An IT risk assessment reviews and analyzes the IT organization from a risk perspective—the possible threats it faces, risks associated with inherent vulnerabilities, loopholes that can lead to breaches, and the impact that these can have on the entire organization. In short, an IT risk assessment is critical to setting the tone for the overall security policy of any organization.
Most organizations are aware of the need for an IT risk assessment, but when conducting one, often overlook some common pitfalls that may impact the assessment. Primarily, it is important to differentiate between a traditional IT risk assessment and security risk assessments. The former covers general IT-related risks such as outages and downtime, hardware crashes, etc. The security risk assessment, on the other hand, reviews issues related to specific security-based threats. If both are generically combined, with no exclusive focus on either, the organization runs the risk of applying a generic risk model to the ever-evolving IT security environment, making both ineffective.
The top five pitfalls to avoid include:
Ignoring third-party risk: Any IT risk assessment should assess the level of IT risk posed by vendors, since organizational data interacts with their solutions and infrastructure. It is important to know, for example, where a vendor is storing sensitive data—on a private or public cloud—and the details of the access protocols associated with it. This is especially true for vendors providing business sensitive services and with access to confidential data, like payment solutions, IT support services, etc.
Conducting a non-contextual assessment: IT risk assessments must be viewed within a business context. When analyzing breaches and vulnerabilities, it is essential to see these in the context of the information assets and how an attack on them will impact business. This kind of in-depth and actionable analysis will help develop an effective assessment that provides a window into not only technology flaws, but also business vulnerabilities.
Viewing IT risk assessment as separate from enterprise risk management: IT risks cannot be treated as a discrete aspect of security not related to the wider enterprise. Incorporate IT risk management into the enterprise risk management system in order to understand how IT risks affect and are affected by other security and business risks.
Infrequent assessment: Conduct frequent and regular IT risk assessments to keep abreast of evolving threats and to identify the possibility of breaches before they occur. An organization that is aware of its IT risks can move swiftly to address those before they develop catastrophic consequences. This is a more proactive approach to take, rather than waiting for a vulnerability to make itself felt and then scrambling to patch the flaw at that point.
Relying mostly on automated assessment tools: While automated tools facilitate efficient assessment and a continuous monitoring of IT assets and infrastructure, manual pen testing is required for a more in-depth and comprehensive assessment. Some risks, specifically business vulnerabilities, can only be identified by manual intervention.
Do keep in mind, however, that an IT risk assessment is only the first step. Unless followed up by remediation, the entire exercise is pointless. This means that risk remediation should be an important consideration when you plan your budget, to ensure that Risk Assessment does not remain a ‘tick in the box’.
Finally, let us not forget a huge, though often overlooked, benefit from an IT risk assessment. Not only does it help identify breaches and plan remediation measures, it simultaneously offers an in-depth analysis of the IT organization, and recognition of opportunities for improvements within the existing IT environment, demonstrating how technology can help enhance business, reduce costs, and maximize organizational efficiency in the long run.
is the Senior Vice President & CTO, IMSS, at Happiest Minds Technologies. With over 20 years of experience in the IT Security domain, Priya’s expertise spreads across Cyber Risk, Cloud Security, Data Privacy and Protection, Access Governance, Risk, and Compliance. She has carved her way up to become one of the women leaders representing the management council of the organization. Priya was also recognized as the “Visionary Women Leaders 2019” by the Business APAC magazine and received the “Women in Tech” award at the 19th Edition of the Asia Pacific HRM Congress for 2021.
Priya’s current work involves planning and developing Next-Gen Managed Security Platforms offering Proactive Threat Detection, Security Automation, Data-Centric Security, and Governance for the new age of digital customers. Her sensibility and compassionate nature have made her one of the organization’s most respected and followed leaders.
