A risk analysis should identify the risks to the network, network resources,
and data. The intent of a risk analysis is to identify the components of the
network, evaluate the importance of each component, and then apply an
appropriate level of security. This helps to maintain a workable balance
between security and required network access.
Asset
Identification
Before the network can be secured, the individual
components that make up the network must be identified. An asset inventory
needs to be created. All of the network devices and endpoints, such as hosts
and servers, should be included in the asset inventory. Once the inventory is
complete, the components can be prioritized and assessed for
vulnerabilities.
Vulnerability Assessment
Once the network
components have been identified, they can be assessed for vulnerabilities.
These vulnerabilities could be weaknesses in the technology, configuration, or
security policy. Any vulnerability that is discovered will need to be addressed
to mitigate any threat that could take advantage of the vulnerability.
Vulnerabilities can be fixed by various methods, including applying software
patches, reconfiguring devices, or deploying countermeasures, such as firewalls
and anti-virus software.
Threat Identification
A threat is an event that can take
advantage of a vulnerability and cause a negative impact on the network.
Potential threats to the network need to be identified, and the related
vulnerabilities need to be addressed to minimize the risk of the threat.