Welcome to today's Tech for Business podcast.
I am Kelsey, a member of our marketing team sitting down with Matthew,
our GRC analyst and VC so.
Today we're asking at the very burning questions all about risk assessments.
We're going to kick it off right away with what is a risk assessment?
A risk assessment is the most fun you can have in the cybersecurity space.
The short version is it's a evaluation of your organization from a what could
possibly go wrong paranoid scenario, which is for those of you who've listened to
the other podcasts, the reason that I was brought in for this one because I'm the
paranoid one.
So really what you're trying to do is you're trying to come up with every
scenario that could feasibly impact your business and list them in the
short version.
It's just listing them one after the other.
Nice, making us to do list, but a scary to do list.
A scary to do list, yeah, exactly.
Nice.
So then who needs to make the to do list?
Again, short answer everyone.
If you run a business, heck, even at home, I mean, we do these types of things
without thinking every day.
Most of the time people have something like this in their head.
If you've put security cameras up at home, it's because you believe there is a
risk and you want to be able to track that.
You've got locks on your doors.
That's part of a risk assessment saying you don't want someone to be able to get
in.
We're doing the same thing at that cyber security level.
So do you have all the things in place that you need to?
A risk assessment some kind of covers things like mitigations as well, which
we'll get into later.
But because of that, everyone needs one.
And even if you aren't really aware that you're doing it, you're probably doing
some things already, so why not document them?
Why not better track that?
What you're saying that everybody needs to document what they do?
Yes.
Mind blowing.
So then why are risk assessments done?
So there's a bunch of reasons why they're done.
The primary one is because I'd like to say it's because people really get into it
and they want to get this information down.
But I do think the primary reason people do them is because of their
GRC requirements, whether it's an order from on high, from the executives,
whether it's something to do with their compliance requirements, maybe there's a
NIST requirement, a CMMC, FFIDC, a lot of different industries, banking especially,
have the very about how often they have to do a risk assessment as well as what
the risk assessment has to include.
So they're generally done for a compliance reason.
I would like to say that they're done because it helps people sleep at night
because that's why I like doing them.
I like having all of that available.
And once you have that listed down, you can see it.
You have a better view of your entire situation.
Makes sense.
So then when should they be done?
Only when the people tell you to or are you saying all the time?
So when the people tell you to, they'll tell you generally that there is a
recurring requirement.
In some cases, that's yearly.
In some cases, it's quarterly.
Personally, I believe it should be continuously.
It should be a living document.
And in much the same way as some of us may keep a grocery list, you should have
this document just radiate your fingertips to be like, oh, I wonder if this
could happen to us.
And then you throw it on the risk assessment for us, for the team or yourself
to do a follow up on it and kind of dig in deeper to what it is.
There's a saying that I think of with this that is most often the best time
of planetary is 20 years ago, but the second best time is today.
And that's when it comes to the cyber security side of things, that feels very
relevant to me because there is so much of this that I think as an industry, we
should have been pushing and really, really building towards back in the
early 2000s that we want.
And so a lot of people can feel like this is a thoroughly overwhelming thing.
But just starting it, just getting a couple of things down, having anything at
all is a great start.
And if you don't have it already, you should be doing it this minute.
Pause this.
Go start it.
Pause the super short podcast.
Go start.
Or just walk away with your phone.
100%.
Yeah, that works too.
Either one.
And so then finally, how is a risk assessment done?
So if you just paused and came back to this after filling it out and now have
to figure out how to do it, my bad.
However, there's generally two different ways of doing it.
And these come from, I mean, there's multiple different ways of doing it.
There's no right way or wrong way.
It's about what works the best for you.
There should be also probably multiple people or there probably will be
multiple people in the organization who want to do it different ways.
There's no right way or wrong way.
Just make sure everyone's getting it done in a way that you're not doing it twice.
So the two ways I tend to think about it are top down or bottom up.
And that's based on what view of the organization you have.
So generally when I'm talking with people who are in executive or leadership
positions, they'll want to do it from a top down perspective.
They'll want to say what things can impact the business.
At such a high level that it could break us.
So if you're doing that, we're talking about generally environmental things.
We're talking about what happens if, say, the building is unavailable.
Or are you going to go next?
Do you have a secondary location set up?
Can everyone work from home?
Those types of risks are a top down risk because they don't really require anything
on the business side of things, on the technical side of things to be looked at.
You're talking purely about what would impact businesses as a whole.
The bottom upside of things is the inverse of that.
So we start with where is our data located?
What happens if that asset, say it's a server, goes fully offline?
What can we do?
In those cases, this is when I mentioned before we start talking about mitigation.
When you do a bottom up one, you'll often find that there are things in place already
to fix that.
Maybe you're doing things like you have secondary servers in place, high availability,
which means that if one server goes down, another one spins up very quickly to take over.
This can result in little to no downtime from an end user perspective.
Those types of things are mitigations on risks you find.
You should document all of this.
Even if you've mitigated already, you need to make sure that you've listed this is why we did it.
And I said earlier there are times when you'll find you're doing it without thinking.
And that's what this is.
Maybe you've got three or four copies of your backups.
That is you mitigating a risk of what happens if you lose your backups.
So when you're doing it from these two directions, you come from very different mindsets.
And starting from one versus the other is what's going to help you really get as much as possible
because you don't want just one person coming in with one mindset of what a risk is and then
working to that.
You want to come up with as many as you can.
You also really want to dig into things that you don't want to think about.
If you find yourself trying to avoid a topic, dig into it deeper.
A lot of people don't like to or don't want to think about insider threats.
Insider threats in some, sorry, malicious threats, depending on what your terminology here,
account for up to a fifth of all attacks across some industries.
So make sure you're not just saying what happens if something that we are outside of our control
happens like a server goes down or we lose internet for an hour.
Think about things of what happens if there's someone who's maybe unhappy is actively selling
credentials.
There is a lot of different things that can happen.
And the more thorough you are filling this document out, the better plan you're going to have going
forward to try and resolve them.
So once you fill that all those, do some research.
See what you have in place.
Find what your mitigating items are.
And at the end, you'll basically say, here's what we have.
Here's what we're afraid of happening.
And here's what we've done to try and fix it already.
I am really speeding through this.
There's a bunch of different ways to do it.
But if you do have any questions, please reach out.
And once you've done it all, you'll be able to say, we're comfortable with this risk with the
things we've done to mitigate it, or we aren't comfortable, at which point you can say, then
we need to do more.
Or we're okay with that.
And you end up with a list of things you have done.
You end up with a list of things you want to do more on.
And as you get that list, you can start prioritizing how critical those items are to you.
A risk assessment is basically that.
Overarchingly, more than anything else, it is a evaluation of things that can be done.
Things that can happen to your organization that you are comfortable or uncomfortable with
where you currently sit in opposing that.
And until you've got the full list in place as much as you can and really evaluate what's in place,
you're not going to be able to answer that question.
Ignorance is not bliss, especially not when it comes to things that you can't control.
And a risk assessment tries to cover as much of that as possible.
You wrapped it up perfectly, right?
When you were like, contact us for more permission.
I was like, yeah, you can just do marketing's job.
But thank you so much for sitting down today answering the very high level.
As you alluded to, if anybody listening has any questions at all,
we are here to help even if you're not located nearby.
We'd still love to chat with you.
Reach out to us at info at cit-net.com.
Or you can head out to our website, cit-net.com, backslash podcast.
Thanks again. We'll be back next week with another episode.