Small businesses often think they don't have to worry about cybersecurity, but these companies are usually the easiest targets for cybercriminals. Some 43% of cyberattacks were directed at organizations with 250 employees or less in 2015, according to Symantec.
\r\nAssessing your own risk is an important first step to mitigating it. If you're running a business and have little to no background in technology or cybersecurity, it's important to partner with a consultant or third-party organization. If you're debating whether your business needs this level of attention, consider how your business is already handling data.
\r\nJorge Rey, chief information security officer for accounting firm Kaufman Rossin, said that businesses that handle customer data – especially sensitive information, such as medical records – need to have some type of security measures in place. That doesn't necessarily mean you need to lock your business down in a fortress, but it's important to assess your situation and determine the best course of action.
\r\n\"The risk profile is some type of score that helps you determine, 'Hey, are we doing good or do we need to do more?'\" Rey said. \"What happens then, and I think this is where the challenging part is, is you can apply this framework.\"
\r\nRey said the way to think about a risk profile is to consider threats, assess vulnerabilities and then quantify potential losses.
\r\nThe first step to assess your business's cyber risk is to identify threats that could impact your business. This can involve reading about industry security threats, considering how your company handles data and reviewing past cybersecurity issues. During this initial phase, it's also important to consider cybersecurity risk from an internal standpoint as well.
\r\n\"I think small businesses [are] worried about threats that [aren't] even affecting them,\" Rey said. \"They're all freaking out about hackers, but they're not even looking at their own employees and their access to systems and … data.\"
\r\nOften, the most common cyberattacks come from disgruntled employees or mistakes from workers within the organization. While industrywide crime trends like phishing, ransomware and DDoS attacks should be considered, don't forget about threats within your own company.
\r\nCybercrime and cybersecurity are very complex, and it can be hard for small business owners to be aware of impending threats. Greg Scott, an author and cybersecurity expert with more than two decades of experience, said cybercriminals often know more about a business's technology than a business owner does.
\r\n\"The bad guys already know more about your equipment than you do, and they know more about how to break into it than you'll ever learn,\" he said.
\r\nIt's crucial to consider vulnerabilities in your own systems to take steps to prevent further problems. This is where cybersecurity consultants and other third-party risk companies can assist you. Scott offered a few recommendations for businesses looking to assess their own vulnerabilities without partnering with a professional.
\r\nOnce you've looked at threats and determined your own vulnerabilities, a cybersecurity consultant can help you quantify risk by applying it to different frameworks. When you've established a profile, they can help you implement strategies to protect your business. When looking for companies or individuals to partner with, Rey said it's important to consider experience and work with a company that understands the business aspect of cybersecurity.
\r\n\"You can manage the risk through technology, but technology is not the only solution,\" Rey said. \"You want to have someone who can understand the business side of your business. You want to make sure that the person you're talking to can relate the issues to some type of operational or financial metric that you understand.\"
\r\nScott said that experience and the relationship they provide are also what's important. He also said it's important for small businesses to share what they learn with other businesses. This can raise the standard for cybersecurity in small business communities.
\r\n\"Share everything you learn liberally with everybody,\" he said. \"The good guys [are] just isolated, and they're vulnerable.\"
\r\nThis assessment maps all vulnerabilities that are uncovered within your IT environment. Testers access the potential severity of possible attacks on each part of the system as well as recovery options and scenarios. The outcome gives a priority list of issues to be addressed.
\r\nThis assessment is more relevant when little has been done on security. It is able to find as many defects as possible based on the priority list and within the available budget and time.
\r\nBudgeting can be carried out after the vulnerability assessment has been done in order to have sufficient funds to fix the defects.
\r\nThis test inspects a potential target. The targets include domain rights that could be hacked, payment and customer data that could be stolen, or stored information that could be altered by cybercriminals. The penetration testing results indicate whether the current security posture is sufficient or not.
\r\nThe penetration test is used to confirm the configurations of the software and version management. Experienced testers should be used for this test as it is of a higher level.
\r\nDetermine the most important assets in the organization. This will include customer information, company assets and other infrastructure. Determine the cost implications of exposing or losing information.
\r\nAssess all buildings and identify and prioritize the assets. These include hardware, laptops and customer data.
\r\nSome of the common threats affecting an organization's data include:
\r\nReduce software vulnerabilities through proper patch management via automatic forced updates.
\r\nControls are implemented through technical means, such as hardware and software encryption, two-factor authentication, automatic updates and continuous detection of data leaks.
\n","docType":"article","guid":"articles_bc55e4acdd6bdff9c2301f8dbbb13d2f","lastModified":"2020-06-03T13:41:00.000Z","published":"2018-06-15T13:30:00.000Z","structuredData":null,"subtitle":"Security risk profiles can help quantify cybersecurity risk.","template":"v1","title":"How to Assess the Cybersecurity Risk of Your Small Business","type":"article","author":{"avatar":null,"bio":"The purpose of our community is to connect small business owners with experienced industry experts who can address their questions, offer direction, and share best practices.","name":"business.com editorial staff","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/company/business-com-/","twitter":"https://twitter.com/businessdotcom","website":"https://www.business.com/"},"status":"enabled","title":null,"type":"Old BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/b14a2c1fa0158a2f46854597139a2067ee8ef.jpg","profile":{"company":"","jobTitle":"","website":"https://www.business.com/"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Security","slug":"security"}},"meta":{"robots":"index, follow","description":"Creating a security risk profile can help you determine how vulnerable your business is to cyberattacks.","title":"How to Discover Cybersecurity Vulnerabilities - business.com"},"parsedContent":{"toc":[{"id":"assessing-risk-means-considering-all-possibilities","title":"Assessing risk means considering all possibilities"},{"id":"determine-vulnerabilities-where-you-can","title":"Determine vulnerabilities where you can"},{"id":"cybersecurity-professionals-can-help-with-your-risk-profile","title":"Cybersecurity professionals can help with your risk profile"},{"id":"types-of-cybersecurity-assessments","title":"Types of cybersecurity assessments"},{"id":"steps-small-business-owners-can-take-to-help-with-a-cybersecurity-assessment","title":"Steps small business owners can take to help with a cybersecurity assessment"}],"json":[{"component":"ul","children":[{"component":"li","children":["Technological advances have grown exponentially, hence the need for organizations to protect their information."]},{"component":"li","children":["Consider all possibilities that could result affect your business's cybersecurity risk and that could impact your business."]},{"component":"li","children":["Carrying out a cyberassessment provides an in-depth review of your ability to informational assets against threats."]}]},{"component":"p","children":["Small businesses often think they don't have to worry about cybersecurity, but these companies are usually the easiest targets for cybercriminals. Some 43% of cyberattacks were directed at organizations with 250 employees or less in 2015, according to ",{"component":"a","props":{"href":"https://www.symantec.com/content/dam/symantec/docs/infographics/istr-attackers-strike-large-business-en.pdf","target":"_blank","rel":"nofollow"},"children":["Symantec"]},"."]},{"component":"p","children":["Assessing your own risk is an important first step to mitigating it. If you're running a business and have little to no background in technology or cybersecurity, it's important to partner with a consultant or third-party organization. If you're debating whether your business needs this level of attention, consider how your business is already handling data."]},{"component":"p","children":["Jorge Rey, chief information security officer for accounting firm ",{"component":"a","props":{"href":"https://kaufmanrossin.com/","target":"_blank","rel":"nofollow"},"children":["Kaufman Rossin"]},", said that businesses that handle customer data – especially sensitive information, such as medical records – need to have some type of security measures in place. That doesn't necessarily mean you need to lock your business down in a fortress, but it's important to assess your situation and determine the best course of action."]},{"component":"p","children":["\"The risk profile is some type of score that helps you determine, 'Hey, are we doing good or do we need to do more?'\" Rey said. \"What happens then, and I think this is where the challenging part is, is you can apply this framework.\""]},{"component":"p","children":["Rey said the way to think about a risk profile is to consider threats, assess vulnerabilities and then quantify potential losses."]},{"component":"h2","props":{"id":"assessing-risk-means-considering-all-possibilities"},"children":["Assessing risk means considering all possibilities"]},{"component":"p","children":["The first step to assess your business's cyber risk is to identify threats that could impact your business. This can involve reading about industry security threats, considering how your company handles data and reviewing past cybersecurity issues. During this initial phase, it's also important to consider cybersecurity risk from an internal standpoint as well."]},{"component":"p","children":["\"I think small businesses [are] worried about threats that [aren't] even affecting them,\" Rey said. \"They're all freaking out about hackers, but they're not even looking at their own employees and their access to systems and … data.\""]},{"component":"p","children":["Often, the most common cyberattacks come from disgruntled employees or mistakes from workers within the organization. While industrywide crime trends like phishing, ransomware and DDoS attacks should be considered, don't forget about threats within your own company. "]},{"component":"h2","props":{"id":"determine-vulnerabilities-where-you-can"},"children":["Determine vulnerabilities where you can"]},{"component":"p","children":["Cybercrime and cybersecurity are very complex, and it can be hard for small business owners to be aware of impending threats. ",{"component":"a","props":{"href":"http://dgregscott.com/","target":"_blank","rel":"nofollow"},"children":["Greg Scott"]},", an author and cybersecurity expert with more than two decades of experience, said cybercriminals often know more about a business's technology than a business owner does."]},{"component":"p","children":["\"The bad guys already know more about your equipment than you do, and they know more about how to break into it than you'll ever learn,\" he said."]},{"component":"p","children":["It's crucial to consider vulnerabilities in your own systems to take steps to prevent further problems. This is where cybersecurity consultants and other third-party risk companies can assist you. Scott offered a few recommendations for businesses looking to assess their own vulnerabilities without partnering with a professional."]},{"component":"h2","props":{"id":"cybersecurity-professionals-can-help-with-your-risk-profile"},"children":["Cybersecurity professionals can help with your risk profile"]},{"component":"p","children":["Once you've looked at threats and determined your own vulnerabilities, a cybersecurity consultant can help you quantify risk by applying it to different frameworks. When you've established a profile, they can help you implement strategies to protect your business. When looking for companies or individuals to partner with, Rey said it's important to consider experience and work with a company that understands the business aspect of cybersecurity."]},{"component":"p","children":["\"You can manage the risk through technology, but technology is not the only solution,\" Rey said. \"You want to have someone who can understand the business side of your business. You want to make sure that the person you're talking to can relate the issues to some type of operational or financial metric that you understand.\""]},{"component":"p","children":["Scott said that experience and the relationship they provide are also what's important. He also said it's important for small businesses to share what they learn with other businesses. This can raise the standard for cybersecurity in small business communities."]},{"component":"p","children":["\"Share everything you learn liberally with everybody,\" he said. \"The good guys [are] just isolated, and they're vulnerable.\""]},{"component":"h2","props":{"id":"types-of-cybersecurity-assessments"},"children":["Types of cybersecurity assessments"]},{"component":"h3","children":["Vulnerability assessment"]},{"component":"p","children":["This assessment maps ",{"component":"a","props":{"href":"https://www.infradata.com/news-blog/the-5-key-cyber-security-assessment-types/","target":"_blank","rel":"nofollow"},"children":["all vulnerabilities"]}," that are uncovered within your IT environment. Testers access the potential severity of possible attacks on each part of the system as well as recovery options and scenarios. The outcome gives a priority list of issues to be addressed."]},{"component":"h4","children":["When should you perform a vulnerability assessment?"]},{"component":"p","children":["This assessment is more relevant when little has been done on security. It is able to find as many defects as possible based on the priority list and within the available budget and time."]},{"component":"p","children":["Budgeting can be carried out after the vulnerability assessment has been done in order to have sufficient funds to fix the defects.",{"component":"strong"}]},{"component":"h3","children":["Penetration testing"]},{"component":"p","children":["This test inspects a potential target. The targets include ",{"component":"a","props":{"href":"https://www.infradata.com/news-blog/the-5-key-cyber-security-assessment-types/","target":"_blank","rel":"nofollow"},"children":["domain rights"]}," that could be hacked, payment and customer data that could be stolen, or stored information that could be altered by cybercriminals. The penetration testing results indicate whether the current security posture is sufficient or not."]},{"component":"h4","children":["When should you perform the penetration test?"]},{"component":"p","children":["The penetration test is used to confirm the configurations of the software and version management. Experienced testers should be used for this test as it is of a higher level.",{"component":"strong","children":[" "]}]},{"component":"h2","props":{"id":"steps-small-business-owners-can-take-to-help-with-a-cybersecurity-assessment"},"children":["Steps small business owners can take to help with a cybersecurity assessment"]},{"component":"h3","children":["Determine the value of your company's information."]},{"component":"p","children":["Determine the most important assets in the organization. This will include ",{"component":"a","props":{"href":"https://www.upguard.com/blog/cyber-security-risk-assessment","target":"_blank","rel":"nofollow"},"children":["customer information, "]},"company assets and other infrastructure. Determine the cost implications of exposing or losing information."]},{"component":"h3","children":["Identify and prioritize assets."]},{"component":"p","children":["Assess all buildings and identify and prioritize the assets. These include ",{"component":"a","props":{"href":"https://www.upguard.com/blog/cyber-security-risk-assessment","target":"_blank","rel":"nofollow"},"children":["hardware, "]},"laptops and customer data",{"component":"a","props":{"href":"https://www.upguard.com/blog/cyber-security-risk-assessment","target":"_blank","rel":"nofollow"},"children":["."]}]},{"component":"h3","children":["Identify potential threats."]},{"component":"p","children":["Some of the common threats affecting an organization's data include:"]},{"component":"ul","children":[{"component":"li","children":["Authorized access from attackers, malware and employee error"]},{"component":"li","children":["Misuse of information by authorized users. An inside user may alter, delete or use information without approval."]},{"component":"li","children":["Data leaks as a result of poor configuration of cloud services."]}]},{"component":"h3","children":["Identify any vulnerabilities."]},{"component":"p","children":["Reduce software vulnerabilities through proper patch management via automatic forced updates."]},{"component":"h3","children":["Analyze and implement new controls."]},{"component":"p","children":["Controls are implemented through technical means, such as hardware and software encryption, two-factor authentication, automatic updates and continuous detection of data leaks."]}]},"resource":null,"sponsorship":{"sponsorType":"no-sponsor","name":null,"thumbnail":null,"bio":null,"slug":null,"status":null,"social":{"website":null,"linkedin":null,"twitter":null,"facebook":null}},"thumbnail":{"path":"https://staging.business.com/images/content/5ed/118db7b437422298b4576/1500-0-","caption":"apichon_tee / Getty Images","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"Resources for Veteran-Owned Businesses","canonical":"https://www.business.com/articles/resources-veteran-owned-business/","slug":"resources-veteran-owned-business","thumbnail":"https://www.business.com/images/content/5b7/425da51ee47e7568b458a/1500-0-","dek":"How to start a business, find funding and gain customers as a veteran business owner.","lastModified":"2018-08-15T12:01:00Z","published":"2018-08-15T12:01:00Z","sponsored":false},{"title":"Considering Going Cashless? Electronic Payment Expert Discusses the Benefits","canonical":"https://www.business.com/articles/electronic-transactions-association-benefits-going-cashless/","slug":"electronic-transactions-association-benefits-going-cashless","thumbnail":"https://www.business.com/images/content/5ba/a86ba1039eb822b8b4579/1500-0-","dek":"Want to increase your customer base? This CEO says offering more payment options is key.","lastModified":"2018-09-25T20:00:00Z","published":"2018-09-25T20:00:00Z","sponsored":false},{"title":"Decoding the Hierarchy of Data Protection","canonical":"https://www.business.com/articles/data-protection-hierarchy/","slug":"data-protection-hierarchy","thumbnail":"https://www.business.com/images/content/5ad/e2b331039eba5148b456a/1500-0-","dek":"What are your options for protecting your data and how do you decide on a strategy?","lastModified":"2018-04-23T19:00:00Z","published":"2018-04-23T19:00:00Z","sponsored":false},{"title":"How to Handle Non-Paying Clients","canonical":"https://staging.business.com/articles/overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid/","slug":"overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid","thumbnail":"https://staging.business.com/images/content/5c5/af13754d26d68178b4596/1500-0-","dek":"Contracts, lawyers and collections agencies are a few places to start.","lastModified":"2019-02-03T08:00:00Z","published":"2018-03-16T14:00:00Z","sponsored":null},{"title":"How to Handle Non-Paying Clients","canonical":"https://www.business.com/articles/overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid/","slug":"overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid","thumbnail":"https://www.business.com/images/content/5c5/e06719c658a87078b4598/1500-0-","dek":"Contracts, lawyers and collections agencies are a few places to start.","lastModified":"2018-03-16T14:00:00Z","published":"2018-03-16T14:00:00Z","sponsored":false},{"title":"How to Make Money in Retirement: A Guide to Turning a Hobby into a Side Business","canonical":"https://www.business.com/articles/how-make-money-retirement-hobby/","slug":"how-make-money-retirement-hobby","thumbnail":"https://www.business.com/images/content/5ba/902e01039eb26648b4572/1500-0-","dek":"Many retirees turn side interests into income. Learn how to make money in retirement.","lastModified":"2018-09-24T15:03:00Z","published":"2018-09-24T15:03:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df905909c658a7e538b4567/Faxing_junce_Getty.jpg","canonical":"https://staging.business.com/categories/online-fax-services/","title":"The Best Online Fax Services of 2021","dek":"Online fax services are growing as more companies divest from conventional fax machines in favor of an automated, scalable and cost-effective option. Here's a look at some of the best online fax services on the market. ","slug":"online-fax-services","lastModified":"2021-03-02T16:07:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2020-06-03T13:41:00.000Z","template":"v1","title":"How to Assess the Cybersecurity Risk of Your Small Business","meta":{"robots":"index, follow"},"docType":"articles","slug":"assess-small-business-cybersecurity","canonical":"https://staging.business.com/articles/assess-small-business-cybersecurity/","skipTOC":false}},"staticQueryHashes":[]}