The topic of cybersecurity in your organization has been discussed in many of our previous articles; how attackers attack, the basic steps you should take to protect yourself against being attacked, and what to do in the event that an attack occurs.
This article explores the top 5 cybersecurity questions your company should be asking to ensure a complete and thorough security posture.
The answer to these questions should be certain – false assumptions can lead to security gaps and could lead to a breach. Ask for supporting evidence of the implementation of processes, procedures, education, and verification from those responsible.
1. Are our assets inventoried on a regular basis?
Maintaining an accurate inventory of both physical and virtual assets is essential. Without this, how can you know what needs to be protected? At a minimum, your inventory should include:
- A list of Hardware and Software Licences – what they do, where they are located, as well as configuration, age, and version information.
- Data – You should know what data you have, where it is located, how often it is backed up, and how you use it. Furthermore, you should have documented who has access to what, and what should happen if a breach occurs.
In addition to having an inventory, keeping it up-to-date is equally important.
2. Do we regularly and properly educate our employees about cyber threats?
Cyber threats are constantly evolving. Therefore, it is imperative that your staff is properly and regularly trained. Handing out information and then testing their knowledge isn’t enough.
Teaching them why they need to know the information, the consequences of not acting appropriately, and then randomly testing them to see how they respond to decisions that could lead to an attack is far more important.
When people are randomly tested, they are more careful and less likely to take risks. Ensure that the testing is sneaky, but as realistic as possible without warnings, and random to ensure that it doesn’t become a habit and staff doesn’t become complacent.
3. What is our business risk management strategy for cybersecurity?
It is important for you to be aware of how your business uses technology, how it is leveraged, and the consequences of an attack on that technology. In the event of a major cyber incident, your employees are unlikely to fully understand the impact on the business.
It’s important to be able to recover from a cyberattack, but also to examine whether you can continue to operate.
You must also know what the minimum continuity requirements are for your organization, if you are prepared to meet them, and if your IT team can prove it.
4. Is there a place where we are most vulnerable to attack?
Unfortunately, it is impossible to prevent 100% of attacks. You can better prepare if you know where you are vulnerable. Find out what your IT team knows about your vulnerabilities and how they monitor them.
5. What is the recovery time from an attack?
The majority of organizations do not have a plan for recovering from a major attack. Before an attack occurs, you must consider issues such as minimizing downtime, preventing or reducing revenue loss, and managing customer expectations.
To ensure that your plans can be followed, they should be reviewed frequently and tested.
Ask for evidence of the following:
Incident Response Plans – should include the latest test results and adjustments since the last test. The plan should also indicate who is responsible for what in the event of an incident. The owner of your plan should be responsible for testing and updating it.
- Disaster Recovery Plans – should detail how you will recover from a catastrophic disaster.
- Business Continuity Plans – should detail how your business can continue to operate in the event of a disaster – both during and after.
- Insider Protections – You need to know what protection you have from the threats within your organisation.
Document your policies and make sure they are understood by your employees, managers, and anyone with a stake in the company. In the absence of documentation, and if they can only be found in the head of a member of your staff or IT team, they are not real.
What is the significance of these questions?
The importance of cybersecurity cannot be overstated for any business. There should be a place for it in yours if it isn’t already there. For sales, marketing, or other areas of your business, your gut instinct can work, but when it comes to security, you need facts.
Don’t leave your business open to litigation, fines, or front-page headlines from data breaches
The cybersecurity experts at VBS IT Services stand ready to tailor a strategic, reliable protection plan that’ll keep your business secure and compliant as you scale.
Please get in touch with us if you’d like assistance or a cybersecurity risk assessment.