What's Involved with a Cybersecurity Assessment?

“Do we need a cybersecurity assessment?” That’s what business leaders are asking as they wonder if their organization has gaps in their cybersecurity posture. Sometimes there’s a lack of confidence in the abilities of their IT team to stand up an effective cyber defense. More often than not, the decision to conduct a cybersecurity assessment has to do simply with the desire to get an objective view of what’s really going on with security.

Whether you have a technical background or not, a cybersecurity assessment can answer a lot of questions, especially those that you didn’t think to ask. These are questions like:

Are we correctly managing administrator rights?
Is our old hardware creating security vulnerabilities?
Do our Wi-Fi access points use default passwords?
Is our third-party software being patched?
Are our firewalls configured properly?

Fortunately, you don’t need to know all the questions to get the answers you need to improve security. You just need a cybersecurity assessment. Let’s go through what an assessment entails, starting with the report.

The Report – Cybersecurity Recommendations

The product that you get from a cybersecurity assessment will be a lengthy report that contains a list of vulnerabilities along with a ranking of their severity, from low to critical. The recommendations that come out of the report prioritize items that are critical vulnerabilities.

Essentially, the recommendations tell you how you can reduce your potential attack surface. Here are a few examples of common recommendations that frequently come up.

Remove administrator rights off of individual user computers.
Replace hardware that doesn’t utilize a supported operating system or software.
Replace default passwords on Wi-Fi access points with strong passwords.
Establish schedule for updating third-party software.
Configure firewalls so that they are hardened.

Can you see how these recommendations match up to the questions we mentioned previously?

The Assessment Process

A cybersecurity assessment report is the result of the gathering and analyzation of lots of data. The data is compiled from three main sources: interviews, external vulnerability scans, and internal vulnerability scans.

1. Interviews

A few conversations with business leaders and perhaps your IT manager, kick off the assessment process. Some executives decide not to include IT in this stage because they don’t want them to know that they’re conducting an assessment.

Most IT managers are actually happy to participate in the assessment process because they understand that they can’t know everything, and the report will only help them to be more successful at what they do. If you have such low trust in your IT team, there are probably other problems that you need to take care of with IT in addition to cybersecurity.

Some of the questions that are addressed in this initial conversation can include:

What immediate concerns do you have about security?
Do you have regulatory compliance requirements?
How is access to data and IT systems controlled?

The assessor will also ask some questions to discover if you have factors that affect your risk profile and tolerance. For example, having a high-profile CEO could increase your cyber risk.

2. Testing for External Vulnerabilities

Scanning your systems to see if there are any ungated entry points on the outside is a straightforward process. Essentially, the scan is looking for any external facing application that can be compromised. These are things like a website, or technologies used by remote workers like Remote Desktop or a Virtual Private Network.

3. Testing for Internal Vulnerabilities

You might think that an external scan is enough to locate any vulnerabilities, but it’s not. Cyber criminals have all kinds of tactics that they use to get into IT systems. They don’t just look for the computer ports that handle network traffic. They look at the devices that are connected to your network.

Internal vulnerability scans require access to your network via a computing device along with a company account and password. This credentialed access is necessary to get the level of detail that’s needed to uncover weaknesses.

Internal scans look for everything that is connected to your network – every workstation, scanner, printer, server, and device. Once found, the scan examines the device to answer questions like:

Is the software on this device up to date?
Have default passwords been changed?
Is antivirus or anti-malware installed?

These are the easy questions. An internal vulnerability scan is going to go deep into the technical weeds of your network and compile a report that could extend 30 pages or more. Whether you’re technical or not, this is going to be eye-opening because you don’t need to be an IT expert to understand the difference between critical and not critical.

Implementing Cybersecurity Recommendations

With your cybersecurity assessment recommendations in hand, you’re ready to make your plan to improve security. Sometimes this part is just as eye opening as the report because you need to contemplate whether your IT team can do everything that needs to be done.

What many small businesses are finding is that they need to bring in expertise that they don’t have internally and that’s where outsourced cybersecurity services come in. Not only does outsourcing bring you the security tools and staff that you need to stand up a solid defense, you can ramp up security fast.

Outsourced Cybersecurity Services for New Orleans Businesses

Bellwether provides Managed Cyber Defense services for New Orleans companies who understand that managing cyber risk is a requirement for business sustainability. We work with companies to create and implement cybersecurity strategy that covers all the bases, and creates resilience so that if and when something happens, they can bounce back strong.

Is Bellwether Managed Cyber Defense right for you? Schedule a cybersecurity assessment and you’ll not only discover where you have gaps in security, but you can get a taste of what it might be like to work together.

Schedule a cybersecurity assessment.