How do you handle technology risk?

Learning How to Manage IT Risks

Modern computing comes with many inherent risks. To succeed in the digital space, organizations need to calculate, mitigate, and manage these risks effectively. The process of managing risk in information systems is an art form that’s learned, refined, and optimized over time.

However, you can rely on some basic strategies and common best practices to jumpstart your information technology risk management knowledge and ensure you’re on the right track:

1. Identifying general and specific risks
2. Control organizational risks
3. Reviewing organizational risks
4. Implement risk management controls:
   • Supportive
   • Preventative
   • Detection and recovery
5. Communicate and report
6. Establish well-defined policies and procedures
7. Train staff to prepare them for potential threats 

Information Technology Risk Management Planning

Managing risks in the IT sector requires a step-by-step approach. Since most steps are dependent on those prior, this approach is necessary to account for all of your organizational IT risks.

Identifying the Risk

The process of identifying and calculating your organization’s IT risks is a crucial first step in risk management. You can’t avoid or overcome any risks without a comprehensive information technology risk assessment to analyze your assets, weigh your organizational goals, and identify risks. So, this is a natural starting point.

Although it’s not an exact science, there is a standard formula for calculating IT risks. The formula involves three variables—threat, vulnerability, and consequence—which are each assigned numbers based on their severity. After each factor has been rated on a scale from one to ten, the three resulting figures are multiplied to establish a final, numerical value representing your organization’s total IT risk.

Threats, vulnerabilities, and consequences should be understood as:

• Threat – This includes general threats that affect all organizations and unique threats specific to your industry or operational activities. Examples include viruses hidden in spam emails and highly sophisticated ransomware attacks. 
• Vulnerability – This category is used to identify gaps, holes, or flaws within your IT security. Failing to update system software and weak user passwords are prime examples of IT security vulnerabilities. 
• Consequence – Use this category to describe the potential damage a specific threat might cause. Since ransomware attacks have the potential to release confidential data while simultaneously preventing you from accessing your network, these are ranked amongst the highest and most severe consequences. 

For the best results, establish individual risk ratings for as many different threats as possible. This helps you focus on the most probable threats while letting you prioritize risks as needed. Once you’ve established general and specific threats, it’s easier to properly examine and assess your organizational risks. To begin, determine how you want to deal with each threat.

Controlling the Risk

Now that they’ve been properly identified, examined, and prioritized, it’s time to start controlling individual risks. Some threats, like spam emails, don’t require much attention at all. These are automatically handled with network firewalls, anti-spam filters, and antivirus software. Other threats, like DDoS and ransomware attacks, require an immediate response.

Generally speaking, you can control IT risks by employing one of four possible strategies:

1. Risk acceptance – This is best for common, constant risks and those that are automatically controlled. In most cases, you can accept the risk of viruses and malicious software—your firewalls and antivirus scanners will handle many of these threats on your behalf.
2. Risk avoidance – It’s best to avoid risks whenever possible. Implementing multifactor authentication for all users, for example, is a great way to prevent the threat of unauthorized system logins.
   • Additionally, evaluating the types of data your organization stores can help avoid compliance risks with HIPAA (i.e., protected health information), GDPR and CCPA (i.e., nonconsenting collection of individuals’ personal data when they live in protected areas), and PCI DSS (i.e., credit card data)
3. Risk transfer – You can also transfer risk to a third-party, such as a managed security services provider (MSSP). Organizations that outsource their IT security are effectively transferring their risk to another organization. In this case, the MSSP is likely to be better qualified to manage and address modern IT threats.
4. Risk reduction – Risks that can’t be avoided or transferred still need to be reduced. Maintaining up-to-date database backups, for example, is a highly effective way to reduce the risk of unexpected or sudden data loss.
   • An example of compliance risk reduction would be segmenting data environments that contain credit card data to minimize your PCI DSS compliance scope.

These four components aren’t limited to information technology risk management. Most organizations rely on these strategies to mitigate and manage risks, regardless of their industry. When used consistently, they help streamline the entire risk management process for everyone involved.

Reviewing the Risk

The final phase in information technology risk management involves reviewing any risks and threats you’ve previously identified or controlled. Comprehensive risk reviews are meant as a learning experience for the entire team, and they’re helpful when trying to identify any potential recurring or future threats, too. 

If necessary, you might ask your affected employees to provide a report in their own words. To ensure effective and actionable feedback, consider prompting their responses with a series of questions. Potential questions to ask during the risk and threat review period include: 

• Was the risk properly calculated and identified in earlier phases? If not, why was it missed? 
• When did you first become aware of the threat? How did it make itself known? 
• What assets or resources were most helpful when addressing the incident? What kind of tools would help you in the future?
• How did the threat affect you personally? Were you able to fulfill your day-to-day responsibilities, or were they disrupted as a result? 
• What kind of information, if any, would have facilitated a quicker or more efficient response? 
• What did you learn from the incident? 

Asking targeted questions like these can help your team formulate their ideas and provide useful feedback to senior-level staff. Remember that this is a very fluid, evolving, and continuous process. With new and more sophisticated threats emerging every day, the task of identifying, controlling, and reviewing organizational risks is never complete. 

Risk Management Controls

Most organizations employ a variety of policies and techniques—also known as security or risk management controls—to mitigate and manage risks from the start. Employees are required to observe and abide by any established security controls, or they may face termination. 

Information technology risk management and security controls are split into three categories—supportive controls, preventive controls, and detection and recovery controls—with each containing numerous best practices and methodologies.

Supportive Controls

These controls provide an information security risk management framework for identifying network activity, addressing suspicious occurrences, and resolving threats. Supportive controls are a prerequisite for all other controls. They include:

• Identification controls – It’s impossible to safeguard your system without properly identifying users, assets, and resources. Controls like identity and access management provide a unique mechanism for identifying all users, objects, and activities.
• Cryptographic key controls – If your organization uses cryptographic keys, controls are vital for key storage, distribution, and maintenance.
• Security administration controls – These controls are represented through the security configuration of your network, including operating system configuration, app-specific rules, and more.
• System protections and controls – This includes residual information protection, layering, process separation, and other necessary controls to ensure technical integrity.

Preventive Controls

An essential component of managing risk in information systems, preventive controls prohibit or restrict unauthorized system access. They are meant to mitigate risks and threats before they even occur:

• Authentication, authorization, and access controls – These controls facilitate user authentication, file authorization, and data access, respecitvely. Each should adhere to well-defined procedures and policies:
  • Authentication – As an initial step, multifactor authentication should be enabled. More sophisticated controls include configurable restrictions governing permissible login times (e.g., regular hours of operation), IP address restrictions, and more.
  • File authorization and data access – A given user’s network permissions should always be set according to the “principle of least privilege.” This means that user access should be restricted to the minimum necessary for efficient job execution—no more, no less.
• Non-repudiation controls – Maintain a strong sense of accountability with non-repudiation controls. These mechanisms prevent users from denying that they’ve received or sent a specific dataset. 
• Communications controls – Protected communications, including confidential or mission-critical communications, are secured with these controls. In most cases, secure encryption is utilized to protect data from prying eyes.
• Privacy controls – With so much sensitive data at stake, Individual consumers need protections, too. These controls include SSL (Secure Sockets Layer), HTTPS (Hypertext Transfer Protocol Secure), SOC (Service Organization Control), and more. 

Detection & Recovery Controls

Detection and recovery help uncover control violations and suspicious activity occurring within your network. They’re also helpful when restoring system access or lost computing resources.   Detection and recovery controls include:

• Audit controls – While these controls constantly collect and log activity data, they’re primarily utilized after a security incident. Audit trails provide a critical investigatory resource and are required by some compliance frameworks.
• Intrusion and containment controls – Should a cyberattack occur, these controls determine the software or hardware tools used to isolate and neutralize the threat.
• Proof of wholeness controls – Meant to detect security violations, these controls ultimately ensure system integrity.
• Secure restoration controls – These controls provide a clear path for restoring your system to a usable and secure state. Like audit controls, any secure restoration controls are utilized after an incident has occurred.
• Virus detection and eradication controls – Focused strictly on software, these controls drive your organization’s antivirus and, in some cases, anti-malware and anti-ransomware tools. 

Risk Management Best Practices

Although constructing and executing an information technology risk management program can prove challenging, many responsibilities are streamlined by maintaining some common best practices. The best practices your organization adopts should reflect its operations and foster a security-conscious culture.

Communications & Reporting

Be as communicative as possible before, during, and after an incident. Providing clear and timely communications is the key to avoiding confusion and resuming service delivery and productivity. 

Feedback and reports should be submitted shortly following an incident. It’s important to review key events and information while they’re still fresh in everyone’s mind, so you’ll want to begin this process as soon as possible.

While your Chief Information Security Officer and management personnel may wish to review the reports first, collectively discussing them after an incident will improve everyone’s knowledge and help fine-tune your response plan.

Policies & Procedures

Design your internal policies and procedures around your information technology risk management controls. This ensures that your entire staff is familiar with the nuances of risk management and mitigation, including their individual roles in the event of a data breach or incident. 

Remember that your policies and procedures aren’t set in stone. Instead, they need to evolve as new trends and threats emerge. Therefore, your risk assessment, risk management strategy, compliance efforts, policies, and procedures should be subject to periodic reviews and revisions.

Staff Training & Development

Even the best staff members require refresher courses on a regular basis. Whether you’ve recently updated your policies and procedures or if you’ve just onboarded a new employee, staff training and development goes a long way in protecting your network from the inside. 

Some organizations only focus on information technology risk management training for their IT department. However, this perspective ignores the dangers of social engineering, fraudulent email scams, and more that will target nontechnical employees just as frequently. Your entire staff should receive basic cybersecurity training with periodic updates to ensure every member of your organization adopts a security-conscious mindset.

It’s also another way of clarifying individual roles in the event of an incident. Employees who know what to do—and those who have the right skills—can help minimize incident likelihood and respond to incidents quicker. 

Planning for Success with IT Risk Management

Understanding the nuances and strengths of information technology risk management provides your organization with a solid foundation for planning and executing cybersecurity and risk management strategies.  A comprehensive approach minimizes risk and increases controls and visibility to aid threat and vulnerability management.

To find out more about IT risk management, including how we can help you control and mitigate IT risks for your organization,

What is technology risk management strategy?

How to manage technology risks a project management approach?

How can we prevent digital technology risk?

How to manage technology risk in banks?