A Guide to the Risk Assessment Process
Define Your Risk Assessment Methodology
Choosing a risk assessment methodology is the first step to take when defining the rules by which an assessment will be performed. Some organizations benefit from a focus on a vulnerability assessment, either to create an initial roadmap or further rationalize patch management initiatives. However, more mature organizations, and those that are bound by stricter compliance, warrant specific risk assessments that include a broad spectrum understanding of policies, business operations, inclusive of technical and non-technical risk.
Create an Asset Inventory
To better understand risks in your environment and the scope of your project is to perform an asset inventory. Although you may have already done this for previous risk assessments, it is important to update this list annually (at least). Often, we need to rely on several sources to obtain a comprehensive list of devices. These devices may include network infrastructure, laptops, servers, and anything with an IP address.
Identify Internal and External Risks
Vulnerability Assessments are an essential part of understanding security risks and are comprised of both internal and external scans. The most valuable internal scans are performed to find areas of risk that automated patching may have missed. Both scanning types are required to fully understand these security risks.
External scans provide insight into a network’s most vulnerable external facing systems. We provide a detailed report of open ports, services, API and Web portals, which may be unintentionally inviting to hackers and threat actors.
Qualify the Risk
With the completion of the vulnerability scanning and risk analysis, we provide an Executive Summary, outlining where resources should be placed to mitigate material risk to the organization. Additionally, an exhaustive technical report is provided, which helps to create a roadmap in addressing and prioritizing identified risks of all types.
Remediation Planning
Risk Assessments are only as valuable as the actions you take after reviewing the report. If your only recourse is to enable automatic updates, the value in a Risk Assessment is likely minimal. Our approach has matured to include the use of a remediation platform to provide your IT team a task-based remediation roadmap. With an annual agreement in our services, we can test over a wide range of time, to help you progressively make the necessary changes.
Proactive Risk Mitigation
FirmGuardian provides a wide array of services to assist customers in preventing security incidents and breaches. Our goal is to keep our clients focused on their business. We leverage managed security services such as SIEM monitoring, alert triage, vulnerability management, as well as security awareness training, and phishing campaigns. These types of concepts are required by most organizations, and our team is here to help augment customer staff to meet these lofty goals.