How to Conduct a Comprehensive Cyber Risk Assessment for Your Organization

Nearly all risk assessments try to figure out what you could lose. How much cash, how much brand value, how many records. That’s information, but it’s only part of the equation. The other half is the likelihood of an attack, and the size of that risk is something you can’t calculate in a spread sheet. Assessing cyber risk needs to cover both the technical side of how intangible assets might be targeted, and the people side: who might be inclined to go after you, and who within your organization might make that easier for them to accomplish.

Build Your Asset Inventory First

You can’t determine risk for assets you haven’t identified. First, create a map of all the components used to store or transfer sensitive data, such as endpoints, cloud environments, databases, third-party connections, and the individuals who have access to all this information.

Classify assets based on sensitivity and importance to the business. A poorly configured server in a non-essential system poses a different risk compared to the same poorly configured server containing customer payment information. The more sensitive or crucial an asset to your business operations, the higher the level of Inherent risk, i.e. risk before implementing any safeguards, and vice versa.

Consider third-party risks as well. External suppliers, subcontractors, and associates who interact with your systems raise your risk exposure beyond what your internal precautions can protect against. Evaluating third-party risk calls for a separate process rather than just adding a few questions to a supplier survey.

Treat Human Risk as its Own Category

This is the area where most audits and assessments of existing security posture fall short. Employee behavior like clicking, sharing, and recycling are often relegated to a footnote under "access controls" or "training & awareness". No more than a caveat. "Oh, and we do our best to change behavior, too."

Employee behavior is a primary risk category. It’s the human connection to virtually all security incidents. And it certainly deserves its own review, mapped to real risk data.

Here are three simple questions that every organization should be able to answer:

1. Who clicked on a simulated phishing email in the last 90 days?
2. Where are password behaviors on the risk register?
3. Where and how are shadow IT practices making employees more susceptible to attack?

Questions like these don’t come from HR. They are critical security posture data points. They also constitute the bedrock of evidence that any security awareness program is compliant.

Finally, the most basic security countermeasure of all against human risk, the security awareness training program, must be audited for its output, not just its input. The question isn’t whether training exists. The question is whether it’s acting to reduce human susceptibility. Two very different things. Security teams that use the best human risk management platforms can automate behavioral tracking, deliver targeted interventions based on actual risk profiles, and measure whether training is working, rather than assuming it is.

Map Threats Against Your Actual Environment

Once you’ve figured out what you’re protecting, you need to figure out who and what poses a threat to it. These can be external attackers, internal bad actors, competitors, and nation-states. You can use different methodologies like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to help identify threats. For instance, "what are the threats to a software application" is a different question from "what are the threats to an executive in the public eye." Threat modeling is common in software development and can be applied to many areas of business.

This is most useful when applied in concert with vulnerability and exposure identification. You can use technical tools/companies to scan for known vulnerabilities. Run that in parallel with a loose qualitative assessment of human system weaknesses: phishing responses, passwords in a .txt file on a shared drive (or similar), exfiltration of sensitive information via employees for relatively mundane applications in some industries. Social engineering vulnerabilities don’t require a zero vuln posture. They do need one rushed employee and an existing relationship with their bank’s wire transfer service.

Document Residual Risk and Assign Ownership

Once you implement the controls, there is still some level of risk that you will face, which is called residual risk. It is important to document what that risk looks like and who owns it.

For instance, frameworks like ISO/IEC 27001 have you put someone in charge of the risk assessment, treatment process, and the acceptance criteria. ISO also expects you to have a management system and to continuously improve it. It’s a good approach to take if you need to demonstrate to regulators, clients, or insurance underwriters that you’re doing a good job, but a lot of companies go overboard.

Name an owner for each of the significant risks. If someone isn’t responsible for it, it won’t get managed.

Move From Annual Audits to Continuous Assessment

A snapshot-in-time evaluation of your risk exposure is quickly rendered obsolete the minute it’s delivered. Zero-day attacks, AI-forged phishing scams, and the fast-pace of today’s business world, all changing the way you interact with partners and vendors means your vulnerabilities are constantly in flux.

Continuous Monitoring is not here to replace the deep-dive assessment, but to act as its early warning system. Alerts when new vulnerabilities are published, behavioral analytics that tip you off to unknown anomalies, and regular business impact analysis meetings are the tripmine alerts that keep Executive views fresh.

The organizations that treat risk assessment not as a report from last year, but like a current business process, are the ones that catch threats before they become breaches. The report isn’t important, it’s the reduced exposure it’s supposed to represent that counts.