10.security Risk Assessment

Security Risk Assessment
A security risk assessment identifies, assesses, and implements key security

controls in applications. It also focuses on preventing application security defects
and vulnerabilities. Carrying out a risk assessment allows an organization to view
the application portfolio holistically—from an attacker’s perspective. It supports
managers in making informed resource allocation, tooling, and security control
implementation decisions. Thus, conducting an assessment is an integral part of an
organization’s risk management process.
How does a security risk assessment work?
Factors such as size, growth rate, resources, and asset portfolio affect the
depth of risk assessment models. Organizations can carry out generalized
assessments when experiencing budget or time constraints. However, generalized
assessments don’t necessarily provide the detailed mappings between assets,
associated threats, identified risks, impact, and mitigating controls.
If generalized assessment results don’t provide enough of a correlation
between these areas, a more in-depth assessment is necessary.
The 4 steps of a successful security risk assessment
model
1. Identification.
Determine all critical assets of the technology infrastructure. Next, diagnose
sensitive data that is created, stored, or transmitted by these assets. Create a risk
profile for each.
2. Assessment.
Administer an approach to assess the identified security risks for critical
assets. After careful evaluation and assessment, determine how to effectively and
efficiently allocate time and resources towards risk mitigation. The assessment
approach or methodology must analyze the correlation between assets, threats,
vulnerabilities, and mitigating controls.
3. Mitigation.
Define a mitigation approach and enforce security controls for each risk.
4. Prevention.
Implement tools and processes to minimize threats and vulnerabilities from
occurring in your firm’s resources.
What problems does a security risk assessment solve?
A comprehensive security assessment allows an organization to:
• Identify assets (e.g., network, servers, applications, data centers, tools, etc.)
within the organization.
• Create risk profiles for each asset.
• Understand what data is stored, transmitted, and generated by these assets.
• Assess asset criticality regarding business operations. This includes the
overall impact to revenue, reputation, and the likelihood of a firm’s
exploitation.
• Measure the risk ranking for assets and prioritize them for assessment.
• Apply mitigating controls for each asset based on assessment results.
It’s important to understand that a security risk assessment isn’t a one-time

security project. Rather, it’s a continuous activity that should be conducted at least
once every other year. Continuous assessment provides an organization with a
current and up-to-date snapshot of threats and risks to which it is exposed.
At Synopsys, we recommend annual assessments of critical assets with a higher
impact and likelihood of risks. The assessment process creates and collects a variety
of valuable information. A few examples include:
• Creating an application portfolio for all current applications, tools, and

utilities.
• Documenting security requirements, policies, and procedures.
• Establishing a collection of system architectures, network diagrams, data
stored or transmitted by systems, and interactions with external services or
vendors.
• Developing an asset inventory of physical assets (e.g., hardware, network, and
communication components and peripherals).
• Maintaining information on operating systems (e.g., PC and server operating
systems).
o Information about:
▪ Data repositories (e.g., database management systems, files, etc.).
▪ Current security controls (e.g., authentication systems, access control
systems, antivirus, spam controls, network monitoring, firewalls,
intrusion detection, and prevention systems).
▪ Current baseline operations and security requirements pertaining to
compliance of governing bodies.
▪ Assets, threats, and vulnerabilities (including their impacts and
likelihood).
▪ Previous technical and procedural reviews of applications, policies,
network systems, etc.
▪ Mapping of mitigating controls for each risk identified for an asset.
What industries require a security risk assessment for

compliance?
Most organizations require some level of personally identifiable
information (PII) or personal health information (PHI) for business operations. This
information comes from partners, clients, and customers. Information such as social
security number, tax identification number, date of birth, driver’s license number,
passport details, medical history, etc. are all considered confidential information.
As such, organizations creating, storing, or transmitting confidential data should
undergo a risk assessment. Risk assessments are required by a number of laws,
regulations, and standards. Some of the governing bodies that require security risk
assessments include HIPAA, PCI-DSS, the Massachusetts General Law Chapter
93H 201 CMR 17.00 regulation, the Sarbanes-Oxley Audit Standard 5, and the
Federal Information Security Management Act (FISMA).
Organizations often question the need for compliance and adherence to these
regulations. At Synopsys, we feel that an organization is required to undergo a
security risk assessment to remain compliant with a unified set of security controls.
Controls that are implemented and agreed upon by such governing bodies. In fact,
these controls are accepted and implemented across multiple industries. They
provide a platform to weigh the overall security posture of an organization.
Governing entities also recommend performing an assessment for any asset
containing confidential data. Assessments should take place bi-annually, annually,
or at any major release or update.

10.security Risk Assessment

Uploaded by

Copyright:

Available Formats

10.security Risk Assessment

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

10.security Risk Assessment

Uploaded by

Copyright:

Available Formats

Security Risk Assessment

A security risk assessment identifies, assesses, and implements key security

It’s important to understand that a security risk assessment isn’t a one-time

• Creating an application portfolio for all current applications, tools, and

What industries require a security risk assessment for

You might also like