Cybersecurity Risk Assessment

The advancement of technology and its increased usage by almost every person and organization has come with its own benefits and risks. As digital transformation progresses and the use of technology widens, many types of potential technology risks surface, which nowadays, have become one of the biggest security problems for different organizations and individuals around the world.

In order to protect all the valuable assets and data from potential cyber threats, organizations need to take preventive measures, including here a cybersecurity risk assessment. The application of technologies, processes, policies, and people for the protection of internet-connected systems, networks, and users, is what we know as cybersecurity. As cybersecurity is vulnerable to a variety of risks, a cybersecurity risk assessment is needed.

What is cybersecurity risk assessment?

Cybersecurity risk assessment is the process of identifying, analyzing, evaluating, and prioritizing various risks and vulnerabilities that could affect assets. Assessing and estimating the risks helps organizations use the appropriate cybersecurity controls to treat the identified risks and reduce security flaws. 

The process of cybersecurity risk assessment includes the identification of assets prone to being affected by cyber-attacks (e.g. hardware or consumer data), the potential risks, and the selection of proper security controls. 

What are the main types of cybersecurity threats?

Any malicious effort to breach the systems of an organization or individual is considered a cybersecurity threat or a cybersecurity attack.

Cisco has listed some of the main types of cybersecurity threats which include phishing, ransomware, malware, and social engineering.

1. Phishing is a type of cybersecurity attack that happens when an attacker sends a fraudulent message or email to trick a person into sharing sensitive information. Phishing is usually used to steal data, such as; login credentials, credit card numbers, or other valuable data. The attacker tries to confuse the potential victim receiver by sending an email that resembles emails from reputable or legitimate sources. 
2. Ransomware is a type of malware designed to encrypt and lock a system or file, making them unusable and inaccessible until a ransom is paid. The attacker does not damage the files or systems, however, they threaten that personal data will be published unless a ransom payment is done. 
3. Malware or malicious software refers to intrusive software, such as viruses, spyware, and ransomware, designed to harm and damage another software or hardware to gain unauthorized access.
4. Social engineering is a form of attack that uses psychological manipulation to make people reveal confidential information.

In 2020, Specops Software found that in 11 different areas of business, 54% of business owners have seen a rise in cybercrime threats since working remotely became “the new normal” due to COVID-19. 96% of business owners reported ransomware attacks to be the biggest cybersecurity threat, followed by crypto-jacking as the second biggest threat, and phishing as the third listed.

For more information on this topic, you can visit “Top 5 Types of Security Threats to Look Out for in 2022”.

To be prepared in case of any threating situation, it is very important that the entire organization, including all the employees, be aware and trained on how to protect themselves from different types of threats.

Individuals can help their organizations by learning more about cybersecurity and acquiring competence and expertise on Cybersecurity Management which can be achieved through training. 

Cybersecurity Management enables individuals to:

1. Protect the organization’s data and privacy 
2. nhance skills to establish and maintain a cybersecurity program
3. Implement best practices regarding cybersecurity
4. Improve security system and business continuity for their organizations
5. Identify and recognize security vulnerabilities
6. Help organization avoid data breaches and loss
7. Reduce long-term costs 

The other three main standards on security and privacy that should be considered are:

1. ISO/IEC 27001 Information Security Training
2. ISO/IEC 27002 Information Security Training
3. ISO/IEC 27701 Information Privacy Training

Top sectors affected by cybersecurity threats

Even though every organization is at risk of being attacked, there are some sectors that are more vulnerable and get targeted by cybersecurity threats more often.

The result of a variety of research that has been conducted in recent years, shows that the most vulnerable industries to cyber threats are small businesses, healthcare institutions, government agencies, energy companies, and higher education facilities. This is mostly due to the amount of sensitive and personal data kept by these industries.

Similar results have also been published by the European Union Agency for Cybersecurity (ENISA), who have found that in the European Union during April 2020 and July 2021, the most affected sectors were public administration, digital service providers, the general public, healthcare, and financial institutions.

Considering that cybersecurity is closely related to privacy and information security, organizations need to be aware of potential risks beforehand. For more information regarding these three areas please visit PECB - Data Privacy, Information Security, and Cybersecurity: What Your Business Needs to Know.

How to conduct a cybersecurity risk assessment?

In order to understand how impactful and threatening a risk can be, and then to be able to control it, a cybersecurity risk assessment is needed. However, conducting a cybersecurity risk assessment can be a very tricky and complicated process.

Of high importance is understanding, following, or creating a structure which would help mitigate the cybersecurity risk assessment process: 

1. Deciding and determining the scope of the risk assessment is essential to identifying which assets and processes are the most important, identify the risks, assess their impact, and define risk tolerance levels. 
2. Identifying assets, potential threats, and possible challenges.
3. Determining the likelihood of risks and their impacts. In cybersecurity risk assessment, likelihood indicates the chance that a threat will exploit an existing vulnerability. On the other hand, impact or consequences, refer to the harm expected to happen as a result of an attack. 

After assessing the likelihood and impact, it is essential to determine and prioritize risks. This can be done by using a risk matrix where the risk level considering the level of likelihood against the level of impact.

There are five levels categorized of both likelihood and impact. 

Likelihood levels can be ranked as: 

• Rare 
• Unlikely 
• Possible 
• Likely 
• Highly likely

Levels of impact are scaled in five categories: 

• Insignificant
• Minor
• Moderate
• Major
• Sever

A risk matrix visualizes risks in diagram and categorizes them from “low” to “very high”. This helps organizations decide which risks should be prioritized and which ones stand within the tolerated risk level. 

After all risk scenarios are identified, they should be documented in a risk register.

Cybersecurity risk assessment best practices

Although we have now gained a general knowledge on the process of conducting a cybersecurity risk assessment, we have to understand that the process is not as simple. That is why it is important to also study best practices used for a successful cybersecurity risk assessment. 

Cybersecurity risk assessment best practices, depending per requirement or framework, often include; creating a risk management team, cataloging information assets, assessing and analyze risks, setting security controls, and monitoring or reviewing their effectiveness.

A more detailed approach of the risk assessment implementation can be provided by the specific cybersecurity risk assessment framework. 

Cybersecurity risk assessment framework

Every organization varies on size, complexity, and sectors, hence, the scope of cybersecurity assessment should comply with the specific organization needs and objectives. A cybersecurity risk assessment framework is a set of standards, guidelines, and best practices that provide appropriate structure and methodology that comply with the mentioned characteristics.

A well-known cybersecurity assessment framework is ISO/IEC 27032, an internationally recognized standard that provides cybersecurity guidelines regarding the sustainability and protection of organizations or individuals. 

How can PECB help?

PECB offers qualitative and professional trainings which help individuals become more competent and achieve required knowledge to implement cybersecurity programs. PECB also provides certification against internationally recognized standards.

For further information please visit PECB Training Events or contact us by email at marketing@pecb.com.

Contributors to the article:

Vlere Hyseni, PECB's staff

Albana Iseni, PECB's staff