You know that strong cybersecurity is crucial, but it’s easy to get lost among competing priorities, complexities and vendor claims:
If you’re confused about cybersecurity, you have a lot of company. In addition to the complexity of its challenges, you’re faced with a bewildering number of service providers, vendors, software and cloud-based applications promising a worry-free life that allows you focus on your business. In addition to maintaining a healthy skepticism about such claims, it’s critical to step back and take a clear-eyed, objective look at your needs.
We believe the foundation begins by developing a fully integrated framework for what robust cybersecurity entails. And spoiler alert, it touches on every aspect of your business from technology to risk management policies, physical assets, internal processes and personnel.
To help you think about cybersecurity in a systematic, holistic way, we’ll lead you through some questions that may help you understand the current state of your data protection and make intelligent decisions about whether to seek additional support. Next, we’ll set expectations for tools such as vulnerability assessments and penetration tests so that you’re prepared to act on the insights they provide.
If you are asked what you’re doing to protect information and data, would you have a ready, detailed answer? Would you be able to lay out your priorities and provide objective evidence to justify your decision? If not, how would you prepare an answer?
Unfortunately, there is no one-size-fits-all checklist suitable for every industry, let alone every individual business. Data protection requirements vary by industry. For example, healthcare companies must meet different standards than companies that handle consumer transactions or work on Department of War contracts. The physical location of your business and individuals whose data you’re charged with protecting can affect security standards and require different certifications.
Understanding the macro requirements driven by industry and domicile is only part of the job. You need a clear, transparent and detailed understanding of your exposures and the current state of your cybersecurity protections. Getting there begins by answering the most overarching question.
Adding a new component to an inefficient, misunderstood system seldom fixes anything. It usually makes it worse. It’s like throwing an engine part under the hood of your car and hoping in lands someplace useful. That’s why a detailed inventory of all your cybersecurity assets is absolutely critical.
Knowing what you have helps you define what each component is intended to do and creates an overall framework for your cybersecurity objectives. It also helps you define immediate and long-term needs and also provides the foundation for creating ongoing cybersecurity policies and guides your data governance for managing enterprise risk.
Your inventory needs to be all-inclusive, incorporating:
Compiling an extensive inventory and updating it frequently gives you insight into your overall cybersecurity, its evolution and its ongoing effectiveness. The information you capture will form the basis for creating documented cybersecurity processes and policies.
If the inventory is what you have, policies and process describe what you do with it, who has access to it and, crucially, what to do if anything goes wrong. Some areas you may want to consider include:
Your process and procedures are likely to be far more extensive than the suggestions here. One related item that we’ll list separately is your vendor management policy.
Third-party consultants and vendors expand your capabilities, free up time and are sometimes required by contract or independent certifications. You probably have a solid a process for reviewing, approving and onboarding new vendors, you should also have policies for watching over the vendors who are watching over your cybersecurity health.
Vendor monitoring policies are safeguards to ensure you’re getting the level of due diligence and service you need from them. They incorporate their ongoing management and periodic evaluations. Some additional ideas to consider are:
Obtaining a vendor’s System and Organization Controls (SOC) reports is a recommended practice before hiring a new vendor as well as part of your ongoing monitoring. SOC reports are comprehensive controls audits produced by third-party auditors.
By systematically reviewing your cybersecurity defenses, you will likely have begun to set priorities and identified areas you want to address. The crucial next step is to get objective perspectives to validate or challenge your findings.
The two tools you will hear recommended for reviewing your readiness to stand up to cyber threats are vulnerability assessments and penetration testing. Both have value and both may be necessary.
They are very different, however. Unfortunately, how they differ and the purposes they serve are not always made clear by some providers. Some even use the terms interchangeably, which may create confusion that blunts their effectiveness or create a false sense of security.
While they are not interchangeable, they do work together to help develop your data protection
Vulnerability assessments are designed to show you where you are today. They apply current best practices and technology standards to provide a baseline assessment of your cyber defenses and identify areas for further testing or remediation efforts.
They are typically automated processes that probe for known weaknesses, including common vulnerabilities and exposures (CVEs), missing patches, misconfigurations and similar flaws. The goal is not to exploit weakness or measure your exposure; rather it’s to identify potential issues and report them.
Depending on your business’ size and complexity, an assessment may need 10 to 15 hours of support from your team. There may be up to 5 interviews with key personnel and system access for the automated assessment tools. The process generally takes a week or two to complete but may require more time for some businesses.
Expect the assessment to help you identify:
If you’ve never had an objective third-party vulnerability assessment, we strongly recommend starting with one.
In contrast to an automated vulnerability assessment conducted against well-known standards, a penetration test is an active, hands-on tool. It probes your defenses using the techniques and tactics of real-world attackers to emulate sophisticated threat actor behavior.
For example, it may stack different attacking methods to identify vulnerability points that might be targeted in a real attempted breach. Typically, it will attack the specific vulnerabilities and concerns identified through conversation with you. It is conducted externally, without internal resources, to approximate a hacking or phishing attempt.
A well-conducted penetration test delivers a detailed narrative that identifies exploitable assets and gives context to the potential impact of a cyberattack. The narrative should also show how vulnerabilities were exploited and detail the attack path a bad actor might take through your system. Finally, it should offer guidance and recommendations on how to remediate issues the test uncovered.
It’s important to note that penetration tests may be required by regulatory frameworks, cyber insurance providers, industry standards and client contracts.
There are a wide range of penetration tests that can be tailored to your needs by mimicking a variety of cyberattacks by both internal and external actors. Here are a few examples:
Vulnerability assessments and penetration tests are versatile tools that can be used multiple times to help develop, evolve and test your processes and defenses. In addition, there are several circumstances when reassessment or new testing makes sense, including:
Another level of sophisticated, intensive review are cybersecurity maturity assessments and tabletop exercises. They may be more appropriate for enterprises with more advanced cybersecurity or extensive technology resources.
The exercise of building an inventory, creating a framework, developing cybersecurity processes and frequently assessing and testing are not discrete processes. They are ongoing, interrelated steps for validating your policies and processes. They form a feedback loop strengthening your security and guiding your decisions. Periodic testing and reassessment, especially leveraging the broad experience and insight of qualified third-party consultants, can help you build sustainable, ongoing protection founded on data, not conjecture.
There are a number of agencies, industry programs, and certifications that may apply to your business or are worth familiarizing yourself with as part of a rounded cybersecurity knowledge base.
The reality of your cybersecurity roadmap is that you never arrive at a destination. There are rest stops and opportunities to refuel, they are best used to recheck your destination and reforecast your journey.
Your business evolves and changes. Cyber threats evolve and change. Some of the same evolutions are felt on both sides of your cyber defenses. For example, understanding how incorporating AI tools changes your cybersecurity framework is just as critical as understanding how it amplifies the tools and methods of bad actors.
Ultimately, your cybersecurity is critical for protection your enterprise from financial and reputation damage from a cyber breach. Understanding that there is no final destination is an essential part of your cybersecurity framework as everything else we’ve discussed.
The upside is that the ongoing effort, backed by a clear, detailed understanding, will empower you with the insight to make intelligent decisions. If will create confidence throughout your business and forge internal alignment behind initiatives.
As we suggested earlier, growth and changes within your business may drive the need for an objective pulse check. Staying on top of external changes is critical as well. Cyberthreats evolve quickly. AI is driving changes on both sides of the cybersecurity challenges. Understanding how incorporating AI tools changes your framework is critical, as is recognizing that AI methods are amplifying the tools and methods of bad actors everywhere.
Periodically reviewing the state of play in cybersecurity with outside experts should be part of your standard practice. The right third-party consultants should provide an objective pulse check for your process. As specialists, they also bring a broader understanding of trends and the technology driving both better protection and the latest threats.
In addition to carefully considering and executing the steps we’ve explored here, your next steps should include deciding where seeking external support may sharpen your data protection.
Cybersecurity is a core pillar of your success. It creates a platform for growth that can be as important as any other aspect of your operations. Learn how our cybersecurity consulting team can help you to stay secure, profitable and sustainable.
Our seasoned audit experts can help you streamline your audit experience and strengthen your financials. Contact us today for a free scoping call to assess your needs.
