Choosing the Best Risk-Assessment Approach

Every organization is unique in how it operates and maintains the confidentiality, integrity, and availability of its IT infrastructure and assets. The following are three basic approaches to conducting a risk and vulnerability assessment on an IT infrastructure and its assets:

• Top-down approach A top-down approach requires the existence of the corporate IT policies, standards, procedures, and guidelines. In addition, baseline configurations or minimum acceptable baseline configurations that have incorporated the minimum standard for security are required. With a security framework in place, it is easiest to commence with the vulnerability assessment, starting with these foundational documents. From here, the IT policies, standards, procedures, and guidelines can be reviewed, and then the IT infrastructure and the domains of security responsibility can be assessed according to the defined IT security framework.

  Figure 4.2 depicts a top-down risk and vulnerability assessment approach. Top-down refers to an examination of the organization's business drivers and goals and objectives for conducting the risk assessment. This top-down risk and vulnerability assessment approach is dependent on documented organizational business drivers, goals, and objectives for the risk and vulnerability assessment, and an existing IT security architecture and framework or IT security policies, standards, procedures, and guidelines.

  Figure 4.2. Top-down risk-assessment approach.

• Bottom-up approach If there are no IT security policies, standards, procedures, and guidelines in place, the risk and vulnerability assessment typically begins in the trenches by examining the IT infrastructure in areas such as the seven areas of information security responsibility. IT assets, configurations, and risk and threat analysis is done on the current production IT infrastructure and its assets. The risk and vulnerability assessment continues upward, meaning that the IT security architecture and framework typically becomes an important next step, deliverable as part of the riskassessment recommendations. A bottom-up risk or vulnerability assessment process can be difficult if it does not gain the support of senior management; without that support, you're attempting to work up from the trenches with little help from above.

  Figure 4.3 depicts a bottom-up risk-assessment approach. In many cases, organizations may not have the necessary documentation that the risk and vulnerability assessment can be compared to. In cases like this, conducting a bottom-up risk assessment is common. Prior to beginning the bottom-up risk assessment, the project usually requires the creation of business drivers, goals, and objectives of the risk assessment, and then the creation of an IT security architecture framework. This provides both a baseline definition for the IT infrastructure information security definition as well as the high-level policies, standards, procedures, and guidelines that are needed to implement proper security controls.

  Figure 4.3. Bottom-up risk-assessment approach.

• Hybrid approach In some cases, organizations have some IT security framework in place, but lack the rock-solid implementation of that framework. The risk and vulnerability assessment can proceed in a hybrid approach. This would be the best solution where an organization has some IT security policies, standards, procedures, guidelines, and baselines in place. The vulnerability assessment would begin by examining whatever IT security framework exists and simultaneously conducting the asset valuation and risk and threat analysis steps.

  Figure 4.4 depicts a hybrid approach to risk management. In this case, both a top-down and bottom-up approach to risk management is conducted in parallel. This will assist in the gap analysis for the provided IT security architecture and framework and an assessment of what is really happening with the security controls and security countermeasures, as defined in the organization's policies, standards, procedures, and guidelines. The hybrid approach to risk management is typical for those organizations that have some IT security policies, standards, procedures, and guidelines, and some network configuration, network documentation, and IT asset inventory data.

  Figure 4.4. Hybrid risk-assessment approach.