Summary

Because of the increase in risks, threats, and vulnerabilities and other exploits in IT infrastructures, IT security professionals are not able to address known vulnerabilities in time before the next unknown vulnerability appears. This catch-22 scenario requires IT security professionals and management to make prioritized decisions pertaining to which IT assets get funding for security controls and security countermeasures first. Many IT budgets are limited, especially for investments in securing the IT infrastructure. This limitation forces organizations to prioritize funding for securing their most critical IT and data assets first. In other organizations, new laws, mandates, and regulations are requiring organizations to invest in information security and IT security infrastructure.

Risk assessments allow the organization to assess from a criticality and importance factor which IT and data assets must be protected and secured more than others. In addition, a risk assessment will allow an organization to make tactical and strategic business decisions pertaining to securing its most valuable IT and data assets. Without a risk assessment, IT management would be guessing as to how best to spend its funds on security for its IT and data assets.

Finally, a risk and vulnerability assessment allows an organization to understand the roles, responsibilities, and accountabilities for the IT professionals and IT security professionals in an organization. Risk and vulnerability assessments typically find gaps and voids in the human responsibility and accountability for dealing with risks, threats, and vulnerabilities. Given the magnitude of the IT security responsibility, segregation of duties and dissemination of these duties to IT and IT security professionals is a critical follow-up step in many IT organizations to properly address the human responsibilities and accountabilities for ensuring that the availability, integrity, and confidentiality of IT infrastructure components and assets are met.

The dissemination of roles, responsibilities, and accountabilities throughout the IT infrastructure or areas of risk management can be clearly defined after the risks, threats, and vulnerabilities are identified within an organization’s IT infrastructure.