ConnectWise Identify®

Cybersecurity risk assessment software

Start Trial

Why understanding your cybersecurity risk is fundamental to your security conversations and solutions

Some key terms are regularly used in a conversation about security: threat, vulnerability, and risk. Do you know the difference between them? They are not interchangeable. To have better security conversations, let’s start with the basics—learning the security vocabulary. Understanding the difference between the three terms will later provide valuable insight into how to address security issues as they arise. So, let’s dive into some definitions:

What is a threat?

According to the National Institute of Standards and Technology (NIST), a threat is any circumstance or event with the potential to adversely impact organizational operations and assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service.
Threat events are caused by threat sources.

A threat source is characterized as:

The intent and method targeted at the exploitation of a vulnerability
A situation and method that may accidentally exploit a vulnerability

In general, types of threat sources include:

Hostile cyber or physical attacks
Human errors of omission or commission
Structural failures of organization-controlled resources (e.g., hardware, software, environmental controls)
Natural and man-made disasters, accidents, and failures beyond the control of the organization

A threat is what we’re trying to protect against.

The Threat Analysis Group defines a threat as anything that can exploit a vulnerability, intentionally or accidentally, and obtain, damage, or destroy an asset.

Visit the Threat Analysis Group >>

A vulnerability is a weakness or gap in our protection efforts

The Threat Analysis Group defines a vulnerability as a weakness or gap in a security program that can be exploited by threats to gain unauthorized access to an asset.

Visit the Threat Analysis Group >>

What is risk?

According to NIST, risk is a measure of the extent to which an entity is threatened by a potential circumstance or event and is typically a function of the adverse impacts that would arise if the circumstance or event occurs; and the likelihood of occurrence. Information security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

There are three accepted ways to handle risk:

Accept it

Acknowledge the risk and choose not to transfer or mitigate

Transfer it

Assign or move the risk to another party

Remediate it

Reduce the likelihood of risk impact

It is best practice to never share the risk. In these cases, no one owns the risk and leaves room for blame.
The Threat Analysis Group defines risk as the potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability.

Risk is the intersection of assets, threats, and vulnerabilities.

What is a risk assessment?

Risk assessment is the process of identifying, estimating, and prioritizing information security risks. Assessing risk requires the careful analysis of threat and vulnerability information to determine the extent to which circumstances or events could adversely impact an organization and the likelihood that such circumstances or events will occur.

Risk assessment is a key component of a holistic, organization-wide risk management process as defined in NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View.

Risk assessments are not simply one-time activities that provide permanent and definitive information for decision makers to guide and inform responses to information security risks. Rather, organizations employ risk assessments on an ongoing basis throughout the system development life cycle and across all of the tiers in the risk management hierarchy—with the frequency of the risk assessments and the resources applied during the assessments, commensurate with the expressly defined purpose and scope of the assessments.

Risk assessments address the potential adverse impacts to organizational operations and assets, individuals, other organizations, and the economic and national security interests of the United States, arising from the operation and use of information systems and the information processed, stored, and transmitted by those systems.

Organizations conduct risk assessments to determine risks that are common to the organization’s core missions/business functions, processes, segments, common infrastructure/support services, or information systems.

Risk assessments can support a wide variety of risk-based decisions and activities by organizational officials across all three tiers in the risk management hierarchy, including, but not limited to, the following:

Development of an information security architecture

Definition of interconnection requirements for information systems (including systems supporting mission/business processes and common infrastructure/support services)

Design of security solutions for information systems and environments of operation including the selection of security controls, information technology products, suppliers/supply chain, and contractors

Authorization (or denial of authorization) to operate information systems or to use security controls inherited by those systems (i.e., common controls)

Modification of missions/business functions and/or processes permanently, or for a specific time frame (e.g., until a newly discovered threat or vulnerability is addressed, until a compensating control is replaced)

Implementation of security solutions (e.g., whether specific information technology products or configurations for those products meet established requirements)

Operation and maintenance of security solutions (e.g., continuous monitoring strategies and programs, ongoing authorizations)

ConnectWise Identify: Risk assessments

ConnectWise Identify is a risk assessment platform based on the NIST Cybersecurity Framework (CSF) that provides a baseline of risk posture to discuss and plan for remediation. The platform is SaaS-based and easy to engage with your clients to risk assessments complete together. The assessment allows you to re-frame the security conversation with your customers or stakeholders, using it as an ongoing method to identify critical risks and create a roadmap for addressing them together. Each assessment includes an outline of top risks, the impact it has on the business, and remediation recommendations from veteran CISOs. Should your customer not accept recommended remediation steps, an attestation letter template is included that you can share with your customers. Once authorized, the risk is transferred back to them if they choose not to implement the recommended remediation plan.

We recommend assessing your entire customer base against the NIST CSF, as it’s the most comprehensive approach to security worldwide. You can send the assessment to each of your customers to monitor and track their progress towards completion, then share the results. The report can lay the foundation for a security-based conversation, complete with remediation recommendations—creating additional revenue opportunities. The dashboard gives you visibility into all your customers from a single application. The dashboard can track all the assessments and provide a historical view reflecting on how your customers are maturing their security posture. There are several out-of-the-box reports which allow you to compare how your customers measure up to other customers in the same industry, size, and geography.

Start your free trial