Security Risk Assessments
A security risk assessment identifies, assesses, and implements key security controls in applications. It also focuses on preventing application security defects and vulnerabilities.
Carrying out a risk assessment allows an organization to view the application portfolio holistically—from an attacker’s perspective. It supports managers in making informed resource allocation, tooling, and security control implementation decisions. Thus, conducting an assessment is an integral part of an organization’s risk management process.
A comprehensive security assessment allows an organization to:
- identify assets (e.g., network, servers, applications, data centers, tools, etc.) within the organization,
- create risk profiles for each asset,
- understand what data is stored, transmitted, and generated by these assets,
- assess asset criticality regarding business operations (This includes the overall impact to revenue, reputation, and the likelihood of a firm’s exploitation.),
- measure the risk ranking for assets and prioritize them for assessment, and
- apply mitigating controls for each asset based on assessment results.
Most organizations require some level of personally identifiable information (PII) or personal health information (PHI) for business operations. This information comes from partners, clients, and customers. Information such as social security number, tax identification number, date of birth, driver’s license number, passport details, medical history, etc. are all considered confidential information.
