Cybersecurity and Risk Assessment
Company leaders recognize the risks for businesses operating in the digital space. As a result, management-level professionals need to be mindful of cybersecurity and risk assessment — and the various threats presented through the internet.
If you’re an IT and information security professional — or are considering a graduate degree in the cybersecurity field — read on to learn about high-end cyber threat assessment measures.
Cybersecurity has increased across industries
Today, most businesses employ cybersecurity measures. According to a 2018 PricewaterhouseCoopers (PwC) Global State of Information Security Survey, 67% of the report’s 10,000 respondents — CEOs, CFOs, IT directors, and other leaders from companies around the world — have detection systems in place to uncover cyber threats.
These numbers show a significant improvement from the state of cybersecurity in businesses about a decade ago, when hacking was a known issue but not taken quite as seriously. However, fewer organizations use in-depth cybersecurity measures — specifically, cybersecurity risk assessments. In a 2017 survey, PwC noted that only 48% of organizational executives engage in vulnerability assessments and about 47% conduct threat assessments.
The problem with this failure to prepare for threats is that detecting malware, trojans, and exploits from email phishing scams before or when they infiltrate a network is beneficial, but it takes just seconds for the most devastating viruses to start doing damage.
COVID-19 has also heightened the vulnerability of sensitive financial and personal information, due an increase in remote employment, distance learning, telehealth, and ecommerce. In a study by Deloitte, data showed a noticeable uptick in phishing and ransomware attacks during the pandemic, which also coincides with an increase in the number of cyber criminals.
Post-COVID prudence should see organizations take proactive measures to ensure the safety and integrity of their network infrastructure. This includes updating work from home IT policies, eliminating business channels that are non-critical, and increasing the number of cybersecurity professionals on staff as well as the frequency of penetration tests to help find areas of weakness before hackers do.
Principles of risk assessment
While the specific steps and processes of a cybersecurity risk assessment may vary, these core concepts can serve as a basic roadmap:
- Take stock of the system. Assess the size, number of hardware- and cloud-based access points, partner organizations and vendors, what information is stored and shared, and sensitivity. For example, a multinational bank is going to prove considerably more attractive to a hacker than a freelance photographer selling prints on a personal website.
- Look at potential threats. According to Sage Data Security, in addition to hacker intrusions and data breaches by disgruntled employees, you should also consider breaches resulting from human error, be it poor data backup, insufficient encryption, or data traveling through unsecure channels.
- Analyze the environment. This step involves examining controls governing administrator access, user authentication and provisioning, infrastructure data protection, continuity of operations, and other factors. The key question is: How vulnerable are these individual controls to the threats an organization is most likely to face?
- Determine the likelihood. Consider the probability of each breach type and its point of origin. Depending on organizational or network complexity, this can involve dozens of breach-source pairings.
- Conduct a final risk assessment. Sage Data Security recommends multiplying the likelihood of a breach by its resultant damage to determine a risk rating. For example, if an organization is likely to experience breach attempts because of the valuable information it’s handling, and the results of such a breach would be catastrophic, the business has an extremely high risk rating.
Lack of risk assessments and changing regulatory climate
According to the National Law Review, 26% of investment management firms don’t conduct cybersecurity risk assessments consistently, and 57% of them don’t conduct cyber penetration tests or vulnerability scans. A May 2017 executive order mandated that all government agencies adhere to all risk assessment and management standards that the National Institute of Standards and Technology has created. While this does not affect the private sector, success in this arena could alleviate any concerns that leaders of companies and organizations might have.
Many organizations may be intimidated by costs associated with expensive technology initiatives; however, PwC found that costs can be mitigated by responsible scaling in its 2021 Global Digital Trust Insights Survey. The survey found that 72% of businesses can strengthen their cybersecurity as they contain costs, all thanks to automation and tech rationalization.
Arm yourself with cutting-edge strategies to keep hackers on the outside looking in
As technology changes and grows — and our reliance on it increases — the associated threats grow as well. A master’s degree in cybersecurity can prepare you to be an expert-level professional. Learn how to conduct cybersecurity risk assessments and be brave in taking the appropriate action to prevent hackers from exploiting infrastructure weaknesses for malicious intent.
Recommended Reading
Why companies everywhere are boosting cybersecurity efforts
What we learned from infamous hacking incidents
Sources
Deloitte, “COVID-19’s Impact on Cybersecurity”
National Law Review, “SEC Issues Cybersecurity Risk Alert on Ransomware”
PricewaterhouseCoopers, “Toward New Possibilities in Threat Management”
Sage Data Security, “6 Steps to a Cybersecurity Risk Assessment”