How to minimize security risks: Follow these best practices for success

Data
breaches
wreak
havoc
on
businesses
across
the
globe,
especially
when
it
comes
to
cash.
According
to
a

recent
survey
conducted
by
IBM,
the
average
cost
of
a
data
breach
was
a
whopping
$4.24
million
for
organizations
surveyed.
And
for
some
organizations,
that
number
could
severely
compromise
the
success
of
the
business.

Jump
to:

Organizations
need
to
be
proactive
when
it
comes
to
protecting
their
IPs,
Certificates,
Storage
Buckets
and
web
inventory.
With
products
like
Internet
Intelligence
Platform,
Censys,
a
sponsor
of
this
post,
can
help
your
organization
have
the
most
comprehensive
inventory
of
your
organization’s
internet-facing
assets.

Being
proactive
is
the
answer

It’s
easy
to
focus
on
risk
response
when
it
comes
to
stopping
security
threats
in
their
tracks.
After
all,
every
second
an
incident
is
left
to
continue
adds
up.
While
response
is
critical,
making
moves
to
prevent
security
incidents
is
too.

In
a

recent
survey
conducted
by
OnSolve
and
Forrester,
52%
of
respondents
agreed
that
protective
risk
management
is
as
important
as
effective
risk
response.
This
means
doing
what
it
takes
to
effectively
manage
risks
before
they
become
active
threats.

Best
practices
for
security
risk
management

To
up
your
security
risk
management
game,
these
industry
best
practices
will
help
you
understand
and
mitigate
risks
before
they
take
hold.

Identify
the
risks
unique
to
your
organization

First,
you
must
identify
potential
threats
that
may
come
against
your
organization
by
performing
a
security
risk
assessment.
This
involves
evaluating
your
IT
systems
and
critical
networks
to
pinpoint
areas
of
risk.
After
the
assessment,
your
results
may
include
everything
from
poor
employee
password
hygiene
to
faulty
firewalls.

Implement
a
risk
management
strategy

Just
like
any
other
business
initiative,
you
need
a
plan.
Your
strategy
should
include
the
potential
risks
you’ve
identified
for
your
organization,
how
likely
they
are
to
occur
and
your
response
plan
in
the
event
of
an
active
threat.

This
strategy
should
be
communicated
to
all
potential
parties
involved
and
updated
at
least
quarterly
based
on
emerging
risks
that
threaten
your
business.

Enhance
your
security
measures

As
you
perform
your
risk
assessment
and
start
to
develop
your
risk
management
game
plan,
you’ll
discover
areas
where
current
security
measures
are
less
than
desirable.
You
can
take
the
necessary
action
now
to
eliminate
potential
threats
stemming
from
these
security
holes.
For
example,
perhaps
you
need
to
enable
two-factor
authentication
for
your
employees
or
enact
a
new
BYOD
policy.

Not
sure
where
to
start?
The
experts
at
TechRepublic
Premium
have
you
covered.
Here
are
three
in-depth
resources
to
guide
you
as
you
develop
an
ironclad
security
risk
management
program:
a
sample
risk
management
policy,
a
risk
assessment
checklist
and
a
cybersecurity
response
glossary.

Limited
time
offer
on
TechRepublic
Premium
subscriptions:
Get
a
30%
discount
off
an
annual
subscription
to
TechRepublic
Premium
by
using
the
code
bf22-30.
This
great
deal
ends
on
Dec.
7,
2022,
so
act
now,
and
start
getting
access
to
hundreds
of
ready-made
IT
and
management
policies,
hiring
kits,
checklists
and
more.

Risk
management
policy

Developing
a
solid
risk
management
strategy
isn’t
easy.
After
all,
there
are
many
moving
parts,
such
as
users,
data
and
systems.
However,
a
risk
management
policy
can
provide
you
with
the
guidelines
for
establishing
and
maintaining
appropriate
risk
management
practices.

This
sample
policy
discusses
everything
from
identifying
insurable
vs.
non-insurable
risks
to
establishing
incident
response
and
investigations.
You’ll
also
discover
guidelines
involving
implementing
controls,
monitoring
for
threats
and
conducting
risk
assessments.
Plus,
this
policy
can
be
customized
to
fit
your
organization’s
unique
needs.

Many
organizations
have
neither
personnel
nor
protocols
—
nor
time,
for
that
matter
—
to
keep
eyes
on
their
Internet-facing
entities.
With
its
newly
launched
Web
Entities,
Censys
is
giving
organizations
visibility
into
their
website
and
other
name-based
HTTP
content.
With
Web
Entities,
Censys,
a
leader
in
internet
intelligence
for
threat
hunting
and
exposure
management,
will
help
you
discover,
monitor,
assess,
and
triage
your
internet-facing
assets,
so
your
teams
can
better
defend
against
places
where
attacks
happen.

Checklist:
Security
risk
assessment

Conducting
a
security
risk
assessment
is
critical
for
understanding
areas
in
which
potential
security
threats
lie.
Begin
your
assessment
by
listing
all
of
your
critical
IT
and
business
elements,
including
your
physical
offices,
computers,
servers,
and
data.
Then
rank
each
of
these
elements
based
on
their
value
to
ongoing
operations.

This
simple
security
risk
assessment
guide
outlines
the
next
steps
you’ll
need
to
complete,
and
the
accompanying
checklist
provides
step-by-step
guidance
on
completing
foolproof
risk
assessments
within
your
organization.

Quick
glossary:
Cybersecurity
attack
response
and
mitigation

Sometimes,
a
lack
of
knowledge
can
be
a
serious
security
risk.
It’s
true.
One
employee
who
is
unaware
of
potential
security
risks
may
click
a
single
malicious
email
that
results
in
the
takeover
of
a
network.
The
more
your
team
understands
about
potential
threats,
cybersecurity
and
mitigation,
the
better
prepared
you
will
be.

This
quick
glossary
includes
a
range
of
cybersecurity
terms
and
their
definitions.
Familiarity
with
these
terms
will
help
you
and
your
team
protect
your
sensitive
business
data
before
and
during
a
security
incident.

Read
more
about
the
threats
uncovered
by
Censys’
state
of
the
art
web
scanning.
Then
click

here
to
learn
more
about
what
Censys,
a
leader
in
Attack
Surface
Management
solutions,
can
do
for
you
and
your
organization.

Limited
time
offer
on
TechRepublic
Premium
subscriptions:
Get
a
30%
discount
off
an
annual
subscription
to
TechRepublic
Premium
by
using
the
code
bf22-30.
This
great
deal
ends
on
Dec.
7,
2022,
so
act
now,
and
start
getting
access
to
hundreds
of
ready-made
IT
and
management
policies,
hiring
kits,
checklists
and
more.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts