Providers of security and anti-malware products like to spread images of young hackers wearing hoodies as a threat to IT systems. But, more often, employees of a company pose a greater threat to information security. Insiders are responsible for about 70 percent of the incidents; external attackers who exploit security vulnerabilities account for about 30 percent. The ISO/IEC 27005 standard [1] on IT risk management lists poorly trained or careless employees, disgruntled or malicious employees, and dishonest or recently fired employees as the main hazards.

At the same time, the profile of the external attacker is also changing. The romantic notion of the lonesome hacker sitting in an apartment and stealing data for the joy of being able to do so is far from the norm. Hacking today is usually a business where prices are defined by supply, demand, and ancillary costs (see the box titled "Cost and Benefits for Attackers.")

In this climate, every business needs to be aware of potential security threats, and it helps to have a systematic strategy for quantifying risk and assigning priorities as to which problems are most urgent. The business tool for getting to grips with vulnerability assessment is risk analysis. Risk analysis helps a company identify the risks, calculate the financial impact, identify vulnerabilities, assess threats, and put a value on the damage that would occur if someone were to exploit existing vulnerabilities and conflicts. The goal is not just to find the most glaring vulnerability or the most expensive loss scenario – risk analysis attempts to evaluate the severity of an attack in the context of the likelihood the attack will occur, showing IT managers which prevention measures will give the most protection for the IT dollar.

[...]