Identifying Assets for IT Risk Analysis

Any organization that uses information technology should conduct cybersecurity risk assessments from time to time.

Each organization, however, faces its own unique set of security risks and needs to tailor its approach to addressing those specific risks within its risk management processes.

To get started, you first need to identify all your organization’s IT assets, which might be subject to those risks. Then, you can understand the losses you might incur should certain risk events happen and implement prudent steps to keep those risks in check.

IT assets include servers, customer contact information, sensitive partner documents, and trade secrets.

Some assets are physical, such as computing devices; others are electronic, such as data or software. Not all assets are of equal value, either. Some are more costly than others, and some have higher risk exposure.

Each asset has different associated risks, and the importance (the “criticality”) also varies. Your cybersecurity risk management plan will need to account for all those factors.

What is an IT Risk Analysis?

Information Technologies (IT) Risk Analysis is a process of identifying potential threats and vulnerabilities to your IT systems to establish what loss you might expect to incur if certain events happen. Its objective is to help your risk mitigation initiatives at a reasonable cost.

Creating an Asset Register for IT Risk Analysis

Risk assessments typically take one of two approaches. The most common is to start by compiling an inventory of your IT assets; the other method is to consider various scenarios or identified risks that can lead to a compromised asset or breach.

An asset-based risk assessment starts with an asset register or asset inventory. This document specifies all the places where sensitive information is stored and the asset’s estimated value.

So, one of the first things an organization should do when performing a cybersecurity risk assessment is to identify those IT assets.

Creating an asset register helps to clarify what is valuable in your company and who is responsible for it. You need to know what you have and who is in charge of protecting those assets to understand the technology risks to your company entirely.

First, generate the register itself: the list of hardware, software, devices, and databases that store sensitive information.

To do this, consult with the asset owners. An “asset owner” is the person or entity responsible for controlling an information asset’s production, development, maintenance, use, and security.

The asset owners will be familiar with how information moves through their departments. Involving them in the process will be quicker and less intrusive than having your implementation or compliance team go through the entire company.

What are Assets for IT Analysis

It might be that asset owners aren’t sure what assets fall within their responsibility. In that case, recommend that they list all the software they use, the documents in their binders and file cabinets, the employees in the department, and the equipment in their office, among others. Assets might include:

Hardware: Laptops, servers, printers, cell phones, USB sticks, authentication keys.
Software: Purchased software and free software.
Information: Electronic media, such as databases, PDF files, Word documents, Excel spreadsheets, and the like, as well as paper documents. This also could include sensitive data.
Infrastructure: offices, electricity, and air conditioning (the loss of these assets can cause information to be unavailable).
Outsourced Services: Legal services, shipping services, online services (Dropbox, Gmail, and so forth). These aren’t assets in the purest sense of the word, but you control these services the same way as assets, which is why they are often included in an asset inventory.
Human Resources: The employees in each department and their access to the IT infrastructure. These also aren’t assets in the purest sense, but they manage and run your business operations and could potentially lead to a data breach.

Identifying Risks to Your Listed Information Assets

When executing the risk assessment, identify the risks these different types of assets might encounter. The purpose of an information security risk assessment is to help inform stakeholders and decision-makers about the risks they face so that they can consider and support proper risk responses. So, think expansively about what risks might happen and how.

Hardware

With the increase in Bring Your Own Device (BYOD) policies, the hardware risks that affect companies also extend to employees’ personal equipment. At the same time, technology solutions are available to enforce removable media policies, limiting unauthorized extraction of information and malware infection.

Software

The principal risks of your company’s software are its vulnerabilities and the ease with which cybercriminals can exploit them to infect your organization.

Vulnerability scanners can help here by highlighting vulnerable software and pending security updates. Updating your tools and enforcing shadow IT and legacy software policies significantly reduces cybersecurity risks.

Infrastructure

The risk identification process can only be completed by considering infrastructure risks. Physical access controls are crucial in mitigating unauthorized access to critical systems.

At the same time, natural disasters are specific threats that hinge upon local geographic factors. Business continuity and data security policies must be in place to prevent cyberattacks during these critical events.

Outsourced Services

Your organization may rely on various third-party services for its operations. This includes traditional vendors and cloud service providers for your information systems.

Your information security risk assessment should consider your suppliers’ risks and data protection policies to determine their risk level. This activity allows your company to assess third-party risk and the cost-benefit of these services.

Human Resources

Human resources present risks that your company should assess, too. For example, phishing attacks are common cyber threats that depend heavily on the cybersecurity awareness of your employees. Malicious insiders may also exist, so implement security controls to identify and intercept potentially dangerous behavior patterns.

Manage and Mitigate Risks with Help from ZenGRC

Whether your organization has its IT team to conduct an information security risk assessment or outsource the task, ZenGRC can help make the process easier for you.

ZenGRC helps your organization implement, manage, and monitor your risk management framework. Prioritize tasks with automated workflows so everyone knows what to do and when. Insightful reporting and dashboards visualize information, making it easy to share with stakeholders.

On the compliance end, ZenGRC has templates to help your organization streamline the complete lifecycle management of all your relevant cybersecurity risk management frameworks, including PCI-DSS, NIST, HIPAA, and more.