CyberSecurity: Risk Management

 

In the world of business and technology, the last thing you want is a cyberattack. It's effects are truly devastating and can lead to the destruction or unauthorized access to the essential assets that keep some of the most prominent companies afloat. As much as we try, the truth is we can never prevent cybercriminals from breaching our systems. However, we can implement methods to reduce the chances or severity of an attack through a process known as risk management. 

A risk describes a situation in which a person, place or object is exposed to harm which can result in injury or damage. By analysing potential risks to an organisation, cyberattacks can be predicted and subsequently stopped. Protecting assets is a common method of managing threats, tangible or intangible. 

Tangible assets refer to devices and physical items in an organisation, including printers and computers; intangible assets are those which are stored in a non-physical state such as database information, trade secrets and company records. 

Risk can be measured using a simple formula:

Risk   =   Threats   *    Vulnerabilities

As mentioned previously, a risk involves a potential loss of money, data or life. 

A threat is when assets can be stolen or destroyed through natural disasters, malicious or clumsy employees, or terrorism. 

A vulnerability is a flaw in the system involving unpatched services, human error, or software issues. 

From the equation above, we can conclude that if either the threat or vulnerabilities are completely nothing, the risk level will be 0. Steps for nullifying the threats are outlined in a threat assessment process: 

1) Identify the Threat

2) Gather information about the threat

3) Assess the situation

4) Manage the threat

However, in most cases, the threats can never be fixed. If in this situation, we should turn to solve the vulnerabilities instead. One of the most common ways to do this is by following the CIA triad (link to post here). 

Risks, threats and vulnerabilities. These are just some of the factors that are considered whilst trying to manage the possible risks posed to businesses and software. As technology develops and advances, the attack surfaces for cybercriminals increases whilst attacks seem almost inevitable. Securing assets is becoming an increasingly daunting task as the challenges faced are varying rapidly. And so it is for that reason that these small steps should be taken to safeguard the information that keeps this world revolving.