/risk-assessment

description: GLBA risk assessment methodology and guidance

GLBA Risk Assessment

Provides methodology and guidance for conducting risk assessments required under the GLBA Safeguards Rule.

Arguments

• `$1` - Assessment phase (required: planning, execution, reporting, all)
• `$2` - Methodology (optional: nist, iso, qualitative, quantitative)

Risk Assessment Requirement

**Authority**: 16 CFR Part 314.4(b) - Safeguards Rule Element #2 **Requirement**: "Identify and assess reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information"

**Purpose**:

• Understand threats and vulnerabilities
• Prioritize security investments
• Demonstrate due diligence
• Support board reporting
• Guide safeguard selection

**Frequency**:

• At least annually
• When significant changes occur
• After security incidents
• When new systems/processes introduced

Risk Assessment Phases

Phase 1: Planning

**Objectives**:

• Define scope and boundaries
• Select methodology
• Assemble team
• Schedule activities
• Gather preliminary information

**Scope Definition**:

1. **Information Assets**:

• Customer information (NPI)
• Systems storing/processing NPI
• Databases and data repositories
• Backup systems
• Cloud services

2. **Physical Locations**:

• Branch offices
• Data centers
• Remote work environments
• Third-party facilities

3. **Processes**:

• Account opening
• Transaction processing
• Customer service
• Marketing
• IT operations

4. **People**:

• Employees with access to customer data
• Contractors and vendors
• Service providers

**Team Composition**:

• Risk assessment lead
• IT/security personnel
• Business unit representatives
• Compliance officer
• Legal counsel (as needed)
• External consultants (if applicable)

Phase 2: Execution

**Step 1: Asset Identification**

**Information Assets**:

• Customer databases
• Transaction systems
• CRM systems
• Document management
• Email archives
• Backup tapes/systems

**Inventory Details**:

• Asset name/description
• Data classification (customer information, sensitive, public)
• Storage location (on-premise, cloud, hybrid)
• Access controls
• Retention period

**Step 2: Threat Identification**

**External Threats**:

1. **Cyberattacks**:

• Ransomware
• Phishing/social engineering
• DDoS attacks
• SQL injection
• Zero-day exploits
• Advanced persistent threats (APT)

2. **Environmental**:

• Natural disasters (flood, fire, earthquake)
• Power outages
• HVAC failures

3. **Third-Party**:

• Cloud provider outages
• Vendor data breaches
• Supply chain attacks

**Internal Threats**:

1. **Insider Threats**:

• Malicious employees
• Negligent employees
• Compromised credentials
• Privilege abuse

2. **Operational**:

• Human error
• Process failures
• System misconfigurations
• Change management failures

3. **Technology**:

• Aging infrastructure
• Unpatched vulnerabilities
• Insufficient capacity
• Single points of failure

**Step 3: Vulnerability Analysis**

**Technical Vulnerabilities**:

• Missing patches
• Weak authentication
• Unencrypted data
• Open network shares
• Default configurations
• Legacy systems
• Insufficient logging

**Administrative Vulnerabilities**:

• Inadequate policies
• Lack of security awareness
• Unclear roles/responsibilities
• Insufficient vendor oversight
• No incident response plan

**Physical Vulnerabilities**:

• Inadequate access controls
• No visitor management
• Unsecured disposal
• Environmental controls lacking

**Assessment Methods**:

• Vulnerability scanning (automated tools)
• Configuration reviews
• Policy/procedure reviews
• Penetration testing
• Physical security assessments
• Interviews with staff

**Step 4: Likelihood Assessment**

**Factors to Consider**:

• Threat actor capability
• Threat actor motivation
• Ease of exploitation
• Existing controls
• Historical incidents
• Industry trends

**Likelihood Ratings**:

• **Low**: Unlikely to occur (0-25% probability)
• **Medium**: May occur (25-75% probability)
• **High**: Likely to occur (75-100% probability)

**Evidence Sources**:

• Threat intelligence feeds
• Industry reports (Verizon DBIR, etc.)
• Incident history
• Security assessments
• Vulnerability scan results

**Step 5: Impact Analysis**

**Impact Categories**:

1. **Financial Impact**:

• Direct losses (fraud, theft)
• Regulatory fines and penalties
• Legal costs
• Remediation costs
• Customer compensation
• Lost revenue

2. **Operational Impact**:

• Business disruption
• System downtime
• Recovery time
• Customer service degradation

3. **Reputational Impact**:

• Customer trust erosion
• Media coverage
• Brand damage
• Competitive disadvantage

4. **Compliance Impact**:

• Regulatory violations
• Contractual breaches
• Certification loss
• Consent orders

**Impact Ratings**:

• **Low**: Minimal impact, easily recoverable (<$50K, <1 day disruption)
• **Medium**: Moderate impact, recoverable ($50K-$500K, 1-7 days disruption)
• **High**: Severe impact, difficult recovery (>$500K, >7 days disruption, regulatory action)

**Step 6: Control Evaluation**

**Existing Controls Inventory**:

**Preventive Controls**:

• Firewalls, IDS/IPS
• Multi-factor authentication
• Encryption
• Access controls
• Security awareness training
• Patch management
• Antivirus/anti-malware

**Detective Controls**:

• Log monitoring
• SIEM
• Vulnerability scanning
• Intrusion detection
• Audit reviews

**Corrective Controls**:

• Incident response plan
• Backup and recovery
• Business continuity plan
• Patch deployment

**Control Effectiveness**:

• **Effective**: Control adequately mitigates risk
• **Partially Effective**: Control provides some mitigation
• **Ineffective**: Control does not mitigate risk

**Step 7: Risk Calculation**

**Risk Formula**: Risk = Likelihood × Impact

**