Threat/ Vulnerability Assessment

     Companies face many different types of threats on a daily basis which range from human error to criminal threats to natural weather related threats.  To ensure that business is running smoothly, it is necessary to develop a threat or vulnerability assessment.  The purpose of these assessments are that they will help develop plans to put in place to eliminate or mitigate the potential threats.  Threat assessments can be created to focus on one specific area such as software or a facility in its entirety. 
    
     When starting a threat assessment, the first step is to identify the area or areas that need to be protected.  Once identified, those involved must evaluate potential threats.  Several different methods can be utilized; they include brainstorming, reviewing past threats and vulnerabilities, thinking like criminals or hackers and asset or software driven threats.  After these credible threats are identified they should be ranked from highest to lowest threat impact.  This will help identify which threats are more likely to occur and the severity if it were to occur so they can be prevented or mitigated.

     To mitigate threats it is important for companies to have a documented plan in place to educate employees on what steps are to be taken to mitigate the threat.   In addition to being a resource for employees the plan also serves the purpose of being continuously reviewed to ensure the plan still mitigates the threats effectively.  Should it no longer be effective, the plan should be updated.  This process is cyclical as threats may never be 100% eliminated.  The frequency of review can vary from days, weeks, months or even years.  It all depends on the asset and the time frame those involved determined the system to be reviewed. 

     While a threat or vulnerability assessment may seem like a tedious or daunting task, it is necessary.  The only way for companies mitigate potential threats is to identify them beforehand.  Should they fail to do this it could cost the company more than just a financial loss, it could damage the company's reputation.