What is the best way to get missing information used for risk analysis

Question

The situation is that I am a software developer working for this company since last January and was asked to do information security for my business unit on the side. I don't have a lot of experience with info-Sec (however, I've always had an interest in it and held a security+ cert) and now I have to do a risk analysis based on the analysis of last year (when I didn't work here yet). The company is quite new to the concept of security, so the previous analysis consists of some threats, frequencies and impacts. What they didn't do last year is naming any controls to mitigate the risks.

I want to determine some controls to add this year, however the more I read/view into the subject matter the more I see I'm missing vital information for doing so.

For example: the course Managing Information Security Threats & Risks (ISO/IEC 27002) mentions the need to know what information there is, who its owners are and what the value of that information is so you can begin estimating the potential loss when a threat occurs. On top of this you need to know what the Exposure Factor is to be able to calculate SLE. Without it I feel that I can't even begin to name controls to apply to threats/risks.

How can someone in my position best get all this information?

Answer 1

You must refere to you immediate manager, and explain him that security is a cost/benefit question. Like in real life: you put a simple lock on your garden shed, a strong door and better knob for hour house and you put you best values in a safe.

You would not use a bank safe to store lawn seeds, but you should not put values in a garden shed. Information security is not different. If you are not sure that doors and windows are all correctly closed you can always start there: identify common and simple security good practices that are not in use in your company and have them applied. But to go further, you must know what is vital for the company and need higher protection.

Real life analogy is often easier to understand for senior managers that are not IT specialists. Do not try to guess yourself, and do not try to steal information form other services, just use the hierarchical path and let the right people take their own responsabilities.