Fresh Thoughts #11: Risk Assessment Mistakes & Do You Need More Security?
- Newsletter
The Biggest Mistake I Made on My First Risk Assessment
The biggest mistake I made on my first risk assessment?
It was too detailed.
I documented every possible way to break into the system.
Now I:
- Decide which information is sensitive - and matters
- Start with the most sensitive data
- List where it is stored and processed (minimise these)
- List the ways to get to the sensitive data (minimise these)
- Remove duplicate steps
- Start with the path with the fewest steps
- Group possible attacks into families
- Mitigate the attacks at a group level
- Repeat for the longer routes and reuse existing mitigations
- Repeat for less sensitive data
highest risk first + reusing mitigations = efficient risk assessments
5 Questions To Know if You Need More Security
Think of your most sacred and sensitive data.
Think about where it's stored...
- Can a hacker get here?
- What would they need to do?
- How easy is it to do those things?
- What defences are you relying on? (Are they implemented?)
- How can you strengthen those defences?
A recent example: Customer data on an e-commerce site.
- Can a hacker get here?
- Yes.
- What would they need to do?
- get into the admin account
- ...
- How easy is it to do those things?
- use leaked, stolen, reused passwords
- guess the password based on the most common passwords
- ...
- What defences are you relying on?
- people not losing or reusing passwords (not very robust...)
- ...
- How can you strengthen those defences?
- strengthen account management and password security:
- make passwords a part of your acceptable use policy
- all team members have unique accounts
- use separate accounts for admins functions and everyday work
- use a password manager so your team doesn't need to remember passwords and can easily create unique ones
- use 2FA, so even if the password is lost, there is an extra line of defence
- strengthen account management and password security:
Some easy, quick wins here. Time to strengthen your security.
April 19, 20222 Minutes Read
