{"id":4769,"date":"2022-07-08T22:37:39","date_gmt":"2022-07-08T20:37:39","guid":{"rendered":"https:\/\/www.sec4you.com\/?p=4769"},"modified":"2022-11-06T10:05:24","modified_gmt":"2022-11-06T09:05:24","slug":"information-security-risk-survey-for-27001-and-tisax","status":"publish","type":"post","link":"https:\/\/www.sec4you.com\/en\/information-security-risk-survey-for-27001-and-tisax\/","title":{"rendered":"Infor\u00adma\u00adti\u00adon secu\u00adri\u00adty risk sur\u00advey for 27001 and TISAX<\/span>\u00ae"},"content":{"rendered":"

<\/p>

Due to the rapidly incre\u00adasing thre\u00adats to an IT<\/span> ope\u00adra\u00adti\u00adon, every com\u00adpa\u00adny should sur\u00advey and eva\u00adlua\u00adte the rele\u00advant IT<\/span> thre\u00adats with regard to infor\u00adma\u00adti\u00adon secu\u00adri\u00adty. Howe\u00adver, the sel\u00adec\u00adtion of thre\u00adats for the pri\u00adma\u00adry Info\u00adSec pro\u00adtec\u00adtion goals con\u00adfi\u00adden\u00adtia\u00adli\u00adty, inte\u00adgri\u00adty and avai\u00adla\u00adbi\u00adli\u00adty is very com\u00adplex, becau\u00adse the\u00adre are no simp\u00adle thre\u00adat lists, espe\u00adci\u00adal\u00adly for small and medi\u00adum-sized enterprises.<\/p>\n

SEC4YOU<\/span> has taken on this task and crea\u00adted the SEC4YOU<\/span> Infor\u00adma\u00adti\u00adon Secu\u00adri\u00adty Thre\u00adat List 2022. In this artic\u00adle, the most important thre\u00adats are pre\u00adsen\u00adted and explai\u00adned. Rea\u00adders will get a sound over\u00adview of which thre\u00adats you should have secu\u00adred your com\u00adpa\u00adny against, as the\u00adse are now beco\u00adming a rea\u00adli\u00adty for com\u00adpa\u00adnies on an almost dai\u00adly basis.<\/p>\n<\/div>

What does an infor\u00adma\u00adti\u00adon secu\u00adri\u00adty risk assess\u00adment accomplish?<\/h3><\/div>

In addi\u00adti\u00adon to the pre\u00adven\u00adti\u00adon of signi\u00adfi\u00adcant to exis\u00adtence-threa\u00adtening eco\u00adno\u00admic and intan\u00adgi\u00adble dama\u00adges, an infor\u00adma\u00adti\u00adon secu\u00adri\u00adty risk assess\u00adment sup\u00adports the sel\u00adec\u00adtion of sui\u00adta\u00adble Info\u00adSec mea\u00adsu\u00adres that are requi\u00adred to pro\u00adtect the com\u00adpa\u00adny from the dan\u00adgers. If you ope\u00adra\u00adte an ISMS<\/span> accor\u00adding to ISO<\/span> 27001 or TISAX<\/span>\u00ae, the com\u00adpa\u00adny must pro\u00advi\u00adde docu\u00admen\u00adted evi\u00addence of the com\u00adple\u00adte risk assess\u00adment, inclu\u00adding the risk method, the assess\u00adment cri\u00adte\u00adria and the assessment.<\/p>\n<\/div>

Sources of infor\u00adma\u00adti\u00adon secu\u00adri\u00adty threats<\/h3><\/div>

The fol\u00adlo\u00adwing sources were used as the basis for the SEC4YOU<\/span> Infor\u00adma\u00adti\u00adon Secu\u00adri\u00adty Thre\u00adat List 2022:<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>
<\/span><\/div><\/div><\/div>

The 47 Ele\u00admen\u00adta\u00adry Thre\u00adats<\/strong> of the Ger\u00adman Fede\u00adral Office for Infor\u00adma\u00adti\u00adon Secu\u00adri\u00adty (BSI<\/span>).<\/p>\n

A very clas\u00adsic list that lists a varie\u00adty of ele\u00admen\u00adta\u00adry thre\u00adats and deals inten\u00adsi\u00adve\u00adly with the aspects of sabotage\/terror and espio\u00adna\u00adge. Unfort\u00adu\u00adna\u00adte\u00adly, this publi\u00adca\u00adti\u00adon does not ade\u00adqua\u00adte\u00adly assess modern cyber\u00adat\u00adtack vectors.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/span><\/div><\/div><\/div>

ENISA<\/span> Thre\u00adat Land\u00adscape 2021<\/strong><\/p>\n

A valuable infor\u00adma\u00adti\u00adon secu\u00adri\u00adty assess\u00adment by the Euro\u00adpean Cyber\u00adse\u00adcu\u00adri\u00adty Agen\u00adcy that ana\u00adly\u00adzes cyber\u00adse\u00adcu\u00adri\u00adty trends on 115 pages, describ\u00ading the nine most signi\u00adfi\u00adcant thre\u00adats and pro\u00advi\u00adding detail\u00aded recom\u00admen\u00adda\u00adti\u00adons on how to avo\u00adid them.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/span><\/div><\/div><\/div>

2022 Cyber\u00adth\u00adre\u00adat Defen\u00adse Report<\/strong> by CyberEdge Group<\/p>\n

This report high\u00adlights tech\u00adno\u00adlo\u00adgies and their resi\u00adli\u00adence to cyber\u00adth\u00adre\u00adats, in addi\u00adti\u00adon the report pro\u00advi\u00addes an excel\u00adlent assess\u00adment of 12 cyber\u00adth\u00adre\u00adats that no risk assess\u00adment should be without.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Clear distinc\u00adtion bet\u00adween hazard, mea\u00adsu\u00adre, effect and effec\u00adti\u00adve\u00adness test<\/h3><\/div>

In an infor\u00adma\u00adti\u00adon secu\u00adri\u00adty risk assess\u00adment, the CISO<\/span> is requi\u00adred to actual\u00adly assess the threats\/hazards and only later deter\u00admi\u00adne the action and its poten\u00adti\u00adal impact, here using a sim\u00adpli\u00adfied prac\u00adti\u00adcal exam\u00adp\u00adle of \u201cmal\u00adwa\u00adre\u201d to delinea\u00adte the terms:<\/p>\n