In Cybersecurity, the famous sports adage applies: “Outstanding Defense is the Best Offense”

Author: Eric Rockwell; Contributors: Carl Grifka and Bob Green 

SingerLewak’s Cybersecurity professionals provide insights to help management team members and boards of directors navigate the growing threats in our Cyber-connected world.  We have articles and other content available to help you learn more at singerlewak.com/cybersecurity. 

In a sports context, outstanding defense comes from application and execution of a solid playbook that’s based on a prudent, proven framework – keeping the strengths of the opposing team in focus.  Cybersecurity Defense is no different. One of the most important things that business leadership teams can do to protect their company after a cyber-attack is to perform regular risk assessments. A risk assessment is a process that helps identify and evaluate potential threats to the security of a business. By performing a risk assessment, you can identify vulnerabilities in your business’ systems and implement measures to protect against those threats.  These risks assessments consider the threat environment (the other team’s offense), as well as the nature of how to address the risks that are posed by that environment.  A business-specific, defensive Cyber game plan is developed from this process.

 Basic Steps to Performing a Risk Assessment: 

There are a few key steps to performing a risk assessment for a small business:

• Identify the assets (information resources, systems, sensitive digital content, etc.)  that need protection
• Identify the potential threats to these assets
• Evaluate the likelihood and impact of each threat
• Implement controls
• Test and review

Identify the assets that need protection

The first step in a risk assessment is to identify the assets that need protection. This could include things like sensitive data, financial information, customer lists, and intellectual property. It’s important to understand what assets are most valuable to your business and make sure they are adequately protected. 

Identify the potential threats

Next, you’ll need to identify the potential threats that could compromise your assets. This could include things like cyber-attacks, physical theft, or natural disasters. It’s important to be as thorough as possible when identifying potential threats, as even seemingly unlikely events can have a significant impact on your business.

Evaluate the likelihood and impact of each threat

Once you have identified the potential threats to your business, the next step is to evaluate the likelihood and impact of each threat. This will help you prioritize the risks and determine which ones to address first. To do this, you can consider factors such as the likelihood of a particular threat occurring and the potential impact on your business if it were to occur. For example, the likelihood of a natural disaster occurring may be low, but the impact could be significant if it were to happen. On the other hand, the likelihood of a cyber-attack may be high, but the impact could be relatively low if you have strong cybersecurity measures in place.

Implement controls

Once you have identified the risks and prioritized them, the next step is to implement what are termed “controls” (procedures, checks/balances, policies, hardware and software deployment and settings, etc.) to mitigate those risks. More specifically, this could include things like installing firewalls and antivirus software, implementing strong passwords and two-factor authentication, and conducting regular security training for employees. It’s important to consider the cost and effectiveness of each control as you implement them. For example, installing a firewall may be a relatively inexpensive way to mitigate certain risks of a cyber-attack, while implementing two-factor authentication may be more expensive but more effective at preventing unauthorized access to sensitive data.

Test and review

Finally, it’s important to regularly test and review your controls to ensure that they are effective. This could involve conducting periodic security audits, running penetration tests, and reviewing your security policies and procedures. By testing and reviewing your controls on a regular basis, you can identify any weaknesses or vulnerabilities and take steps to address them.

Conclusions

Performing a risk assessment is an essential step for small business owners looking to protect their company from potential threats. By identifying the assets that need protection, identifying the potential threats, evaluating the likelihood and impact of those threats, implementing controls to mitigate those risks, and regularly testing and reviewing those controls, small business owners can take proactive steps to secure their business. While risk assessments may seem like a daunting task, they are essential for protecting the assets, customers, and reputation of a small business. By taking the time to thoroughly assess and address the risks to your business, you can help ensure that your company is secure and well-protected.

Take the Next Step

Still unsure if you have truly assessed your risk? Need help with assessing your Information Security / Cybersecurity “maturity” and preparedness? We’re here to help. We’ve got many years of experience helping businesses tune their Cybersecurity gameplans towards the risks and threats most impactful and likely to them.  

• Reach out to us at [email protected]  
• Or check out our web page for more information, articles, webinar announcements and learning eents:  https://singerlewak.com/cybersecurity
• Don’t wait for a breach to test your defenses—partner with SingerLewak LLP’s Cybersecurity Team today.

___________

Resources

The National Institute of Standards and Technology (NIST) is a federal agency that develops standards and guidelines for a variety of industries, including cybersecurity. NIST has published several documents that provide guidance on risk assessment, including the following:

•  “NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments” – This document provides guidance on conducting risk assessments for federal agencies and organizations that handle sensitive government information. It covers the entire risk assessment process, from identifying the assets that need protection to implementing controls to mitigate identified risks.
•  “NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View” – This document provides guidance on managing information security risk at the organizational level. It covers the risk assessment process, as well as risk management and risk-related decision making.
•  “NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy” – This document provides a risk management framework for federal agencies and organizations that handle sensitive government information. It covers the risk assessment process, as well as risk management and risk-related decision making throughout the system life cycle.