Part 2 Good Practices for Cyber Risk Management To manage cyber risk and assess cybersecurity preparedness of its critical operations, core business lines and other operations, services, and functions organisations may choose to use standardised tools that are aligned with common industry standards and best practices. Our preference is the National Institute of Standards and […]
Operational resilience is the ability to deliver operations, including critical operations and corebusiness function, through a disruption from any hazard. It is the outcome of effective operational risk management combined with sufficient financial and operational resources to prepare, adapt,withstand, and recover from disruptions. Any organisation that operates in a safe and sound manner is able […]
Information Technology is a core business operation, it is now essential to most business operations. Technical staff – IT Mangers, Chief Information Officers, Chief Information System Officers now are being engaged by senior management and the board. Working at this level, board members are from all backgrounds and experiences, and you may be lucky to […]
Steps to cyber risk assessment
Once that’s completed here are the steps needed to undertake a cyber risk audit.
1. Identify threat sources and events
2. Identify vulnerabilities and how they may be exploited
3. Estimate the likelihood of these threats occurring
4. Evaluate the potential impact on your business if they do occur
5. Determine the degree of risk involved
6. Rank the risks in order of priority
7. Prioritise actions and responses to critical risks
Without a prepared strategy in place, your exit from the failed relationship may be more akin to jumping out of the window of a burning building, rather than a calm exit using the stairs. Both get you out of immediate danger, but one is much more likely to end in a painful landing.
Action Item Checklist Function Summary Description User Name and Password Protection Strictly enforce robust password security as per NIST Standards that include Upper and lower case letters, numbers and symbols Minimum of 8 characters, avoiding common words and dates Password not used for any other log in’s Changing passwords regularly – 3 months Using 2 […]
We are currently working with two large companies and it is interesting on my behalf on how little emphasis there has been on asset registers. An asset register of IT equipment is one of the foundations of your IT systems and security, if you dont know what you own, then you dont know what keys […]
Much of the business discussion around cybersecurity relates to protection of key assets such as customer information and intellectual property, often after the news that another company has suffered a large data breach. While strengthening defenses against cyber attackers is important, companies also must be prepared to handle the reputational and financial hits that a […]
Employee Data Theft When most of us think about a cybercriminal, we usually think of a person from home, and probably not in your own country. But did you ever consider that a hacker could be inside your own organisation? While most business owners assume that attacks on their company, data, website or operations are […]
SME’s need advice and assistance in identifying and defining suitable actions to mitigrate the risk of Information Technology risks, data loss and the issues where the loss of an IT function brings to any organisation. Cyber crime poses a severe risk to all types of enterprises. Preventing these risks requires implementing initiatives based on both education and awareness.
You know you need a risk assessment to show that you’re secure and to find the problems that expose your enterprise to risk. But how do you sell your CEO or the board on that expensive proposition?
Does your credit union lack the resources to hire or retain a full-time It Manager? Are your current IT expert(s) overwhelmed by their responsibilities? Have you ever wondered what virtual Chief Information Officer, vCIO as a service is? This post is for you! vCIO as a service is a unique approach to providing consultation around […]
Every organisation should take a fresh look at the impact specific cyber events can have and whether management’s response plan is properly oriented and sufficiently supported. This review includes an assessment of internal processes and capabilities to determine whether proactive steps should be taken to make necessary improvements — both near term and long term.
The key to mitigating IT risks is to minimise the harm they can cause. One way to manage risks is for boards to set up policies and procedures to reduce risks. Non-profit boards can also transfer some degree of risk by purchasing the appropriate insurance policies or by outsourcing some activities
