data to answer the following questions:

• What data do we collect?
• How and where are we storing this data?
• How do we protect and document the data?
• How long do we keep data?
• Who has access internally and externally to the data?
• Is the place we are storing the data properly secured? Many breaches come from poorly configured S3 buckets, check your S3 permissions or someone else will.

Next, you'll want to define the parameters of your assessment. Here are a few good primer questions to get you started:

• What is the purpose of the assessment?
• What is the scope of the assessment?
• Are there any priorities or constraints I should be aware of that could affect the assessment?
• Who do I need access to in the organization to get all the information I need?
• What risk model does the organization use for risk analysis?

A lot of these questions are self-explanatory. What you really want to know is what you'll be analyzing, who has the expertise required to properly assess, and are there any regulatory requirements or budget constraints you need to be aware of.

Now let's look at what steps need to be taken to complete a thorough cyber risk assessment, providing you with a risk assessment template.

Step 1: Determine Information Value

Most organizations don't have an unlimited budget for information risk management so it's best to limit your scope to the most business-critical assets.

To save time and money later, spend some time defining a standard for determining the importance of an asset. Most organizations include asset value, legal standing and business importance. Once the standard is formally incorporated into the organization's information risk management policy, use it to classify each asset as critical, major or minor.

There are many questions you can ask to determine value:

• Are there financial or legal penalties associated with exposing or losing this information?
• How valuable is this information to a competitor?
• Could we recreate this information from scratch? How long would it take and what would be the associated costs?
• Would losing this information have an impact on revenue or profitability?
• Would losing this data impact day-to-day business operations? Could our staff work without it?
• What would be the reputational damage of this data being leaked?

Step 2: Identify and Prioritize Assets

The first step is to identify assets to evaluate and determine the scope of the assessment. This will allow you to prioritize which assets to assess. You may not want to perform an assessment on every building, employee, electronic data, trade secret, vehicle, and piece of office equipment. Remember, not all assets have the same value.

You need to work with business users and management to create a list of all valuable assets. For each asset, gather the following information where applicable:

• Software
• Hardware
• Data
• Interface
• End-users
• Support personal
• Purpose
• Criticality
• Functional requirements
• IT security policies
• IT security architecture
• Network topology
• Information storage protection
• Information flow
• Technical security controls
• Physical security controls
• Environmental security

Step 3: Identify Cyber Threats

A cyber threat is any vulnerability that could be exploited to breach security to cause harm or steal data from your organization. While hackers, malware, and other IT security risks leap to mind, there are many other threats:

• Natural disasters: Floods, hurricanes, earthquakes, lightning and fire can destroy as much as any cyber attacker. You can not only lose data but servers too. When deciding between on-premise and cloud-based servers, think about the chance of natural disasters.
• System failure: Are your most critical systems running on high-quality equipment? Do they have good support?
• Human error: Are your S3 buckets holding sensitive information properly configured? Does your organization have proper education around malware, phishing and social engineering? Anyone can accidentally click a malware link or enter their credentials into a phishing scam. You need to have strong IT security controls including regular data backups, password managers, etc.
• Adversarial threats: third party vendors, insiders, trusted insiders, privileged insiders, established hacker collectives, ad hoc groups, corporate espionage, suppliers, nation-states

Some common threats that affect every organization include:

• Unauthorized access: both from attackers, malware, employee error
• Misuse of information by authorized users: typically an insider threat where data is altered, deleted or used without approval
• Data leaks: Personally identifiable information (PII) and other sensitive data, by attackers or via poor configuration of cloud services
• Loss of data: organization loses or accidentally deleted data as part of poor backup or replication
• Service disruption: loss of revenue or reputational damage due to downtime

After you've identified the threats facing your organization, you'll need to assess their impact.

Step 4: Identify Vulnerabilities

Now it's time to move from what "could" happen to what has a chance of happening. A vulnerability is a weakness that a threat can exploit to breach security, harm your organization, or steal sensitive data. Vulnerabilities are found through vulnerability analysis, audit reports, the National Institute for Standards and Technology (NIST) vulnerability database, vendor data, incident response teams, and software security analysis.

You can reduce organizational software-based vulnerabilities with proper patch management via automatic forced updates. But don't forget physical vulnerabilities, the chance of someone gaining access to an organization's computing system is reduced by having keycard access.

Step 5: Analyze Controls and Implement New Controls

Analyze controls that are in place to minimize or eliminate the probability of a threat or vulnerability. Controls can be implemented through technical means, such as hardware or software, encryption, intrusion detection mechanisms, two-factor authentication, automatic updates, continuous data leak detection, or through nontechnical means like security policies and physical mechanisms like locks or keycard access.

Controls should be classified as preventative or detective controls. Preventative controls attempt to stop attacks like encryption, antivirus, or continuous security monitoring, detective controls try to discover when an attack has occurred like continuous data exposure detection.

Step 6: Calculate the Likelihood and Impact of Various Scenarios on a Per-Year Basis

Now you know the information value, threats, vulnerabilities and controls, the next step is to identify how likely these cyber risks are to occur and their impact if they happen. It's not just whether you might face one of these events at some point, but what it's potential for success could be. You can then use these inputs to determine how much to spend to mitigate each of your identified cyber risks.

Imagine you have a database that store all your company's most sensitive information and that information is valued at $100 million based on your estimates.

You estimate that in the event of a breach, at least half of your data would be exposed before it could be contained. This results in an estimated loss of $50 million. But you expect that this is unlikely to occur, say a one in fifty-year occurrence. Resulting in an estimated loss of $50m every 50 years or in annual terms, $1 million every year.

Arguably justifying a $1 million budget each year to be prevented.

Step 7: Prioritize Risks Based on the Cost of Prevention Vs Information Value

Use risk level as a basis and determine actions for senior management or other responsible individuals to mitigate the risk. Here are some general guidelines:

• High - corrective measures to be developed as soon as possible
• Medium - correct measures developed within a reasonable period of time
• Low - decide whether to accept the risk or mitigate

Remember, you have now determined the value of the asset and how much you could spend to protect it. The next step is easy: if it costs more to protect the asset than it's worth, it may not make sense to use preventative control to protect it. That said, remember there could be a reputational impact, not just financial impact so it is important to factor that in too.

Also, consider:

• Organizational policies
• Reputational damage
• Feasibility
• Regulations
• Effectiveness of controls
• Safety
• Reliability
• Organizational attitude towards risk
• Tolerance for uncertainty regarding risk factors
• The organizational weighting of risk factors

Step 8: Document Results from Risk Assessment Reports

The final step is to develop a risk assessment report to support management in making decision on budget, policies and procedures. For each threat, the report should describe the risk, vulnerabilities and value. Along with the impact and likelihood of occurrence and control recommendations.

As you work through this process, you'll understand what infrastructure your company operates, what your most valuable data is, and how you can better operate and secure your business. You can then create a risk assessment policy that defines what your organization must do periodically to monitor its security posture, how risks are addressed and mitigated, and how you will carry out the next risk assessment process.

Whether you are a small business or multinational enterprise information risk management is at the heart of cybersecurity. These processes help establish rules and guidelines that provide answers to what threats and vulnerabilities can cause financial and reputational damage to your business and how they are mitigated.

Ideally, as your security implementations improve and you react to the contents of your current assessment, your cybersecurity score should improve.

Identify Threats in Your Ecosystem

UpGuard is an industry-leading attack surface monitoring platform. The propriety cyber risk mitigation solution strengthens vulnerabilities both internally and throughout the vendor network to significantly reduce the chances of data breaches.

UpGuard also supports compliance across a myriad of security frameworks, including the new requirements set by Biden's Cybersecurity Executive Order.

What is the final step in the NIST risk management Process?

What is the last step step 4 of a NIST risk assessment?

What are the six steps of the NIST Risk Management Framework?

What is a NIST risk assessment?