Risk Assessment in IT System Development

Risk Assessment Methodology

• Risk assessment is the first process in the risk management methodology, determining the extent of potential threats and risks associated with an IT system throughout its SDLC.
• The output of this process helps identify appropriate controls for reducing or eliminating risk during the risk mitigation process.

Risk Factors

• Risk is a function of the likelihood of a given threat-source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization.
• Likelihood of a future adverse event is determined by analyzing threats to an IT system in conjunction with potential vulnerabilities and controls in place.
• Impact refers to the magnitude of harm that could be caused by a threat's exercise of a vulnerability.

Risk Assessment Steps

• The risk assessment methodology encompasses nine primary steps:
  • Step 1: System Characterization
  • Step 2: Threat Identification
  • Step 3: Vulnerability Identification
  • Step 4: Control Analysis
  • Step 5: Likelihood Determination
  • Step 6: Impact Analysis
  • Step 7: Risk Determination
  • Step 8: Control Recommendations
  • Step 9: Results Documentation

System Characterization

• Step 1 defines the scope of the effort, identifying the boundaries of the IT system, resources, and information that constitute the system.
• Characterizing an IT system establishes the scope of the risk assessment effort, delineates the operational authorization (or accreditation) boundaries, and provides essential information.

System-Related Information

• Identifying risk for an IT system requires a keen understanding of the system's processing environment, including:
  • Hardware
  • Software
  • System interfaces (e.g., internal and external connectivity)
  • Data and information
  • Persons who support and use the IT system
  • System mission (e.g., the processes performed by the IT system)
  • System and data criticality (e.g., the system's value or importance to an organization)
  • System and data sensitivity
• Additional information related to the operational environment of the IT system and its data includes:
  • Functional requirements of the IT system
  • Users of the system (e.g., system users who provide technical support to the IT system; application users who use the IT system to perform business functions)
  • System security policies governing the IT system

Learn about the risk assessment process in IT system development, including identifying potential threats and vulnerabilities, and implementing controls to mitigate risk.