I am working on my first IT Risk Assessment assignment and even though I have the steps required and understanding of the system I am working on, I was wondering if there was a list of generic IT Risk associated with Different IT Systems. That is because one does not have to start from scratch for every assessment he starts. Given that IT Risk Assessments have been conducted for a long time now it is only logical that there must be a list compiled by someone by now that can be used as a reference. For example, if I am working on a client server type of application assessment, I can refer to all risks associated with the client and the server.

Searching google did not result in any result I was interested in but I could be searching the wrong term. I would be grateful if someone could refer me to such a resource.

Thank you.

closed as too broad by Adi, NULLZ, Ayrx, Xander, TildalWave Aug 13 '13 at 8:47

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The correct term I should have been searching for is Threat Catalog. This link is a good source of that. – AdnanG Aug 13 '13 at 14:08

try these guides from BSI who give a nearly complete overview of what a company can do/has to do when running it in any way.

and then you might want to check SANS Reading Room and NIST; i know they published the following:

  • Technical Guide to Information Security Testing and Assessment
  • Small Business Information Security: The Fundamentals
  • Guide to General Server Security

and many mor but dont find any references atm (anbd their website is crap :)

  • @Graham Hill Very clear explanation of IT Risk Assessment. As I suspected the term I should be searching for and that returns the closest results of what I am looking for is the Threat Catalog. For people looking to what I was looking for, the link mentioned in the answer is great place to start with. – AdnanG Aug 12 '13 at 10:27
  • This link is a comprehensive list that I found very useful. – AdnanG Aug 13 '13 at 2:21
  • there is also a (java-based) programm that can be used as a checklist: verinice – that guy from over there Aug 13 '13 at 6:00

As you suspect, this is an issue of terminology. You're probably looking for lists of vulnerabilities, but to be safe I'd like to explain a little bit more.

I'm afraid the whole thing is rather complicated, but worth it in the end!

Before I begin, I should point out there are many different approaches to Information Security that may have their own terminology (I'm an ISO 27000 man myself.) So other answers may use different wording.

So, you have your system that you are working on, and you want to protect it from harm - that's what Information Security is, the systematic protection of information from harm.

For harm to happen, there have to be two things. A "threat", which is someone who will cause harm (either deliberately or by accident), and a "vulnerability" which is a way that the threat can do harm.

Two examples: Your competitor ("threat") accesses your system via SQL injection ("vulnerability") in order to steal your customer list ("harm" - specifically a "loss of confidentiality")

Joe in shipping ("threat") can't figure out how your system works ("vulnerability") and always puts in the wrong value for widget crank setting. ("harm" - specifically "loss of integrity").

You can find lists of threats and lists of vulnerabilities online.

Threats tend to be easier to figure out yourself though - who might realistically want to harm your system? Who might accidentally harm your system?

So mostly you find lists of vulnerabilities. The OWASP top ten is a great place to start.

Where does risk come into this, then? Risk is a measurement that combines the likelihood of a threat exploiting a vulnerability with the harm that would come about if they did.

Risk assessment is used to figure out which threat and vulnerability combinations have a risk higher than you want to accept, so you know that you need to "treat" them - do something about them.

For example, if your competitors are all honest, and you are carefully handling your SQL input, and everyone knows who your customers are anyway, then the risk in example one is very low and so not worth worrying about. (Well, not worth spending money on, at least.)

Alternatively, if Joe is careless and the wrong widget crank setting will make your product catch fire, then the risk is high, and you need to do something about Example 2 ASAP.

Here's the thing though - each risk assessment is pretty much unique because the threats and vulnerabilities you face are in a unique combination. Something like the OWASP list is not a short-cut. It's more a list of things you should check to make sure you haven't missed any of them.

  • Hi Graham, i am interested in how you see risk assessments being conducted. For example, in the current environment, the security maturity is betwixt initial & managed. This poses a challenge since when projects are initiated security is often overlooked and not a consideration. I am attempting to compile a checklist of sorts that will allow the project managers to assess the risks quickly and ensure sufficient investment is sought. Is there a recommended approach? – Motivated Dec 19 '15 at 2:28

If you are working for a medium to large organisation then I've had quite a lot of luck with the ISF Standards of Good Practice (https://www.securityforum.org/). The ISF SoGP provide a "control framework" by which you can measure and evaluate your organisation and the SoGP trace to relevant ISO, COBIT etc standards.

The difficulty with asking for "list of IT risks" is that the threats that your organisation face will be entirely different to mine. So my answer would advice looking at the controls you have in place and the Risks that your organisation face will be where controls are not in place.

  • I totally agree with you that is why I mentioned a generic list that serves like a Risk bank. The correct term turns out to be a threat catalog. – AdnanG Aug 13 '13 at 2:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.