Identifying Your Company’s Vulnerabilities to Cyberattack

Today’s technological advances and unique customer needs are continuing to drive businesses towards a much-needed and exciting digital transformation. But along with that transformation come vulnerabilities to a company’s cybersecurity.

As the second article in our Employer Series: People Management in the Digital Era, this piece picks up on the potential risks for cyberattacks outlined in article one and provides five key actions you can take to identify your company’s areas of vulnerability and likelihood of cyberattack.

As you progress through the steps below, you’ll find the answers to the following important security questions about your organization:

• What are your company’s most important assets and information?
• What vulnerabilities exist internally and externally?
• What is the likelihood that these vulnerabilities will be exploited?
• What type of cyberattack would have the biggest impact on your business?
• What level of risk is your company willing to take on?

According to the National Institute of Standards and Technology (NIST), cybersecurity efforts should involve a risk assessment like this to determine, evaluate, and rank the risks they are vulnerable to as an organization. In addition, business leaders must assess the potential damage a successful cyberattack can cause, not only to their organization, employees, and stakeholders, but also to the wider community. Going through this process will help guide you in knowing where to focus your cybersecurity efforts and the training needs of your staff.

Step 1: Identify Your Most Valuable Assets and Information

The first step to identifying your company’s vulnerabilities is to compile a list of all assets. You want to connect with every department head to itemize all networked systems, mobile devices, information, data and other assets that are of value to the organization. This should be a very detailed inventory because many sources of information could be at risk of cyberattack. You will prioritize this list during later steps, so there’s no need for your teams to grapple with what might or might not be more important in this first step. 

Step 2: Determine Potential Threats and Digital Vulnerability

Various processes exist to help you define potential risks. Once all risk factors have been identified, then you can determine the level of each potential risk. The most common risk factors include:

Threat

A threat is anything capable of harming operations, assets or employees through a company’s systems as a result of unauthorized access, destruction, denial of service, or other similar breaches. Examples of threats include:

• Hackers
• Hostile cyberattacks
• Human errors
• System failures
• Unauthorized access
• Misuse of information  
• Data leaks or data loss
• Services disruption
• Natural disasters
• Accidents

Vulnerability

A digital vulnerability is a weakness in a system that a threat can exploit. Vulnerabilities typically occur because of a lack of proper information system security controls, but they can also be found in other circumstances:

• Missing, inadequate or degraded security controls
• Misaligned organizational governance structures
• External relationships with suppliers, providers, and technologies
• Poorly-defined business processes
• Inadequate enterprise infrastructure

Predisposing Condition

A condition that already existed in your organization could increase or decrease cybersecurity risks. Some of these conditions can be mitigated if you take proper action, but others may be outside of your control. Examples of predisposing conditions include:

• The company being based in a location prone to natural disasters (increased risk)
• The information system lacking connections to the Internet (no risk)
• Outdated system technologies (higher risk)

Likelihood

Likelihood is a risk factor that’s weighted and based on analyzing the chance that a particular threat may exploit a particular vulnerability. It’s usually measured as part of a three-step process:

• The likelihood of being initiated or occurring
• The likelihood it will have an impact
• The overall likelihood of it being initiated/occurring and having an impact

Impact

Impact relates to how much damage a threat could cause. This damage could affect anyone with a relationship to the organization: 

• Business owners
• Stakeholders
• Information owners
• Groups relying on the organization

In short, during a risk assessment, you’ll identify possible events (threats) that could exploit weaknesses (vulnerabilities) and assess the chance of those events happening (likelihood) and how much damage (impact) they may cause.

Step 3: Prioritize High-Value Assets at the Greatest Risk of Cyberattack

The severity of cyber risks depends on several factors, including the type of threat, probability of a vulnerability being exploited, and potential damage that could be done to a company’s reputation or financial state. Vulnerabilities are found in several ways, but most often through audits, analyses, and databases.

Once you determine vulnerabilities, you can use them to measure the potential level of risk on valuables assets and information depending on the specific threats. There are four categories you can use when evaluating the risk levels of important assets, although it’s rare for a company to have systems and equipment with zero risk.

• Zero risk
• Low risk
• Medium risk
• High risk

You should place the most valuable information with the highest level of risk as a high priority. You’ll want to spread your security budget so that you focus on assets that are most valuable and would cause the most harm if they sustain a cyberattack.

Step 4: Evaluate Employee Training in Proper Security Practices

Identifying vulnerabilities and implementing cybersecurity is not complete without the proper human resources in place. Sanquinetta Dover, the founder of Dover Solutions, emphasizes that “staying ahead in a constantly changing global economy requires a secure technology transformation but also a focus on sound people management.” 

You should educate all relevant employees on any new technologies that are added, and provide ongoing training on how to use those technologies most securely. This includes being able to handle security alerts and maintain security controls designed to reduce or eliminate the risks of cyberattack.

Step 5: Implement Cybersecurity Measures

After you’ve identified and prioritized all the potential risks throughout your organization, both internally and externally, you’re ready to lay out a cybersecurity plan. When done properly and accurately, the risk assessment should act as a guide for where you need to concentrate your efforts to secure your valuable systems, equipment, information, data, and other assets.

There are several approaches you can take in your cybersecurity process, but most fall into one of the three following areas of focus: 

• Threat-oriented
• Asset/Impact-oriented
• Vulnerability-oriented

Regardless of the method, it’s important to cover all bases and ensure that weak points in the system are protected as best as possible.

Final Thoughts

Cybersecurity is often approached from primarily a technological standpoint, but it’s vital to consider the human resources involved as well. From IT staff to equipment operators, everyone should be knowledgeable of an organization’s specific security best practices. At Dover Staffing, we offer solutions and training designed to help employees keep up with technology. If you need assistance with training your employees on learning and following cybersecurity practices, contact Dover Training Institute for more information.