Webinar Jan. 18, 2023: Cybersecurity New Year’s Resolution – Go On the Offensive
Security Risk Assessments are critical for a business in order to identify gaps in user and company data protections, as well as meet regulatory or compliance requirements.
Assessments may uncover vulnerabilities or potential risks that, if remediated, can save the organization from significant losses, including not only monetary losses, but also operation downtime, application outages, and the loss of intellectual property.
According to the National Institute of Standards and Technology, a cyber security risk assessment identifies the risk to your organization’s operations, assets, users, and more through the use of information technology. Since risk is always present in business, a thorough assessment tests the protection in place to effectively mitigate risk.
Performing a cyber security risk assessment on third-, fourth, and Nth-party vendors can be extremely challenging. Without the same level of access to the vendor’s systems, making a thorough assessment can be difficult. Additionally, the scale of an enterprise vendor attack surface can overwhelm most manual processes.
The first step in completing a cyber security risk assessment is observing what data your organization collects (whether through customer payment portals, surveys, or just employee operations), where you store that data, how it is protected, and how long you keep the data.
What threats do you face in your organization? Malicious actors are not the only threats to data information. You should consider natural disasters common in your area (will the disaster damage on-premise servers?), power to your critical systems, human error, and unauthorized access.
Third-party vendors have become an increasing threat to organizations, as they rarely have the same level of security. The security checklists used to audit vendors quickly become outdated, and you may not know if they change servers or leave your data without protection.
A security risk assessment multiplies the threat by the impact to determine the risk level. You should consider both the operational and reputational impact of a vulnerability exploit.
Customer or user data loss has a high reputational impact: your users no longer feel safe doing business with you, and that will decrease sales or stock prices.
The operational impact would be a two-week closure due to a hurricane, application downtime due to a power outage, or a phone outage due to a poor internet connection. Cloud storage and systems dramatically reduce the likelihood of those issues.
Your company may not have the same natural disaster risks as other companies, but you most likely face malicious actors looking to steal data.
If your business relies heavily on cloud storage (whether on your own server or through Dropbox, Google Drive, or Microsoft), do you have permissions in place to keep that data secure from the whole internet? Unintentionally, employees make folders “visible to anyone” or worse, “writeable by anyone” and expose intellectual property to the wrong people.
When businesses don’t update systems regularly, they may not catch security patches. Hackers regularly scan systems looking for those open holes.
Some PII (Personally Identifiable Information) is not actually valuable. For example, when hackers breached the audio-only social platform, Clubhouse, they released the usernames, social media handles, and other information for free. However, Clubhouse responded that “the data referred to is all public profile information from our app, which anyone can access via the app.” While users may not want all their public data available in an easy-to-search spreadsheet, Clubhouse does not consider this a valuable asset to protect.
In contrast, if your company has credit card information or social security numbers for clients, that data needs more protection.
Security risk assessments cannot be a one-time activity (and regulatory compliance typically requires regular assessments). As we mentioned earlier, the initial security checklist for a new vendor does not give you an up-to-date understanding of their security posture. Regular security risk assessments ensure that your organization is not exposed long enough for a vendor to exploit vulnerabilities.
Your third-, fourth-, or Nth-party vendor may change servers and leave an exposed S3 data bucket with your data, and you would never know without continual assessments.
Cyberpion’s regular External Attack Surface Assessment alerts you when these changes occur, so you can secure them before potential attackers notice.
Regular audits and assessments of your vendors’ security systems will lead to better security down the chain (they know you will audit them, so they audit their own vendors).
Internally, more security risk assessments demonstrate where employees need better training to protect assets and keep them alert for phishing and malware.
Request a free hyper external attack surface scan today.
