In 2021, we’re navigating both longstanding and unique security issues that undermine the time and money invested in a robust security posture. From weakened networks compounded by poor WFH practices to sophisticated and layered phishing campaigns, there are many factors that threaten the work we do today.
In fact, around 80% of senior IT employees and security leaders are convinced their companies lack adequate protection against cyber attacks despite increased IT security investments in 2020.
In a post-pandemic environment, then, how do traditional security assessments need to change to capture all-new risks?
In the words of Arthur Grollman, “Hurricanes, AIDS and Ebola are not just physical epidemics from nature but also cyber epidemics that ravage the IT infrastructure.” The very same can be said for COVID-19.
These issues are never one-dimensional and have a major impact on the work we do, and that much is clear when you look at the escalation of risks we’re seeing today.
What this means for the security assessments is that they now need to capture a wider variety of risks and assess every procedure and process we use on a daily basis.
Identify an updated list of threats and vulnerabilities
If your teams are still operating remotely or did at some point in the last 1.5 years, your networks and systems may be harbouring certain vulnerabilities.
In these instances, it’s definitely a good idea to carry out a quick cyber risk analysis and get an idea of the current risks you face and the overall preparedness of your systems.
You can also consult threat libraries and other resources to help you map how real-world attacks are occurring and identify which of your systems’ and networks’ touchpoints may be at risk.
Map out your worst-case scenarios and prepare for them
Part of assessing your risk in the new normal also involves plotting out what could go wrong and what you can do in these instances.
A best practice, here, is to look at how your existing threats or vulnerabilities could be exploited to gain access to your resources and assets. This contextualises the threats you face and helps your teams identify what’s at risk and how to prepare for these kinds of outcomes.
Especially in terms of WFH networks and settings, it’s important to understand how home networks can be exploited and their immediate fallouts, so you’re not caught unprepared.
Understand the impact and likelihood of these risks
In addition to plotting out the novel ways in which your vulnerabilities can be exploited, it’s important to understand how it will impact your operations and how likely it is for these scenarios to occur.
The likelihood, in particular, will need to be evaluated by considering the nexus between exploitability, reproducibility, and discoverability. While past patterns and your risk history can be insightful, it should not be your sole, or even main, point of reference.
When considering and assessing impact, explore the consequences of a threat that exploits a vulnerability and the impact this has on access to and the integrity of each of your assets.
In this process, consult various stakeholders and internal experts to gain a holistic understanding of the fallouts of a potential breach.
Document your risks and prioritize your remediation efforts
Prioritizing your risks is another important step in a post-pandemic security sweep of your networks, systems, and teams.
Based on the likelihood and the impact it has on your organisation, determine which risks and vulnerabilities need to be shored up immediately. There are many ways this, in turn, can be done, the most direct being to address the threat.
You can also share this risk with external agencies including your cyber insurance company or eliminate certain procedures or tools that run more risk than the advantages they bring in.
Once you’ve identified your risks and prioritized their remediation, documenting these in a central location and updating them periodically is another best practice.
This way, it’s easier to compare it against your current efforts, the progress you’ve made remediating that risk, existing levels of risk, accepted thresholds and other indicators that help you keep track of your overall exposure.
Assess all-new risks in a post-pandemic world with security assessment best practices
At a time when many businesses are scrambling to adopt best practices and secure their networks, a risk assessment may seem like an ineffective tool against the tide of cyberattacks we’re seeing.
Nonetheless, thorough, technology-driven and expert-led assessments in the new normal can shed light on critical areas of risk that would otherwise compromise the investments you make to secure your posture.
With powerful solutions like cybersecurity rating platforms and targeted strategies that cover every element of your operations—including your vendor ecosystem—staying secure can just be another part of the work you do.
