Asset Discovery
Cybersecurity has to secure something within organizations. That something is asset. Asset has to be identified and discovered first before they are protected. Asset can a process or data e.g a payroll software, slack, microsoft365 or data like business secrets, algorithms etc
Risk management
Once assets are identified. All risks that can be imagined to assets are identified. Analysis of these identified are carried out to identify the severity of each risk. The severity consists of how likely a risk might occur and what will the severity if it does occurred like likelihood x impact
Penetration Testing
There are certain aspects that require penetration testing and open source intelligence like website, organization network, firewalls, security controls to see what’s like to breach the organization and use the information in risk management. Penetration testing compliments risk management by providing more accurate real world data.