A Practical Guide To Writing Great Risk Security Assessments From Industry Experts

4 min readDec 30, 2024

Recently, I was tasked with the security evaluation of several new tools my team was considering. To ensure a thorough and robust assessment, I had a pretty productive chat with my good pal, Mahir Chowdhury, a seasoned risk, compliance, and assurance professional. He generously shared a template he’d developed based on best practices and his extensive experience with risk security assessments (RSAs). This template, combined with my own insights and our collaborative efforts, forms the foundation of this article.

The goal? To provide a practical and systematic approach to conducting comprehensive security assessments, ensuring that adopting new tools doesn’t inadvertently open your organisation to security risks. This approach incorporates key elements from established security frameworks, including the CIA triad (Confidentiality, Integrity, and Availability), NIST Cybersecurity Framework, and ISO 27001, to provide a holistic view of security.

1. Know Your Tool: Background and Usage

Before diving into the assessment, it’s crucial to understand the tool inside and out. This includes:

Purpose: What specific needs does it address?
Vendor Reputation: Are they reputable? What security measures do they have in place?
Architecture: Is it cloud-based, on-premise, or a hybrid?
Existing Documentation: What security-related information does the vendor provide?
Usage in Other Companies: How do other organisations leverage this tool? Does this reveal any availability concerns?

This preliminary investigation illuminates potential vulnerabilities and informs subsequent assessment stages. It also starts to address the “availability” aspect of the CIA triad by understanding the tool’s operational resilience and potential points of failure.

2. Map the Workflow: Incident Management Process

Visualising how the tool will be used within your organisation is critical. A process map outlining incident management steps provides clarity and identifies potential security bottlenecks. Consider the following stages:

Incident Identification & Logging: How will incidents be reported and logged within the tool?
Incident Assessment: How will the tool be used to triage and prioritise incidents?
Response: How will the tool facilitate communication and collaboration among incident responders?
Monitoring and Reporting: What kind of metrics and reporting capabilities does the tool offer?
Closure: How does the tool ensure proper documentation and closure of incidents?

By mapping this process, you can pinpoint areas where sensitive data might be exposed or require additional security measures. This aligns with the “confidentiality” aspect of the CIA triad and the “Identify” function of the NIST Cybersecurity Framework.

3. Unmasking the Threats: Risk Identification

This stage involves brainstorming potential risks associated with the tool. Consider the following:

Data breaches: Could unauthorised access, data leaks, or exfiltration occur?
Insider threats: Could malicious or negligent employees misuse the tool?
System vulnerabilities: Are there any known exploits or weaknesses in the tool’s software or infrastructure?
Integration risks: Could the tool’s integration with existing systems create new vulnerabilities?
Compliance violations: Does the tool adhere to relevant data protection regulations (e.g., GDPR, HIPAA)?

Leveraging security expertise and threat modelling methodologies can help identify and prioritise these risks effectively. This aligns with the “Protect” function of the NIST Cybersecurity Framework and risk assessment principles from ISO 27001.

4. Building Defences: Mitigation Strategies

Once risks are identified, it’s crucial to develop and implement mitigation strategies. This involves designing and implementing security controls across three main categories:

Preventative controls: Measures taken to prevent incidents from occurring in the first place (e.g., access controls, encryption, strong authentication).
Detective controls: Measures that help detect incidents as they happen (e.g., intrusion detection systems, security information and event management (SIEM) tools, log monitoring).
Corrective controls: Measures taken to contain and remediate the damage caused by an incident (e.g., incident response plans, data backups, disaster recovery procedures).

The bow-tie method, a risk assessment framework that visualises the pathways leading to and from an incident, can be instrumental in identifying and implementing appropriate controls. This also addresses the “integrity” aspect of the CIA triad, ensuring data remains accurate and unaltered. These mitigation strategies align with the “Detect,” “Respond,” and “Recover” functions of the NIST Cybersecurity Framework.

5. Achieving Compliance: Meeting Security Standards

This stage focuses on ensuring the tool complies with relevant security standards and regulations. This might involve:

Data encryption: Implementing encryption for sensitive data at rest and in transit.
Access control: Enforcing role-based access control (RBAC) to restrict access to sensitive information.
Regular audits: Conducting periodic security audits and vulnerability scans.
Vendor due diligence: Ensuring the vendor meets your organisation’s security requirements.

By addressing compliance requirements, you minimise the risk of legal penalties and reputational damage. This aligns with the control objectives and controls from ISO 27001.

6. Weighing the Scales: Cost/Benefit Analysis and Final Opinion

The final step involves summarising the assessment findings, including:

Advantages and disadvantages of the tool: A balanced perspective on the tool’s benefits and drawbacks.
Required work: Outlining the effort needed for implementation and ongoing maintenance.
Cost/benefit justification: Assessing the financial implications of adopting the tool, considering both costs and potential benefits.
SME opinion: Providing an expert opinion on the tool’s overall security posture and suitability for the organisation.

This summary aids decision-makers in making an informed choice about adopting the tool.

By following this structured approach and incorporating elements from established security frameworks like the CIA triad, NIST Cybersecurity Framework, and ISO 27001, organisations can effectively assess and mitigate the security risks associated with new tooling, ensuring a smooth and secure integration. This approach offers a practical roadmap for navigating the complexities of tool adoption in today’s security-conscious environment.