An existential twist on Information Risk Analysis

Information systems and their protection are a major headache for most business owners, managers and executives due to their complexity and the abundance of technical jargon. In this article, we aim to explain Information Risk Analysis in a visual and straightforward way.

1. Taking an existential twist on information risk analysis

A crew of astronauts is heading into space to save humanity. One of them is piloting the spacecraft, alongside a second, the co-pilot, and together they monitor the control panel — a complex system of buttons and sounds displaying the most relevant information for decision-making — to see what is happening in real time. The buttons turn red and the sounds activate, creating a sense of imminent danger: the spacecraft is about to pass through a star storm in a matter of seconds. The difference between the mission’s success and failure is a matter of life and death, or to put it another way: the future of an entire species.

This is a typical scenario in science fiction films. They all follow the same pattern: the protagonist is a leader who makes decisions in times of crisis based on one thing alone: information. Information drawn from multiple sources and supported by a team of specialists. In most cases, the final outcome depends on the screenwriter’s imagination, but in real life the result depends on two factors: creativity and preparation.

The formula seems clear, although finding the right ingredients and the right mix is probably the greatest challenge facing any organisation:

Success = people + information + preparation

What will happen this time if you’re the protagonist? What will happen if you have neither the information nor the team to support you in making a decision? All right, perhaps you’re not piloting a spaceship, nor does the fate of humanity depend on you, but you do have a team and other kinds of responsibilities on your shoulders: perhaps as a manager, entrepreneur, employee or team leader. Who supports you? Who advises you?

Creativity, vision and experience are three qualities that rarely occur simultaneously in one person, which is why they are among the most sought-after. A creative, well-prepared and experienced person is the golden goose of any organisation. The difference between success and failure in business: a sustainable future or a ‘going out of business’ sign.

2. What is risk analysis and why is it important?

Information risk analysis is a process of understanding and assessing information assets, their vulnerabilities and the threats they face, with the ultimate aim of protecting them. This involves taking into account the company’s various systems as well as their relationships with external systems.

The article How to be prepared in a world with 12 cyberattacks per second has already shown us that it is a fact that we are unaware of the value of our assets, their vulnerabilities and all the threats that endanger their security every day.

It is a well-known adage that ‘prevention is better than cure’. International organisations and governments are investing increasingly in prevention to tackle humanity’s major challenges because they are fully aware that there is no better solution: why solve problems when we can avoid them? Preparedness is key.

Being prepared in terms of cybersecurity or information security involves carrying out risk analysis and management. To do this, we must answer many questions:

1. What are our information assets, what is their value, and what are their vulnerabilities?
2. What threats does each of them face, and what is their impact on the organisation?
3. How can we mitigate these vulnerabilities and maximise security against these threats?

For our organisation, carrying out a proper risk analysis does not require a great deal of effort if we are convinced of its usefulness and, above all, if we compare it with the benefits it can bring by helping us to reduce – or even prevent – the impact that threats would have on the business and its continuity were they to materialise.

As Steve Jobs says…

3. Risk analysis in 7 simple steps

There are several methodologies for carrying out a comprehensive risk analysis: Magerit, the ‘Guide for Conducting Risk Assessments’ – NIST, ISO/IEC 27005:2011 or its equivalent Spanish standard UNE 71504:2008, amongst others. And they all share the common recommendation to carry out the following fundamental steps, which we outline here:

3.1. Determining the scope of the risk analysis

Every organisation is a large system divided into smaller, distinct systems that are interrelated. Thus, for example, when setting out to carry out a risk analysis of the entire organisation, we might begin with the Management System, the Commercial System or the Financial System.

This aspect is crucial in terms of its implications and for coherently assessing the investment required to achieve satisfactory results: more secure systems, a more secure organisation.

3.2. Listing assets and assessing their criticality

Information assets are any data or system related to the processing of that data, defined and managed as a single unit that can be understood, shared, protected and utilised efficiently.

Information assets have value, risk, content and life cycles that can be assessed and managed; therefore, their protection is essential. There are various categorisation systems, although one fundamentally useful distinction stands out for its simplicity:

• Tangible: a person, a computer, a smartphone or a server.
• Intangible: a database, an email or data relating to colleagues and customers

Identifying the assets that underpin our company’s processes and services is a crucial step towards gaining the big picture and taking the right actions to protect them. For this reason, during the asset identification stage, the key output is the asset map.

ID

Asset

Responsible

Criticality (1–3)

ID_BD01

Customer bank account database

Sales Director

3

ID_S01

Main server

Systems Director

3

ID_PM01

Prototypes for new flagship launches in 2018

Product Manager

3

3. 3. Identify and categorise the threats to each asset.

The next step is to identify and review the threats to each of the assets. We review their vulnerabilities, the threats to which they have been exposed and the impact that would result should these threats materialise. The assets are thus assessed, thereby determining, by extension, the impact on the processes and services of which they form part. At this stage, we also determine which risks the organisation can accept and which it cannot, and which must therefore be addressed.

3. 4. Identifying vulnerabilities and safeguards

The benefit of listing and assessing each information asset is the opportunity to understand them better – their vulnerabilities – and to remedy their information security by safeguarding them.

Vulnerability = exposure × susceptibility / resilience

We will do the same with our current security measures, to determine whether these vulnerabilities are currently being protected or, conversely, whether new systems and processes need to be introduced to protect them.

For example, realising that there are no backups, that software is out of date, or that the data centre is poorly located are situations that can be easily improved once we are aware of them.

3. 5. Assessing risk

Risk is calculated by estimating the probability – based on our vulnerabilities – of a threat occurring and its impact should that happen. The numerical calculation is more complex, but with these tables we aim to give you a qualitative idea of how we assess the true risk to your information systems:

Table for calculating the probability of threats:

Qualitative Quantitative Description Low 1 The threat occurs once a year Medium 2 The threat occurs once a month High 3 The threat occurs once a week

Impact calculation table:

Qualitative

Quantitative

Description

Low

1

The damage resulting from the threat has no significant consequences for the organisation

Medium

2

The damage resulting from the threat has significant consequences for the organisation

High

3

The damage resulting from the threat has serious consequences for the organisation

Once we have assessed and classified the vulnerabilities, threats and their impact, we can then solve the risk equation:

Risk = threat × vulnerability × impact

With the help of the risk matrix, we can qualitatively assess the type of risk we are facing:

3. 6. Managing risk: Selecting and implementing security measures.

Once we are aware of the risks we face, we are halfway there. The penultimate step is therefore to select the most appropriate measures to eliminate or reduce the risk to a level acceptable to the organisation.

Once identified, these are grouped into programmes and activities, and those responsible for implementing them are appointed.

3. 7. Document the experience so that the lessons learnt remain within the organisation: safeguarding know-how.

Know-how is one of the greatest competitive advantages and, alongside creativity, is what enables our organisations and societies to progress. For this reason, we always recommend creating and updating records of the circumstances the organisation has faced, the alternatives that have worked and those that have not, with a view to improving them.

In this way, not only will we keep our organisation’s knowledge firmly in mind, but we will also make it easier for future staff to understand it.

4. The costs and benefits of a risk analysis

Back in June, in our article How to be prepared in a world with 12 cyberattacks per second, we discussed the average costs of neglecting your cybersecurity:

According to the “Global State of Cybersecurity Survey”, compiled by the consultancy firm PwC, losses incurred by Spanish companies resulting solely from cyberattacks were estimated to average around 1.4 million euros in 2016. If we focus specifically on SMEs, the insurer Mapfre, drawing on various studies, puts this figure at between €20,000 and €50,000 on average.

All these data breaches can entail a high cost for businesses, not only in terms of business disruption, but also in terms of damage to their reputation, loss of trust and even the loss of customers, as well as the cost of recovering the data itself. Although this figure depends on the company’s line of business and the sensitivity of the lost data, the same study estimates that the average cost of recovering a single data record following a cyberattack is €152. This figure is significantly higher than that resulting from system errors or human factors, estimated at between €119 and €123 respectively. These figures give us an idea of the significant impact that losing several thousand records of business-sensitive information can have on a company.

As a company contracting information management and information security services, your cost will depend on the scope of the work and the type of professional engaged. At EPUNTO Interim Management, we have senior executives with over 15 years’ experience in information systems and information security who work on an assignment basis for as long as you need. In this way, we place a temporary executive within your company who will help you understand and resolve your challenges, resulting in a process of problem-solving, learning and management independence.

The benefits of addressing information systems management and information security are clear:

• Avoiding problems
• Respond more quickly and effectively
• Be more efficient: better results with less investment
• Expand and improve our understanding of our organisation and our people
• Be smarter

Conclusions

We began by talking about scenes, or in other words, a succession of frames. The fact is that over time everything changes: processes, assets, services, people, vulnerabilities, threats and their impacts.

Information and technology are sectors that, by their very nature, grow exponentially and at breakneck speeds. For this reason, our constant attention and vigilance are essential to ensure we are prepared in a world where there are 12 cyberattacks per second. It is a process of continuous improvement and, given its technical nature, requires a team with both general and detailed expertise.

My name is Santiago Muñoz, and I am a professional with over 20 years’ experience in ICT. Together with our team, I am responsible for our information security leadership and management service. Let me know how I can help you!