The first step to building an effective incident response plan is to perform a risk assessment. This involves identifying potential threats, vulnerabilities, and impacts to your organization. The goal is to get a clear picture of the risks you face so you can prioritize and focus your incident response capabilities.
Why is a risk assessment important?
A risk assessment provides the foundation for your incident response plan. It helps you understand what kinds of incidents could realistically occur and how severe their impact might be. This allows you to direct your efforts and resources towards developing incident response capabilities that align with your actual risks.
Without a risk assessment, you could end up with gaps in your incident response plan. For example, you may be overprepared for certain low probability risks while underprepared for other more likely risks. Conducting a thorough risk assessment at the outset helps avoid this mismatch and ensures your plan addresses the threats most pertinent to your organization.
How does a risk assessment work?
Typically, a risk assessment involves four key steps:
- Asset identification – Inventory assets, data, and systems that may be impacted.
- Threat identification – Identify potential threats such as malware, hackers, system failures.
- Vulnerability analysis – Evaluate which assets/systems are vulnerable to identified threats.
- Risk analysis – Assess the overall likelihood and potential impact for identified risks.
The end result is a list of risk scenarios (e.g. data theft due to a phishing attack) ranked by their risk level. This provides a prioritized basis for determining where to focus your incident response capabilities.
What are the key benefits of a risk assessment?
Conducting a risk assessment provides the following key benefits for building an effective incident response plan:
- Informs incident response priorities and resource allocation based on actual risks.
- Identifies previously unknown threats and vulnerabilities.
- Justifies investments in incident response capabilities.
- Provides inputs for defining incident response policies and procedures.
- Establishes a baseline for evaluating future changes to the risk environment.
In short, with a risk assessment you can build an incident response plan tailored to your organization’s specific threat landscape rather than using a generic one-size-fits-all approach.
What are the key elements of a risk assessment?
While risk assessment methodologies can vary, most contain the following high-level elements:
Asset inventory
Document hardware, data, applications, third-party connections, and other assets that are within the scope of the assessment. This provides the foundation for evaluating vulnerabilities and impacts.
Threat identification
Identify potential threats such as malicious actors, insiders, system failures, and natural disasters that could lead to incidents impacting priority assets.
Control analysis
Evaluate existing controls and processes that help mitigate the likelihood or impact of identified threats. This could include things like firewalls, encryption, access controls, backups, etc.
Vulnerability analysis
Identify vulnerabilities that could be exploited by threats, bypassing or circumventing existing controls. Common vulnerability sources include unpatched systems, misconfigurations, risky user behavior, etc.
Likelihood determination
Estimate the likelihood of identified threat/vulnerability pairs based on factors like threat capability, vulnerability ease of exploit, and effectiveness of current controls.
Impact analysis
Estimate the detrimental business impact if identified risks were to materialize, such as financial losses, reputational harm, service disruptions, etc.
Risk determination
Combine likelihood and impact estimates to determine overall risk scores that allow different risks to be compared and prioritized.
Risk reporting
Document the assessment methodology, key findings, prioritized risks, and recommendations for risk mitigation strategies and incident response improvements.
Who should be involved in a risk assessment?
Conducting an effective risk assessment requires participation from stakeholders across the organization, including:
- Information security team – Provide expertise in threats, vulnerabilities, controls, and risk assessment techniques.
- IT staff – Help identify critical IT infrastructure and dependencies that could impact incident response.
- Business unit leaders – Provide perspectives on potential business impacts and risk tolerances.
- Operations staff – Help assess vulnerabilities in business and manufacturing processes.
- Legal/compliance team – Provide inputs on legal/regulatory compliance risks and requirements.
- Executive leadership – Set risk assessment scope and may help review critical threats and impacts.
With input from across the organization, you can develop a more complete and actionable view of the risk landscape.
Should I use qualitative or quantitative assessments?
Risk assessments can take a qualitative or quantitative approach. Each has pros and cons:
Qualitative risk assessment
- Uses descriptive scales like High/Medium/Low for threats, impacts, and overall risk.
- Relatively quick and easy to complete.
- Outcomes can be subjective based on individual judgements.
- Difficult to compare or aggregate risks consistently.
Quantitative risk assessment
- Uses numerical values and calculations to assess risk factors.
- Data-driven and provides objective results.
- More complex and time consuming.
- Requires robust data inputs which may be lacking.
Qualitative assessments are a good starting point for initial or periodic risk assessments. For managing risks on an ongoing basis, quantitative methods provide more analytical rigor.
What are the steps for conducting a risk assessment?
The typical risk assessment process includes the following steps:
- Plan and prepare – Define objectives, scope, methodology, participants, timing, and resources.
- Identify assets – Inventory hardware, software, data, and other technology assets along with business processes, 3rd parties, and personnel.
- Identify threats – Document potential threats such as cyber attacks, system failures, unauthorized access, fires, storms etc.
- Evaluate controls – Catalog existing security controls, safeguards, backups, auditing, and other mitigating factors.
- Analyze vulnerabilities – Identify gaps or weaknesses in controls that could be exploited by threats.
- Assess likelihood – Estimate the probability of threats successfully exploiting vulnerabilities based on existing controls.
- Assess impact – Evaluate the potential business impact if threats were to materialize, considering costs, operations, reputation, etc.
- Determine risk – Calculate overall risk scores by combining likelihood and impact ratings.
- Prioritize risks – Rank risks from highest to lowest to guide incident response plans and investments.
- Document results – Record findings, risk register, recommendations, and next steps in a risk assessment report.
This process results in a comprehensive view of the organization’s risk landscape, threats, vulnerabilities, and controls to inform incident response planning.
What are some best practices for risk assessments?
Follow these best practices when conducting a risk assessment:
- Perform assessments periodically as threats and technology evolve.
- Use a defined risk model and consistent scoring methodology.
- Involve stakeholders from IT, security, business units, and leadership.
- Leverage threat intelligence resources to identify relevant threats.
- Focus assessments on high value and sensitive assets.
- Review existing audit and security findings for risks.
- Document all key assumptions, data sources, and decisions.
- Present results in both technical and business contexts.
What are the limitations of risk assessments?
While invaluable for incident response planning, risk assessments do have some limitations including:
- Static point-in-time evaluations that can become outdated.
- Require regular updates to account for evolving threats and vulnerabilities.
- Results are influenced by the skills of those involved.
- Can miss risks due to incomplete asset inventories or threat intelligence.
- Subjective human judgements needed for qualitative assessments.
- Quantitative assessments depend heavily on data quality.
Despite these constraints, risk assessments currently provide the most effective way for organizations to understand and prioritize their key incident response requirements.
Should I use threat modeling?
Threat modeling can provide a more structured way to identify security threats during a risk assessment. It involves creating detailed diagrams or architectures of systems, then analyzing those models to find potential weaknesses. Some of its key benefits include:
- Provides a systematic process for finding threats and vulnerabilities.
- Can uncover overlooked risks not found through checklists or questionnaires.
- Allows assessing threats against proposed systems in development.
- Diagramming provides a concise way to document security architectures.
- Tool support automates parts of the analysis process.
Threat modeling does require skilled resources to create and assess the diagrams. For complex or critical systems, the additional rigor can uncover risks that might otherwise be missed. When used together, threat modeling and risk assessments provide complementary approaches for gaining a comprehensive view of the potential threats facing an organization.
How often should I conduct risk assessments?
Most experts recommend conducting a formal risk assessment at least annually. More frequent assessments may be warranted when:
- Introducing major new systems, technologies or processes.
- Responding to a major incident or breach.
- Facing a shift in the regulatory or threat landscape.
- Mergers, acquisitions or divestitures occur.
- New threats or attack types emerge.
- Significant network or system architecture changes occur.
Ongoing risk monitoring is also important to identify emerging issues between formal assessments. This continuous view of risks allows incident response plans to be updated in a timely manner.
What are common challenges when conducting risk assessments?
Risk assessments can encounter the following challenges:
- Scoping issues – Failure to include all relevant assets, systems and processes.
- Limited participation – Not involving subject matter experts from IT, security, business units, etc.
- Poor data quality – Lacking comprehensive and accurate data on threats, controls, and vulnerabilities.
- Unstructured processes – No defined risk model, approach, or consistent analyses.
- Resource constraints – Inadequate time, money, or personnel devoted to assessments.
- Outdated results – Assessments not performed frequently enough.
- Biased outcomes – Risk ratings reflect inherent biases rather than objective data.
Utilizing risk assessment best practices, and securing leadership support, can help avoid many of these pitfalls.
Conclusion
An effective risk assessment provides the foundation for building a targeted, cost-justified incident response capability tailored to your organization’s unique threat landscape. While requiring time and expertise, a risk-based approach avoids wasted resources on generic plans or functions that may not match actual incident response needs. With appropriate scoping, participants, techniques, and executive buy-in, the risk assessment process can produce actionable results that inform the first and most critical phase of developing a comprehensive incident response plan.