News

Data and information have become some of, if not the most important assets for businesses in any industry. Data security should be treated with the utmost importance. This is so not only for ICT but any industry that is digitalized. There are as many software reinforcements to protect against cyber attacks almost as much as there are cyber threats in the digital landscape.

Board chairman for ADVANTUM, John Gibson in his presentation to the Caribbean Shipping Association (CSA) outlined the foundation, framework and components of risk management and information security in the maritime industry. However, his points apply to anyone interested in effective risk management for their company.

Steps in successful risk management

The process of effective risk management begins with identifying potential and past risks of data security infringement to your network, analysis of these risks, evaluating them then documenting them. 

Firstly, in identifying risks, ascertain what are your company’s assets (data, application, infrastructure etc), identify potential threats to these assets, then identify what could go wrong and how to prepare. 

Next is analyzing the likelihood of previously identified threats and rating them on scales from 1 to 5 of both likelihood and impact. From ‘rarely’ to ‘highly likely’ and from ‘negligible’ to ‘very severe’. For example, if one of the threats identified is phishing, determine the likelihood of phishing possibly infiltrating your system and its predicted impact. It could be fairly likely and moderately severe compared to something like malware or a password attack which could have moderately likely but very severe.

After careful analysis of threats and the risk of them, an evaluation is necessary to calculate the probability of the previously determined outcomes so that they can be measured, monitored and used to predict future outcomes. An example of a risk assessment evaluation tool is the 5×5 risk matrix.

Finally, documentation of all risk management activity is what helps companies to stay proactive in their effort to fortify their data security. Documentation helps companies to identify which risks to avoid, transfer or mitigate. If the risk outweighs the benefits, anything associated with the risk should be avoided and minimized.

Continuous learning is key to risk management

In the words of John Gibson, “Cyber/Information Security is a journey not a destination. A journey of risk assessment and continuous improvement.” If information gained through risk assessment and evaluation can be useful to other business partners in your industry, this knowledge should be transferred to encourage healthy relations and business economy. With risks that cannot be avoided, measures have to be taken to mitigate their success rate and ensure protection. 

“Cyber/Information Security is a journey not a destination. A journey of risk assessment and continuous improvement.”

John Gibson (CISM, CRISC, CDPSE, CISSp, Security+,)

ADVANTUM helps companies to be proactive about their data security through our Network Managed Services. We also offer a free Network Health Check that assesses your network, internal servers, user devices and overall cyber security health.

Schedule your free Network Health Check with ADVANTUM today or email [email protected] for more information on how we can help you optimize your operations.