How to assess your IT risks

IT risk analysis is becoming more and more important in the business world. It”s hard to imagine a company getting by today without IT and especially without web-enabled devices. Despite all its advantages, however, the use of digital infrastructure harbours risks which, in the worst case, can threaten the entire company. Risks include cyber attacks such as DDoS, malware and phishing, as well as simple power outages at data centres – not to mention risks relating to applications maintained by third parties. Equally dangerous is improper use of devices by employees: the so-called “human factor”.  

To specialist article: What role does the “human factor” play in IT security? 

IT risk analysis: step by step 

Step 1: Identify risks 

To reduce risks, you first have to identify them. Make a schematic diagram of your company’s IT, taking care to include the "shadow IT". This refers to semi-official devices, workarounds and other adaptations used by employees. Don’t forget the update status of devices and other possible security gaps. 

Remember, for IT risks, the chain is only as strong as its weakest link. That means you need to identify the weak links. Go through all systems and data flows and make a note of every risk. This will quickly give you an idea where the greatest vulnerabilities lie. Risks can be of varying kinds: 

• Technical risks: old devices or operating systems with security gaps 

• Physical risks: water damage in the data centre or vandalism 

• Procedural risks: human error or lack of awareness of risk management 

Step 2: Structure risks

You will probably be amazed at how many risks you identify. But that’s completely normal. The next step is to structure these risks. There are two important scales:

1. How severe is the potential damage? 

2. How likely is the risk to occur? 

There are risks that threaten the company’s existence and others that would have little effect if realised. For example, connecting private devices to the company’s WiFi network is a serious risk. If such a device is not secure, attackers may, in an extreme case, have access to all the company’s customer data. The second scale assesses likelihood of occurrence. For example, it is clearly less likely for a sandstorm to damage a server than for an employee to accidentally download malware. 

Step 3: Prioritise risks

After you have identified and structured the risks, they must be prioritised. A points system is a good approach. Rule of thumb: a risk with high potential damage and high likelihood of occurrence should be at the top of your list of priorities.  

However, the assessment should include an additional factor. Some risks are easy to rectify, while others are nearly impossible. For example, a software update is quick to install, while replacing an old core system requires a successor and strategic planning. This leads to the adapted rule of thumb: even if a risk is unlikely and could only cause minor damage, if it can be rectified in 10 minutes, do it. 

Step 4: Define measures 

After priorities have been established, it is time to define specific measures, processes and a timeframe. Even if the most logical option initially seems to be to take care of high-priority, easily resolvable risks first, a good plan should always include short-, medium- and long-term elements. Don’t forget that many risks also require repeated action, such as software updates.  

Along with measures, define processes and integrate these into the existing process landscape. Provide all employees with training and do not make IT security the responsibility of a single department. The more employees are aware of the issue, the better your company will be protected. 

Step 5: Prepare an emergency plan 

Don’t forget to prepare an emergency plan. While risks can be minimised, often they cannot be wholly neutralised. You should have emergency plans and backup systems ready for these cases. Once an incident has already occurred, it’s often too late for a structured response. That’s why it’s important to clarify in advance how the company will continue to operate in such a situation or how infrastructure and business activities can be restored. 

Notwithstanding all your planning and your security culture, take care not to compromise efficiency and paralyse business processes. IT security should be an organic part of your activities and the practised experience of all employees, not an annoying task that complicates every process.