Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


server risk assessment

Posted on 2013-12-03
Medium Priority
Last Modified: 2014-01-02
as part of any disaster recovery excercise have you done any scoring/ranking of which fall into your p1 servers, i.e. high priority, which fall into p2, p3 etc. I wondered whether there is any guidance out there on what to base your ranking of each server, i.e what formula to use - and whether you go down to that level, i.e. server level.
Question by:pma111
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
LVL 18

Expert Comment

by:Steven Harris
ID: 39692402
I wondered whether there is any guidance out there on what to base your ranking of each server, i.e what formula to use
If you are just looking to rank your servers into categories by risk, I would suggest using Risk = Likelihood x Impact.

and whether you go down to that level, i.e. server level.
Why stop at the server level?  You should be determining the risk for every piece of equipment, i.e. switches, firewalls, PSUs, etc.

Author Comment

ID: 39692437
I dont fully understand how:

> Risk = Likelihood x Impact.

Can be applied though, as surely some servers if they died/went down have more of an impact on your business than others, thats the kind of analysis I was interested in. Or by impact are you considering the impact that specific server would have on the business.

What kind of factors do you consider in "impact".
LVL 18

Accepted Solution

Steven Harris earned 1000 total points
ID: 39692468
Impact is exactly what you are thinking.  Let me clarify:

What effect does this have on my business -- Can I live without it in it's entirety?  Can it be down for 5 minutes without causing major problems?  Can it be down for 5 hours without causing major problems?  Can it be down for 5 days without causing major problems?  Is there any type of redundancy or disaster recovery operation in place?
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.


Author Comment

ID: 39692474
is this an excercise you have done for all your servers previously?
LVL 18

Expert Comment

by:Steven Harris
ID: 39692496
I perform this type of assessment every year.  Some companies perform this every quarter...

I guess the best question I can ask is:

What is your ultimate goal?

Author Comment

ID: 39697782
Ultimate goal is to list priority servers for audit purposes, i.e. which elements of the infrastructure require audit focus and why/justifying that appraoch.
LVL 25

Assisted Solution

madunix earned 1000 total points
ID: 39750769
For risk assessment purpose as you know it's been measured by terms of likelihood & impact of the risk under assessment, so you should write down all your operations to make Audit Universe. Then prioritize the most and less risky ones (Impact and likelihood). You should find concrete criteria to prioritize them, after that you have the Risk Based audit plan for your risk assessment:

Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

597 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question