Information Security Handbook

Identifying your organizations vulnerabilities

The next step in the risk assessment process is to identify the vulnerabilities in your information systems. In order to conduct a thorough review of the information system you will need to examine multiple sources of information and utilize varied testing methods.

Information sources:

• Business team: Work with your business users to understand how they conduct their activities. You may find some vulnerabilities in the underlying information systems by asking how they conduct their day:
  • Do your business users access a business-critical system while teleworking without VPN or strong access controls?
• IT team: Work with the IT team to understand how operations run and how information systems ...