Security+ Sy0301: Risk Assessment Steps

Front 1

Step One

Back 1

System characterization - set the scope of the assessment by defining boundaries of the IT system and capturing the resources and information that the system comprises. You need to determine system and data criticality and sensitivity at this stage.

Front 2

Step Two

Back 2

Threat identification - review the history of system attacks. create a threat statement listing the potential threat sources associated with the IT system under review

Front 3

Step Three

Back 3

Vulnerability identification- focus on flaws or weakness in system security procedures, design, implementation, or internal controls that could result in a security breach or a violation of the system's security policy. Gather information from previous risk assessments and audits and from software that tests system vulnerabilities. Compile a list of potential vulnerabilities describing their location, and whether the vulnerability level is high, medium, or low

Front 4

Step Four

Back 4

Control analysis- analyze existing and planned controls against system vulnerabilities. Review technical, managerial, and operational controls in terms of their ability either to prevent or detect violations of security policy.

Front 5

Step Five

Back 5

Likelihood determination- consider how capable the threat source is of carrying out the threat and the level of motivation the source has to do so. consider the nature of the vulnerability and the effectiveness of current controls against the threat that exploits it.

Front 6

Step Six

Back 6

Impact Analysis- done in terms of a loss of integrity, availability, or confidentiality of the system or system data.

Front 7

Step Seven

Back 7

risk determination- the level of risk to the system is determined based on the likelihood of attack, the impact a violation would have, and the adequacy of current or planned controls.

Front 8

Step Eight

Back 8

Control recommendations- controls that you recommend at this stage in the risk assessment process should aim to reduce risks to acceptable levels. Controls should also be appropriate to the organization's operations. consider the effectiveness or compatibility of the options, the operations impact they may have, the safety and reliability of the options, and their compliance with organizational policy, regulations, and legislation.

Front 9

Step Nine

Back 9

Results documentation- consolidate the results of risk assessment in an official report or briefing. This document will be used to help management make informed decisions around security policy, budgeting, and other security-related issues.