- Technological advances have grown exponentially, hence the need for organizations to protect their information.
- Consider all possibilities that could result affect your business's cybersecurity risk and that could impact your business.
- Carrying out a cyberassessment provides an in-depth review of your ability to informational assets against threats.
Small businesses often think they don't have to worry about cybersecurity, but these companies are usually the easiest targets for cybercriminals. Some 43% of cyberattacks were directed at organizations with 250 employees or less in 2015, according to Symantec.
Assessing your own risk is an important first step to mitigating it. If you're running a business and have little to no background in technology or cybersecurity, it's important to partner with a consultant or third-party organization. If you're debating whether your business needs this level of attention, consider how your business is already handling data.
Jorge Rey, chief information security officer for accounting firm Kaufman Rossin, said that businesses that handle customer data – especially sensitive information, such as medical records – need to have some type of security measures in place. That doesn't necessarily mean you need to lock your business down in a fortress, but it's important to assess your situation and determine the best course of action.
"The risk profile is some type of score that helps you determine, 'Hey, are we doing good or do we need to do more?'" Rey said. "What happens then, and I think this is where the challenging part is, is you can apply this framework."
Rey said the way to think about a risk profile is to consider threats, assess vulnerabilities and then quantify potential losses.
Assessing risk means considering all possibilities
The first step to assess your business's cyber risk is to identify threats that could impact your business. This can involve reading about industry security threats, considering how your company handles data and reviewing past cybersecurity issues. During this initial phase, it's also important to consider cybersecurity risk from an internal standpoint as well.
"I think small businesses [are] worried about threats that [aren't] even affecting them," Rey said. "They're all freaking out about hackers, but they're not even looking at their own employees and their access to systems and … data."
Often, the most common cyberattacks come from disgruntled employees or mistakes from workers within the organization. While industrywide crime trends like phishing, ransomware and DDoS attacks should be considered, don't forget about threats within your own company.
Determine vulnerabilities where you can
Cybercrime and cybersecurity are very complex, and it can be hard for small business owners to be aware of impending threats. Greg Scott, an author and cybersecurity expert with more than two decades of experience, said cybercriminals often know more about a business's technology than a business owner does.
"The bad guys already know more about your equipment than you do, and they know more about how to break into it than you'll ever learn," he said.
It's crucial to consider vulnerabilities in your own systems to take steps to prevent further problems. This is where cybersecurity consultants and other third-party risk companies can assist you. Scott offered a few recommendations for businesses looking to assess their own vulnerabilities without partnering with a professional.
Cybersecurity professionals can help with your risk profile
Once you've looked at threats and determined your own vulnerabilities, a cybersecurity consultant can help you quantify risk by applying it to different frameworks. When you've established a profile, they can help you implement strategies to protect your business. When looking for companies or individuals to partner with, Rey said it's important to consider experience and work with a company that understands the business aspect of cybersecurity.
"You can manage the risk through technology, but technology is not the only solution," Rey said. "You want to have someone who can understand the business side of your business. You want to make sure that the person you're talking to can relate the issues to some type of operational or financial metric that you understand."
Scott said that experience and the relationship they provide are also what's important. He also said it's important for small businesses to share what they learn with other businesses. This can raise the standard for cybersecurity in small business communities.
"Share everything you learn liberally with everybody," he said. "The good guys [are] just isolated, and they're vulnerable."
Types of cybersecurity assessments
Vulnerability assessment
This assessment maps all vulnerabilities that are uncovered within your IT environment. Testers access the potential severity of possible attacks on each part of the system as well as recovery options and scenarios. The outcome gives a priority list of issues to be addressed.
When should you perform a vulnerability assessment?
This assessment is more relevant when little has been done on security. It is able to find as many defects as possible based on the priority list and within the available budget and time.
Budgeting can be carried out after the vulnerability assessment has been done in order to have sufficient funds to fix the defects.
Penetration testing
This test inspects a potential target. The targets include domain rights that could be hacked, payment and customer data that could be stolen, or stored information that could be altered by cybercriminals. The penetration testing results indicate whether the current security posture is sufficient or not.
When should you perform the penetration test?
The penetration test is used to confirm the configurations of the software and version management. Experienced testers should be used for this test as it is of a higher level.
Steps small business owners can take to help with a cybersecurity assessment
Determine the value of your company's information.
Determine the most important assets in the organization. This will include customer information, company assets and other infrastructure. Determine the cost implications of exposing or losing information.
Identify and prioritize assets.
Assess all buildings and identify and prioritize the assets. These include hardware, laptops and customer data.
Identify potential threats.
Some of the common threats affecting an organization's data include:
- Authorized access from attackers, malware and employee error
- Misuse of information by authorized users. An inside user may alter, delete or use information without approval.
- Data leaks as a result of poor configuration of cloud services.
Identify any vulnerabilities.
Reduce software vulnerabilities through proper patch management via automatic forced updates.
Analyze and implement new controls.
Controls are implemented through technical means, such as hardware and software encryption, two-factor authentication, automatic updates and continuous detection of data leaks.