2021! A (Wild) Year in Review
We wanted to wrap up the year reflecting on the positive: customer stories that knocked it out of the park, the big wins, and revisiting…
Information security risk assessments are vital to the health and longevity of every organization, but they can often be a confusing process with terms that vary across industries and organizations. One of the major gaps within information security risk assessments is the lack of information regarding threat actors and threat events. Without these two key pieces of information corporations and enterprises are wasting valuable time, money, and other resources on extensive information security risk assessments and walk away without knowing any details about the very real threats to their business.
Risk: The chance of an event occuring that negatively impacts business decisions, goals, and objectives combined with the impact it would have on the business.
Risk = threat X vulnerability
Threat Event: A negative event that can lead to an undesired outcome.
Threat Actor: The person, organization, or entity responsible for the threat.
Vulnerability: A weakness that can be exploited in order to attack your company.
Information Security Risk Assessment practices vary among industries and disciplines, which results in multiple approaches and methods for risk assessments. A recent study by Guate Wangen et al. in the International Journal of Information Security titled “A Framework for estimating information security risk assessment method completeness” discovers and analyzes several gaps in the surveyed methods. One of their findings was, “that there is little conformity on how to conduct a threat assessment and what it should contain.” Many Risk Management companies are negating the largest piece of the information security assessment puzzle when they don’t address the threat events and threat actors.
In order to have a fully completed information security risk assessment that will allow your company to create effective policy and procedures you must first have an awareness of the threat events putting your business at risk. The only way to mitigate against upcoming threats and prepare for future risks is to know where your business is vulnerable. Threat events vary greatly depending upon your specific industry and business, but the most common threat events according to The Department of Public Safety and Emergency Preparedness of Canada are:
Crucial information to your information security risk assessment is knowing your potential threat actors. Many information security risk assessments do not include the threat actor in the assessment, which makes protecting your business with an accurate risk management process impossible. There are numerous threat actor categories, but a few of the most common to put your business at risk are:
A robust information security risk assessment is the only way for a corporation to rest assured that their risk management plan is functional and not just theoretical. Without information concerning the company's specific threat events and threat actors the company is left vulnerable to vicious and costly attacks.
With LogicGate's Information Security Risk solution you'll have access to a repository of control frameworks to ensure compliance with industry best practice standards. You’ll be able to map controls to business processes, assets, and risks and identify deficiencies versus standard frameworks. Ultimately, you’ll be able to easily identify gaps in controls, pinpoint your vulnerability exposure, and send updates through remediation workflows to improve control effectiveness.
In our most recent episode of GRC & Me, LogicGate CEO, Matt Kunkel and the GRC Pundit himself, Michael Rasmussen discuss agility and resiliency and…
As we enter into a new year, Matt Kunkel, CEO of LogicGate shares his thoughts on the items the GRC community and the business world…