Introduction to how to write a security risk assessment

I’m going to be taking you through the next six steps on how to write a security risk assessment.

Now you may be thinking before we get into this video whether or not it is for you. Well, it’s intended for you if you are novice or an experienced practitioner, looking after a small business or a large enterprise. The intention is this video to have some value for you.

The six steps that we follow need to be done in sequence. That means we need to go through each step before we begin the next step and the six steps are over there.

We look at:

1. Assets,
2. threats to those assets,
3. the vulnerability of those assets to those threats which then gives us a calculation which we create as a
4. risk status
5. we then think about the impact of an event happening.
6. finally we consider whether any measures, any countermeasures required to help mitigate or eliminate those risks all together. 

1. Assets

So let’s start then by considering number one assets. What are our assets? Let’s identify them and list them down. Now I have been relatively helpful here by listing down some typical asset types. Number one in any organization I would say is people. And for me I would put me down at the top of the most important asset in any organization. Why wouldn’t you? So the first consideration is probably around people. Then we think about other asset types which are physical. These could be things like equipment or buildings. And then we have other assets which are intangible. Things like information and reputation.

2. Threats

Now let’s think about number two threats. Broadly speaking, assets have three different kinds of threats to the number one. Natural disasters. These could be anything from a tsunami to a flood. . . Cyber attacks. Things such as denial of service. And number three, physical attacks. And very often think people think about physical attacks as things such as terrorist incidents. So let’s then look at the. Idea of terrorist incidents and their impact on people, the asset type of people.

3. Vulnerability

And let’s give it some context. Let’s say we are running a public venue and we are considering the threat type of terrorism to our asset type people. That is our vulnerability. What is the vulnerability of our people to a terrorist attack in a public venue? Here we have an image of a public venue mock up and there are three different kinds of contexts we might want to think about in the public venue. Number one, who is in attendance? For example, if you have loyalty or some sort of VIP, the likelihood is they will attract a greater likelihood of a terrorist attack. Or it could be you just have a huge number of people in one place that makes it more attractive to a terrorist attack. Then we have the consideration of pedestrian access. How the people get in and get out of our public venue. And finally, we could well have a public venue which has access to public transport nearby. That could be trams, it could be buses, it could well be a rail.

Let’s drill down further then and look at the idea that we have a public venue. And let’s look at the vulnerability of people in a public transport venue. So let’s look at a railway station. What are the typical kind of vulnerabilities we could think about. They could be things like a drone attack. So a terrorist might use a drone to land on our railway station or they could actually launch a drone attack from the roof of the railway station. It could well be the access and egress points, particularly vulnerable to terrorist attacks. It could well be that we have large quantities of people gathering outside. The railway station or the railway station itself, the structure is particularly vulnerable or attractive to terrorist attacks.

4. Risk Status

Let’s consider then our risk status. We’ve thought about our assets we’ve thought about. It’s vulnerable they are to a terrorist attack. How do we come up with this concept of a risk status? Risk status is put simply vulnerability multiplied by threat. And we do this by giving each kind of vulnerability, asset vulnerability a weighting against a threat type which we also give a weighting.

So the lowest score we can give is number one which means for example something is highly resistant to a terrorist attack or perhaps we give it a level a score of number five which means it’s got really no resistance to a terrorist attack and equally we give a terrorist attack a weighting from one to five. Number one, no information indicates a terrorist attack at all. Number five then there is specific information of a terrorist attack.

Risk Status and railway station

Let’s briefly revisit our railway station and focus on one particular vulnerability which is structure. So let’s consider our structure at the railway station and let’s say The structure is super tough and it’s very high resistance and there is no information whatsoever out there suggesting that a terrorist attack is likely on our structure. We would then do a bit of math and give ourselves this formula. High resistance, therefore the number one, no information whatsoever about a terrorist attack. Therefore give that a value of number one. One times one gives us one. So this then means that a structure at our railway station has a super low likelihood and a risk status of really low number one.

And we then think about that in this context. We have all of a different possibilities and we would say that the structure sits there in the very low stability bracket category low zero to five. An attack is highly unlikely on our structure. And you see here how we would then moderate and increase and graduate as the risk increases. We give it all of these different statuses. So for example severe and critical substantial depending on the risk appetite of the organisation they may want to do something about those particular risks.

Okay so far so good we have gone through assets we’ve gone through threats we’ve looked at vulnerabilities we’ve looked at risk status. We only have two more steps to go. That is to look at the impact what if an attack such a terrorist attack did happen and finally what measures could we put in place to counter the likelihood of that attack.

5. Impact

Let’s look then at impact. We would need to list down what would be the impact of an event occurring. So a really easy way of doing that is to consider the impact on our:

• Operations,
• the legal impact
• financial impact
• strategic impact and
• reputation impact of any event occurring.

Things such as terrorist events have obviously a very big impact on reputation and the impact could be quite minor; as far as operationally it could be just a lone wolf stabbing somebody which is obviously a terrible thing to happen but nonetheless operationally this is lots less severe than perhaps a building being blown up. But you might find that the reputation of your organization is so damaged it has an impact on the operational viability of your venue because nobody turns up any more to visit your venue.

So one really easy way to consider impact is to go through these five different steps.

6. Counter measures

Finally we think about countermeasures. It might well be that some of our risk statuses are high and therefore we need to put in place some countermeasures. Typical countermeasures that people may put in place:

• Anti drone
• security officers
• CCTV
• SIRV
• Barriers perhaps to stop crowds gathering in certain areas or being exposed to the railway line et cetera.

That is countermeasures. And that is all six steps that we need to go through to be able to put together a security risk assessment.

If you have found this particular video sure to leave a comment and possibly get in touch and remember that one of the things that we do here at SIRV is bring together and bring to life. So in other words, on a day to day basis the threats and the assets can be changed and it means you have a dynamic security risk assessment in place. If you’ve got this far well done and thank you for watching. All Goodbye.