Prioritizing levels of risk in your cybersecurity assessment

Cybersecurity is one of the most pressing issues for businesses. For the first time, it has been identified by security professionals as the single biggest risk to an organization. Cybersecurity risks come in many forms but, while businesses need to protect against all threats, some are more urgent than others.

Prioritizing the levels of risk associated with cybersecurity incidents will help you protect your business from the most pressing threats first. For example, if you have an unsupported operating system (OS) on your PCs, they are very likely to get breached, whereas your up-to-date systems pose less risk. But how do you determine the biggest risks in your business? Read on to find out how.

Identify potential cybersecurity risks

The first step is to identify the overarching themes of the cybersecurity risks your business faces. We recommend doing this by listing the areas of your business that pose a risk. The main areas include software risks, hardware risks, data risks, vendor risks and personnel risks. There is some crossover between these categories, but it’s important to understand how they can each pose a risk to your business.

Software risks

Your software could be responsible for compromising your business’ cybersecurity for a number of reasons. The most common issue is outdated or unpatched systems, which are vulnerable to cyber-attacks. Software providers continually patch their systems to plug newly-discovered security gaps, so it’s critical to apply those patches as quickly as possible. Modern cloud-based applications will automatically update, giving you peace of mind.

Hardware risks

In a similar vein, outdated hardware can pose a risk to your business. Outdated devices often aren’t compatible with security or software updates, meaning you’re left with multiple vulnerabilities. Think about new phone releases; the physical technology improves, which allows for advancements in the phone’s functionalities. Outdated hardware works in the same way but is particularly pertinent to security issues.

Data risks

Now that GDPR is in force, businesses are required to safeguard any personally identifiable information (PII) they hold. All businesses will hold some PII, whether that’s on customers, employees, target customers or a combination. Data risks cross over with software and hardware risks because, in the modern business world, you’re likely to have most of this data stored on PCs and in business-critical systems.

Vendor risks

One of the most pertinent risks associated with vendors is those who deal with your business’ sensitive data and how they do it. Many organizations use ERP and BMS systems to store their customer data and import it into their email marketing platform. Understanding your providers’ policies and security measures will help you understand the risk associated with them holding your data.

Personnel risks

We all know hackers are targeting businesses with more force than ever. But what about your internal security threats? Human error accounts for as much as 95 percent of all cybersecurity breaches. So, while you need to put measures in place to keep cybercriminals out, you need to look beyond them. Your workforce represents the biggest attack surface in your business. It’s the frontline of your defense. So, if your people aren’t educated on cybersecurity risks, they could unknowingly compromise your business.

Identify potential threat categories

Once you’ve identified the areas of your business which are likely to experience cybersecurity incidents, it’s time to look at the threat categories. This can include:

• Data theft (including phishing attacks or stealing data from your systems)
• Data destruction (including ransomware attacks which encrypt data)
• Backdoor attacks (for example, hackers gaining remote access to your systems)
• Accidental data loss (such as an employee losing a USB stick with sensitive data)

You can then look at tying these threat categories to your cybersecurity risk categories. So, for example, data theft can come under software risks, hardware risks and personnel risks. Data destruction can relate to hardware risks, but also vendor risks because your provider could suffer a cyber-attack.

Identify threat scenarios

Finally, you should tie all of that information together to predict the threat scenarios that are likely to hit your business.

Let’s say 50 percent of your PCs still operate on Windows 7. That’s a software risk because Microsoft is no longer providing updates for the outdated operating system. This leaves it vulnerable to hacker attacks. A hacker is able to penetrate your system via a backdoor attack and execute remote code, which spreads across your entire network of PCs. This is an immediate and pressing threat because hackers are already exploiting Windows 7 vulnerabilities, so you should upgrade those PCs as a matter of urgency.

Similarly, let’s say you have a common problem with your staff (a personnel risk) clicking links in phishing emails (data theft). Because this problem is so widespread, you should address it immediately. You can implement solutions like simulated phishing attacks. These will send fake phishing emails to your staff which replicate common, successful spam emails. If your people click on those links, they’re directed to training resources.

How to prevent cybersecurity incidents

Carrying out a cybersecurity risk assessment and prioritizing certain areas based on their threat level is the first step in the process. You should use this assessment to determine the methods you put in place to bolster your security, which can include:

• Modern anti-virus solutions
• Backup and disaster recovery tools
• Updated operating systems and software
• Modern hardware
• Staff training programs

If your business isn’t in the cybersecurity space, why not tap into the expertise of an IT support service? These businesses are the experts in cybersecurity, meaning they’ll be able to recommend and implement the solutions which work best for your organization. Working with a trusted security partner ensures you don’t miss out any critical areas of your business which need to be protected.

Photo Credit: Olivier Le Moal / Shutterstock

Steve Osprey is Microsoft Solutions Director at TSG