<p>Given growing concerns about cyberattacks and the effect of AI on cybersecurity, enterprise CISOs should periodically review and update their organization's cybersecurity plans and procedures.</p>
<p>Periodic assessments of cybersecurity plans, policies and procedures help ensure <a href="https://www.techtarget.com/whatis/definition/cyber-resilience">cyber resilience</a>, which defines an organization's ability to recover and resume operations following a cyberattack. Organizations should conduct such assessments regularly to ensure cybersecurity programs meet their objectives and are prepared in the event of an attack.</p>
<p>This article provides guidance on preparing and conducting a cyber-resilience assessment, and includes activities to improve an organization's cyber-risk posture.</p>
<section class="section main-article-chapter" data-menu-title="What a cyber-resilience assessment evaluates">
<h2 class="section-title"><i class="icon" data-icon="1"></i>What a cyber-resilience assessment evaluates</h2>
<p>The following sections summarize information to collect and issues to address during a cyber-resilience assessment.</p>
<h3>Business context</h3>
<p>Determine the organization's <a href="https://www.techtarget.com/it-strategy/feature/Risk-appetite-vs-risk-tolerance-How-are-they-different">risk tolerance</a> for business-impacting events. For example, include acceptable levels of disruption, such as acceptable downtime, acceptable data loss and financial impact thresholds.</p>
<h3>Cybersecurity risks</h3>
<p>List the risks and threats that could enable cyberattacks, as well as systems to protect. Consider the following:</p>
<ul class="default-list">
<li>Employees.</li>
<li>IT systems.</li>
<li>Business processes.</li>
<li>Communications and network services.</li>
<li>Desktop and other edge systems.</li>
<li>Data storage facilities.</li>
<li>Cybersecurity management systems.</li>
<li>Network perimeter protection systems.</li>
<li>Facilities systems, such as fire detection and suppression, building security, access control, HVAC systems and utilities.</li>
</ul>
<h3>Potential cyberattacks</h3>
<p>Create a list of potential cyberattacks and vulnerabilities based on the current threat landscape. Consider how the organization assesses its specific risks, for example, by performing the following tasks:</p>
<ul class="default-list">
<li><a href="https://www.techtarget.com/cybersecurity/tip/How-to-perform-a-cybersecurity-risk-assessment-in-5-steps">Cybersecurity risk assessments</a> to identify the latest risks and threats. These could include phishing, DDoS and <a href="https://www.techtarget.com/cybersecurity/definition/What-is-ransomware-Definition-and-complete-guide">ransomware</a> attacks, as well as risks to critical infrastructure and supply chains.</li>
<li>Vulnerability assessments to identify where the organization's technology ecosystem might have points of failure or pathways for unauthorized access.</li>
<li>Penetration tests to further identify potential vulnerabilities and failure points.</li>
</ul>
<h3>Business impact of a cyberattack</h3>
<p>Identify how cyberincidents could affect revenue, operations, safety, compliance, customer trust and the firm's reputation. Establish which event characteristics could have the greatest impact — for example, attacks on mission-critical systems and services the organization provides.</p>
<h3>Attack entry points</h3>
<p>Identify where attacks could infiltrate the network. Threat vector access points might include:</p>
<ul class="default-list">
<li>Unprotected access points in the network.</li>
<li>Vulnerable remote access technologies.</li>
<li>Phishing and social engineering scams.</li>
<li>Infected files and compromised code.</li>
<li>Rogue employees who provide access to unauthorized users.</li>
</ul>
<h3>Dependencies</h3>
<p>Determine the dependencies and interdependencies the organization maintains:</p>
<ul class="default-list">
<li>Identify and map upstream and downstream dependencies for business and technology infrastructures, including regulatory and standards compliance and corporate governance.</li>
<li>Identify applications, data flows, mission-critical systems, supply chains, cloud services, vendors and shared infrastructure.</li>
</ul>
<h3>Incident response</h3>
<p>Examine and assess how the organization prepares for and responds to cyberattacks. Gather the following:</p>
<ul class="default-list">
<li>Cybersecurity policies that address various cyberattack scenarios.</li>
<li><a href="https://www.techtarget.com/cybersecurity/feature/How-to-build-an-incident-response-plan-with-examples-template">Incident response plans</a> that define how to capture malicious code for analysis and cybersecurity.</li>
<li>Playbooks that document procedures from initial detection to resolution and reporting.</li>
<li>Event management guidance that documents the
<p>Periodic assessments of cybersecurity plans, policies and procedures help ensure <a href="https://www.techtarget.com/whatis/definition/cyber-resilience">cyber resilience</a>, which defines an organization's ability to recover and resume operations following a cyberattack. Organizations should conduct such assessments regularly to ensure cybersecurity programs meet their objectives and are prepared in the event of an attack.</p>
<p>This article provides guidance on preparing and conducting a cyber-resilience assessment, and includes activities to improve an organization's cyber-risk posture.</p>
<section class="section main-article-chapter" data-menu-title="What a cyber-resilience assessment evaluates">
<h2 class="section-title"><i class="icon" data-icon="1"></i>What a cyber-resilience assessment evaluates</h2>
<p>The following sections summarize information to collect and issues to address during a cyber-resilience assessment.</p>
<h3>Business context</h3>
<p>Determine the organization's <a href="https://www.techtarget.com/it-strategy/feature/Risk-appetite-vs-risk-tolerance-How-are-they-different">risk tolerance</a> for business-impacting events. For example, include acceptable levels of disruption, such as acceptable downtime, acceptable data loss and financial impact thresholds.</p>
<h3>Cybersecurity risks</h3>
<p>List the risks and threats that could enable cyberattacks, as well as systems to protect. Consider the following:</p>
<ul class="default-list">
<li>Employees.</li>
<li>IT systems.</li>
<li>Business processes.</li>
<li>Communications and network services.</li>
<li>Desktop and other edge systems.</li>
<li>Data storage facilities.</li>
<li>Cybersecurity management systems.</li>
<li>Network perimeter protection systems.</li>
<li>Facilities systems, such as fire detection and suppression, building security, access control, HVAC systems and utilities.</li>
</ul>
<h3>Potential cyberattacks</h3>
<p>Create a list of potential cyberattacks and vulnerabilities based on the current threat landscape. Consider how the organization assesses its specific risks, for example, by performing the following tasks:</p>
<ul class="default-list">
<li><a href="https://www.techtarget.com/cybersecurity/tip/How-to-perform-a-cybersecurity-risk-assessment-in-5-steps">Cybersecurity risk assessments</a> to identify the latest risks and threats. These could include phishing, DDoS and <a href="https://www.techtarget.com/cybersecurity/definition/What-is-ransomware-Definition-and-complete-guide">ransomware</a> attacks, as well as risks to critical infrastructure and supply chains.</li>
<li>Vulnerability assessments to identify where the organization's technology ecosystem might have points of failure or pathways for unauthorized access.</li>
<li>Penetration tests to further identify potential vulnerabilities and failure points.</li>
</ul>
<h3>Business impact of a cyberattack</h3>
<p>Identify how cyberincidents could affect revenue, operations, safety, compliance, customer trust and the firm's reputation. Establish which event characteristics could have the greatest impact — for example, attacks on mission-critical systems and services the organization provides.</p>
<h3>Attack entry points</h3>
<p>Identify where attacks could infiltrate the network. Threat vector access points might include:</p>
<ul class="default-list">
<li>Unprotected access points in the network.</li>
<li>Vulnerable remote access technologies.</li>
<li>Phishing and social engineering scams.</li>
<li>Infected files and compromised code.</li>
<li>Rogue employees who provide access to unauthorized users.</li>
</ul>
<h3>Dependencies</h3>
<p>Determine the dependencies and interdependencies the organization maintains:</p>
<ul class="default-list">
<li>Identify and map upstream and downstream dependencies for business and technology infrastructures, including regulatory and standards compliance and corporate governance.</li>
<li>Identify applications, data flows, mission-critical systems, supply chains, cloud services, vendors and shared infrastructure.</li>
</ul>
<h3>Incident response</h3>
<p>Examine and assess how the organization prepares for and responds to cyberattacks. Gather the following:</p>
<ul class="default-list">
<li>Cybersecurity policies that address various cyberattack scenarios.</li>
<li><a href="https://www.techtarget.com/cybersecurity/feature/How-to-build-an-incident-response-plan-with-examples-template">Incident response plans</a> that define how to capture malicious code for analysis and cybersecurity.</li>
<li>Playbooks that document procedures from initial detection to resolution and reporting.</li>
<li>Event management guidance that documents the
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
This article has been indexed from Search Security Resources and Information from TechTarget
Read the original article: