September 17, 2019
An essential stage of improving your overall cyber security strategy is assessing and identifying the potential risks your organisation face and determining how vulnerable you are. Recent news headings are giving us every reason to reconsider current cyber security practice to fall out of the false sense of security.
In fact, cyber-attacks have been ranked the third-likeliest risk right after data fraud and theft. While you may think that your organisation is not at risk, it is useful to know that no one is safe.
Malicious criminals are stepping up efforts to extract as much value from brand reputations, customer trust and whole economies.
Before setting out to assess your cyber security defences, it’s crucial to understand the risk profile. Research cited on CSO states that the average cost of a cyber-attack climbed from $1.2 million in 2016 to $1.3 million in 2017.
A risk-based cyber security strategy will make it easier for your company to allocate the right resources and apply the highest level of security. This kind of strategy always starts with identifying which data is critical and how far you’re able to go to prevent this data from falling into the wrong hands.
1. How valuable is your data and reputation?
Assess what data is most critical to your business and what is most important to protect and prioritise. Which of your data is of high value to someone else?
Personal information like bank account numbers, Social Security numbers, or health records are easily monetised in the criminal market. Your organisation’s intellectual property, which defines and distinguishes you from your competitors, can be valuable in other markets
2. Who are the potential threats?
Who wants your data? Who wants to destroy and disrupt your operations? What are their usual attack methods? Assume what will be worse for them to do. Steal your data? Make it inaccessible? Alter it?
Look at your data from an attacker’s perspective—to what extent will they go to achieve their goal? Consult your IT team about appropriate hardening, scanning, and monitoring of critical systems to protect your business against the most likely and harmful attack opportunities.
3. How much ‘risk’ can we handle?
What level of risk are you willing to accept? It is near impossible to be able to fix every vulnerability and address every risk that your business is exposed to, it is beyond most technical and financial resources.
If the likelihood of business impact is low, measuring detection and response is more effective.
Do not waste money protecting all of your information and systems equally from every threat. By taking the time to understand the realistic risks to your business, you can more effectively work with your IT team to design security into the systems that handle your most valuable data.
Who’s the fairest of them all?
In most cases, it is information and financial assets that are most vulnerable as these are most attractive to cyber criminals. The best way to assess the security of these assets is by making sure only those who crucially need it can access it. Assess the storage and management by reviewing where the information stays and how easy/hard it is to get into it. Assess all the IT equipment within your business, including mobile and personal IT devices.
Here are some factors that turn your IT situation into a hacker’s jackpot
- Poor configuration security: your base configuration should hold encryption and proper hashing of passwords.
- No attention to patch management: This can be very challenging when managing systems that are critical to core business operations.
- Increased attack surface for remote function call (RFC) communication: RFC communication may have been put in place to allow business systems to talk to one another, it is possible that access rights to the landscape have been excessive over time and are performing with limited reach.
- Unreliable encryption enablement: Addressing the level of enablement between systems is just as important as focusing on encryption within a system.
- Poor code security: User-developed code hasn’t been reviewed and analysed to make sure that it is “vulnerability free” – this is a common occurrence.
The most crucial stage of assessing and improving your overall cyber security strategy is to identify your vulnerable areas and bridge those gaps.
- Phishing statistics 2019 – The shocking truth
- Cyber security awareness training: What is it?
- Cyber Essentials vs Cyber Essentials PLUS: What’s the difference?
- Best practice password policy recommendations
- INFOGRAPHIC: Malware examples: What are the different types?
- 6 steps to a successful cyber security improvement programme
About Comtact Ltd.
Comtact Ltd. is a government-approved Cyber Security and IT Managed Service Provider, supporting clients 24/7 from o
ur ISO27001-accredited UK Security Operations Centre (SOC).
Located at the heart of a high security, controlled-access Tier 3 data centre, Comtact’s state-of-the-art UK Cyber Defence Centre (SOC) targets, hunts & disrupts hacker behaviour, as part of a multi-layered security defence, to help secure some of the UK’s leading organisations.