Part 2: Evaluating Your Company’s Cyber Posture

In our previous post, we discussed the key differences between cyber posture and cyber risk management. Cyber posture – a measure of your resilience to cybersecurity threats – is a crucial marker of your company’s well-being that reflects the strength of your defenses and the readiness of your cybersecurity team.

Evaluating the cyber posture of your company is an absolute must. Unsure where to begin? Here’s what you need to know about the how of determining your company’s cyber posture.

Evaluating Cyber Posture: Internally and Externally

Evaluating your company’s cyber posture requires a set of strategies which can be classified into two key approaches, and both are essential to building a strong cybersecurity roadmap. The first approach is internal to your company and demands an honest assessment of your organization.

• Data Assessment: This begins with accounting for your most sensitive data. Who in your organization has access to which information and how is it handled? Whether that’s an upcoming fashion line, pricing data or a soon-to-be-announced promotion, who in the chain of command is privy to which information? If you’re unable to answer these basic questions or identify the most sensitive data in your vertical expertise, protecting your data will be impossible.
• Incident Response: Many companies fail to take the preemptive step of creating incident response (IR) documentation, but waiting for a vulnerability to be exploited before articulating a response plan is no longer viable. How prepared is your company for the next incident – i.e., do you have clear IR procedures in place? Plus, what are some of the steps that can be automated as part of an IR policy to various threats? For example, when should IR procedures call for closing web interfaces, and when is it more ideal to secure them but keep them open?
• Security Controls: Are your company’s security controls set up? Ensuring as much is vital for finding potential vulnerabilities and keeping your company safe. Without controls, your other efforts will be for naught.
• Employee Education: Your cyber posture will only be as strong as its weakest link, and all too often the weakest links are your company’s employees. In most retail businesses, employees have the authority to process the returns of goods, and in one such case a dishonest employee operated a return fraud scheme on the dark web, enabling people to submit fraudulent refunds. In addition, it’s impossible to underscore the relationship between human error and cybersecurity. Maintaining a robust cyber posture requires a healthy security culture and a highly engaged team that’s committed to learning.

While looking inwardly is clearly crucial, it’s ultimately not enough. The second approach is external: you also have to go beyond your company’s walls to gain an outsider’s perspective to begin strengthening its cyber posture. Each of these strategies has a common aim of placing your company one step ahead of potential hackers.

• Attack Simulation: PenTests and other white hat hacker techniques reveal the readiness of your company’s defenses. For many companies, PenTests are a much-needed wake-up call. As industry experts have begun to realize, “nothing beats the real thing.” Data breach emulation can prepare your company like nothing else.
• Bring in Cybersecurity Experts: Employee education is a crucial piece of the external review, including bringing in experts to help improve employee awareness of cybersecurity beyond the very basics, helping them brush up their knowledge. Workshops, quizzes, and games can be an effective part of preparing your team with online resources such as PwC’s Game of Threats, Apozy’s Security Checkups, and Logical Operations’ CyberSAFE Readiness Test.
• Advanced Security Solutions: Relying on employee education alone is never enough; investing in advanced technology and/or cybersecurity solutions is needed to manage your threats and vulnerabilities proactively.
• 3rd Party Vulnerability: A vulnerability in one of your vendors can be exploited by hackers to gain access to your company’s data. For example, earlier this year hackers compromised millions of credit cards used at Saks and Lord & Taylor stores through a weakness in a point-of-sale (POS) system. Before doing business with a vendor, ask about their cyber defenses to ensure they aren’t creating security risks for your company.

The Ongoing Work of Cyber Defense

With cybercriminals constantly developing new ways to exploit vulnerabilities, evaluating your company’s cyber posture is in no way a one-time challenge. Continuously adapting with both internal and external assessments is the name of the game. Neglecting either approach will leave you vulnerable.

CyberInt’s team of experts utilize a unique strategy of looking at your company through the eyes of hackers, providing invaluable insight into the state of your defenses. Contact us for a free consultation to evaluate and strengthen your cyber posture.