Identifying, prioritizing and deciding how to deal with risks (Part I)

Learn about the first two steps of an effective risk assessment process: what to protect and what to protect it from
Learn how to identify and prioritize the main risks or problems you might be facing
Be able to understand and specify what assets need to protected, such as key people, processes, systems and data
Get familiar with the threat modelling process, allowing you identify the unwanted events that can threaten your assets

First stage of the risk management process is called the risk assessment, which guides you through identification and prioritization of the main risks and problems you might be facing.
It is important to understand and specify WHAT needs to be protected. The identified elements are called assets, and the process of identifying them is known as asset enumeration. These assets can include people, processes, systems, data, or anything else that needs to be protected. After identifying all relevant elements, you can collect them in a list of assets.
During the identification process, it is good to establish a security perimeter by defining what’s “inside” and “outside” the organization’s responsibility to protect, ensuring key people, processes, systems, and data stay within the perimeter. By doing so, critical assets can be better protected and the security measures simplified.
After identifying the assets, it is important to understand WHO can do WHAT to the assets. The potential unwanted events that could impact the assets are called threats, and the process of identifying them is known as threat modelling. It is important to conduct the modelling in a collaborative way, as the perception of threats is not the same for everyone. After identifying all relevant threats, they can be collected in a list of threats.