Explained: Why you should take a risk-based approach to cyber security

In an ideal world, a business would use every security technique available to protect against every possible cyber threat. But, in reality, that’s not realistic nor economically viable. 

Businesses don’t want to overspend on security they don’t need, but at the same time, they can’t afford to leave themselves exposed. It’s about finding the right balance between resource and resilience – something the vast majority of small to medium-sized organisations struggle to achieve. 

This is where a risk-based approach comes in. It allows businesses to understand the relative value of the information assets they hold and the threats those information assets face. Armed with this insight, they can focus resources – money and people – on the most valuable assets and at-risk areas. The great thing about a risk-based approach is it provides traceability to the business as to why you have invested in these areas.

What is a risk-based approach to cyber security?

Taking a risk-based approach simply means identifying, evaluating and prioritising the cyber risk threats the business and its information are exposed to – and making decisions about your cyber security programme accordingly. 

The approach involves creating a cyber risk profile unique to the organisation and from this, an effective cyber security strategy can be put in place based on the resources available. If a business already has cyber security measures in place, it can identify weaknesses or areas that are being over-protected. 

Ultimately, this allows businesses to design and deploy a cyber security programme that fits their risk profile precisely. 

The different cyber threats businesses face: 

The number of cyber attacks being launched against businesses is very much on the rise, but so too is the size, intensity and sophistication of these attacks. This means businesses are more exposed than ever before, with an attack often a case of “when” not “if”. 

These are just some of the different cyber attack types that businesses can be subject to: 

• Distributed Denial of Service (DDoS)
• Ransomware
• Malware
• Phishing
• Spoofing.

Different businesses are more likely to be subject to one type of attack over another. An ecommerce website, for example, is likely to be hit by a DDoS attack to take it offline, while a recruitment company is more likely to be subject to phishing scams to access its databases. 

A successful attack will typically involve reconnaissance prior to the attack being launched, so hackers know exactly which attack types the company is most exposed to and will feel the most pain from. 

How businesses can create their own cyber risk profile:

Generating a cyber risk profile doesn’t have to be complex. CRMG’s Risk Genie gives businesses the information they need to drive a cyber security programme that’s based on real business risk. 

Using our web interface, businesses follow a straightforward process which is underpinned by our Threat/Control Matrix to help organisations understand, prioritise and address the cyber risks relevant to each of their systems. 

This generates a detailed picture of current threats and the most important controls and actions needed to minimise the business’ exposure. In short, a risk-based approach to cyber security made simple. 

How to transition to a risk-based approach:  

Cyber security is often seen as an IT problem, but genuine resilience requires business buy-in from the Board all the way down to the newest member of the team. 

This is certainly the case when moving to a risk-based approach. In addition to having the right cyber technologies and products in place, engaging managers, employees, freelancers and even suppliers is vital. 

This can be achieved by leveraging support from the Board and executive management to create a cyber risk-aware culture across the business. Training is also a must, ensuring that everyone understands the part they play in ensuring resilience. 

This can be supported by cyber champions across various areas of the business. It really comes down to viewing cyber resilience as being collaborative, with each member of staff playing an important role in protecting the business and its information assets as well as understanding that a major cyber attack could impact them as individuals significantly (sometimes in terms of direct negative career impact). 

Ready to take a risk-based approach to cyber security? 

If you’ve read this far, chances are you are ready to take a risk-based approach to cyber security. Click here to contact a member of the CRMG team to discuss how we can help your business become genuinely resilient.