Threat Management and Risk Mitigation


Risk management is the identification, evaluation, and prioritization of risks (defined in ISO 31000 as the “effect of uncertainty on objectives”) followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities. Risk management’s objective is to assure uncertainty does not deflect the endeavor from the business goals.

There are 5 steps to Risk Management:







When preparing to conduct a risk assessment for your organization, I will consider these nine key areas:

  1. Third Party Vendors: How secure are their operations? How much visibility and insight do you have? Who is the cyber security point of contact for each vendor you work with?
  2. Security Management: Who is in charge of implementing strategy? What strategy is being implemented? Has it been effective? What changes should be made?
  3. Security Architecture: What programs are currently in place? How effective are they? What measures can be added? What tools are available to teach employees about the current architecture?
  4. Emerging Technologies: What can be added to enhance security? How secure are new technologies that are currently in place? Where are these technologies applied – physical server, virtual server, cloud?
  5. Regulations and Policy: What is the current security policy? How does it impact overall security? What updates can be made?
  6. Incident and Crisis Management: How are you monitoring for incidents currently? How well is it working? How are incidents resolved today?
  7. Identity Management: What authentications are in place? What password protections are available?
  8. Awareness & Education: What programs are in place to educate employees about cyber security? What tools and guidelines are given to employees?
  9. Threat & Vulnerability Management: What systems are there to identify and remediate vulnerabilities and threats?

Click here to contact me and discuss a Threat Management or Risk Mitigation review of your environment.