A Cybersecurity Assessment, simply put, is an evaluation of your organisation’s readiness to deal with a cyber incident.
These assessments gauge the level of risk your organisation faces as well as examine where the major loopholes lie in your cybersecurity infrastructure, plans and processes.
As cyber threats are evolving and becoming more complex and virulent with every passing day, it is critical that all businesses look at investing in regular cybersecurity assessments. This is the only effective way to keep on top of cyber threats, ensure that your cybersecurity strategy is strong enough to deal with potential cyber risks and ensure business continuity.
While traditional cybersecurity audits, for example the ISO 27001:2013, definitely hold weight and are important to demonstrate how you manage information security to external stakeholders, in this post I have tried to focus on assessments that give you a faster and, in many instances, a more contextual picture. These assessments are easily accessible and can make a huge difference to your cybersecurity posture this year:
1. Cyber Essentials:
Cyber Essentials (aka CE) is a UK-government backed certification scheme that allows businesses to ensure that they're safe from the most common cyber threats and demonstrate commitment to the cyber safety of their business information and the sensitive data of their customers.
It’s important to mention CE and call out that the UK Government’s intention is laudable. ISO 27001 and NIST in most cases have been and can be highly complicated for micro, small and medium businesses. Enter Cyber Essentials. It may be a compact assessment, but it is ‘powerful’ and relevant enough to highlight the key and foundational gaps an organisation may face.
The certification is available in two forms - Cyber Essentials (a self-assessment) and Cyber Essentials Plus (this includes a technical verification). The Self-Assessment is one of the easiest ways to ensure that you’re protecting your business against the most common cyber threats.
A lot of the common/unskilled cyber criminals on the internet are looking for easy targets that don’t have the Cyber Essentials controls in place. Once you do get the Cyber Essentials or Cyber Essentials Plus certification, you can enjoy at least enough peace of mind to know that you are well protected against the most common and easily preventable attacks.
Cyber Essentials is also one of the easiest ways to assure new customers or business partners that they’re working with an organisation that’s committed to cybersecurity and that the organisation has its foundational controls under review.
2. NIST Health Check:
As the name suggests, a NIST Health Check is an assessment of your organisational cyber health and resilience against the NIST Cybersecurity Framework. NIST Health Checks are typically time and cost-effective.
At Cyber Management Alliance, the process for a NIST Health Check is fairly straightforward: You will be given a self-assessment questionnaire to fill out. A cybersecurity expert is then assigned to your business who goes through the details filled out with you. Over a short period of time, generally a day, the expert conducts a high-level review of your key documents and artefacts and gives you a formal assessment report.
The report will highlight the cybersecurity expert’s opinion on your overall compliance and incident response maturity, apart from identifying vulnerabilities. It will also contain recommendations on how to patch up any deficiencies that require urgent attention.
The NIST Health Check is ideal for those organisations who want to kick start their journey towards complete cyber resilience with an actionable improvement plan.
3. Ransomware Readiness Assessment:
As the name suggests, this assessment is targeted specifically at evaluating your organisation’s ability to respond to and contain a ransomware attack - the number one growing concern in the world of cybersecurity today.
A Ransomware Readiness Assessment is the quickest way to validate your security investments and check if your technology infrastructure is up to scratch. It also helps you identify gaps in your existing ransomware strategies, apart from helping you understand specific issues in your plans and processes.
This Assessment checks how you handle key technology aspects such as user access and management, Web Browser Management and DNS Filtering, Patch and Update Management, Application Integrity and Allowlist, Robust Data Backup and Network Perimeter Monitoring etc.
The Ransomware Readiness Assessment is becoming increasingly important given the exponential rise in ransomware attacks and their extremely damaging outcomes for business.
The Assessment is a great way to know if your ransomware readiness aligns with your organisation’s specific threats, threat actors and risk mitigation strategies. You also get personalised recommendations on ways to boost detection and response capabilities.
4. Breach Readiness Assessment:
A Breach Readiness Assessment is a more comprehensive and score-based, focussed evaluation of your organisation’s breach readiness capabilities. It seeks to answer one straight question - Are you prepared for a data breach?
This assessment looks at the breach readiness capability of a specific group of people and gauges how they react in a specific cyber-attack scenario targeted at a distinct, critical asset.
We normally conduct the Breach Readiness Assessment in conjunction with a Cyber Crisis Tabletop Exercise. During the exercise, the participants are observed and scored against a fixed set of criteria.
This cybersecurity risk assessment is a cost-effective way to demonstrate how a particular group of staff members will respond to a cyber crisis. It is also important to satisfy current and future regulatory requirements with least disruption to business operations.
5. SIEM Use Case Assessment:
An extremely critical cybersecurity audit, the SIEM Assessment looks at how your SIEM system is configured and assesses the operational aspect of the SOC team.
Use Cases trigger alerts for malicious activity and it’s important that existing use-case logic and configurations are effective. The SIEM Use Case Assessment also evaluates this key aspect of your cyber capabilities. There will also typically be a review of monitoring standards and policy, along with a review of incident triage, investigations and analysis.
Conducting a SIEM & Use Case Assessment for your organisation can be very effective in understanding how your approach to log management aligns with NIST's Computer Security Incident Handling Guide: NIST SP 800-61 Revision 2.
It can also help you determine if your current SIEM implementation and configuration are fit-for-purpose.
5. Cyber Incident Response Maturity Assessment:
This is the most comprehensive, evidence-based assessment of your organisational cyber resilience and cybersecurity crisis readiness.
This cybersecurity assessment is not just based on an interview with stakeholders. It digs deeper into every in-scope artefact and also examines your SIEM configuration, security controls, technology stack implementation and SOC operations.
The formal report that we give at the end of the Cyber Incident Response Maturity Assessment can give the business a comprehensive overview of its cyber-resilience maturity measured against easy-to-understand NIST-based Incident Handling categories. You can also understand how your approach to incident response aligns with ISO 27001:2013’s Annex A.16.1, Incident Management Lifecycle.
While there are many cybersecurity audits and assessments that your business can invest in, the above cover all key aspects of cyber resilience that you may need to investigate.
Conducting these assessments on a regular basis can ensure optimal cybersecurity health for your business and can keep you on track with the right technology investments and incident response plans and procedures.
