Risk Assessment Process

Security Upliftment & Mitigation Strategies

Cybervue Australia is giving the opportunity to small and midsize organisations to shore up and kick start their cyber security defences by offering Essential 8 strategies assessments in line with the Australian Cyber Security mitigation baseline. This baseline ensures
organisations a proactive approach to protect their systems making it difficult to infiltrate and improve upon their security posture.
Organisations that have started their journey towards secure systems in implementing
Essential 8 mitigation strategies can be categorised into 3 maturity levels for each mitigation
strategy.

The maturity levels are defined as:

  • Maturity Level One: Partly aligned with the intent of the mitigation strategy.
  • Maturity Level Two: Mostly aligned with the intent of the mitigation strategy.
  • Maturity Level Three: Fully aligned with the intent of the mitigation strategy.
    Organisation’s are expected to attain maturity level 3 for each maturity strategy as a baseline. The first step for organisations is to conduct a risk assessment and prepare a profile based on the threats of adversaries. Based on this profile, mitigation strategies can be customised that is intended to thwart cyber security incidents or minimise the affects of cyber attacks. Implementation of these strategies will help organisations to build a robust cyber security posture.

Risk Assessment

A security risk assessment is the process of identifying the risks currently facing your
organisation – People, Process and Technology. It is a first step to ensure an organisation is
ready and shielded.

An information security risk assessment will certify an approximate snapshot of the security
risks that threaten to undermine the confidentiality, integrity and availability of your organization’s information assets.

Threat Modelling

Threat modelling is a security process where prospective threats are detected, classified, and examined proactively during design and development in an ideal environment.
Alternatively It can be retrofitted into an existing solution using the adversarial or reactive approach. This holistic process facilitates the detection of threats, the likelihood of occurrence and its severity to reduce the vulnerabilities that infiltrate system controls to gain unauthorised access to the system.

The process of Threat modelling can be categorised into 3 methodologies which can be targeted on Assets, Attackers or Software. Some of the threat modelling methodologies commonly used are STRIDE & PASTA. The ATT&CK framework is a comprehensive compilation of strategies and practices developed by MITRE which is used to assess and define an organisation’s posture.

Penetration Testing

Penetration testing, generally termed as ethical hacking, is usually carried out in different phases: It begins with accumulating information about the target environment and determining the tests required to be carried out. This is known as the reconnaissance phase.

This is then followed by employing techniques to determine the vulnerable spots in the target environment. Phase three involves taking advantage of the identified weaknesses in the system and ensuring continued access to retain access within the target environment. The last phase involves removing all traces of any break-in into the system, so that the breach remains unrecognizable.