How to Build a Cybersecurity Risk Management Process for Your Surrey Business

How to Build a Cybersecurity Risk Management Process for Your Surrey Business

While “risk frameworks” are not a concern for most small business owners in Surrey, Vancouver and Langley, they are for a handful.For most small business owners in Surrey, Vancouver and Langley, there won't be much sleep lost over “risk frameworks.” For a few, there will be a lot. They are concerned about the possibility of a phishing email being received by the wrong person, a supplier being breached, or a laptop being lost containing customer data. A cybersecurity risk management process converts those ambiguous concerns into a defined, prioritised listing of issues, owners and deadlines.

Cybersecurity risk management is a process of identifying threats, assessing their relative severity, determining a response and verifying that your response is still effective. It's not an "audit" or a "file in a file" that sits on a shelf. How it works and how a local business can implement it.

Why Risk Management Matters More Than Ever

Your business is likely to use more services from outside than it did five years ago. Your data comes into contact with cloud storage, email systems, payment systems, remote access and software vendors. All of those links are a potential vulnerability and if one of the vendors gets breached it can quickly become your issue.

Personal information regulations have also been strengthened. PIPEDA has a requirement for Canadian organizations to safeguard the personal information they gather and to report on any breaches. If there is no process in place, there is a tendency to forget to ask about something which the regulators, insurers or customers will ask later.

Step 1: Set the Scope and Identify Your Risks

First, determine what it is you are protecting. Identify critical assets: Customer records, financial information, email, line-of-business software, servers, laptops, and cloud accounts. Ask 3 questions about each one:

• What are the threats? Ransomware, phishing, stolen passwords, accidental deletion, mistakes by employees or staff, hardware failure, a power outage or even a flood.
• Where are the weaknesses? Common examples include not using multi-factor authentication, not having logins patched, sharing logins, and not using up-to-date firewalls. Vendors and suppliers can also be a point of vulnerability.
• What would the consequences be? Think about business interruption, lost revenue, legal/regulatory issues, and loss of customer trust.

If a threat aligns with a weakness and the consequence would be damaging, it's a risk to follow.

Step 2: Assess and Rank What You Found

All risks are not created equal. For each, make a guess at the probability and the impact it would have. For a small business, a simple high, medium and low scale is sufficient. Numerous teams document the results in a risk register, which is merely a shared document that lists each risk, its rating and who is accountable.

It is also the time to determine your risk tolerance, or how much risk you're willing to take before you do something about it. A medical office, which processes patient details, will not accept anything less than a medical office. If that line is clear, it is much easier to make decisions, as any that are above it will be acted upon and budgeted, and any that are below it will be ‘bought'.

Step 3: Decide How to Treat Each Risk

If you feel uncomfortable with a risk you have three choices:

1. Mitigate it. Implement controls to minimise the likelihood and impact. These can include multi-factor authentication, frequent patching, next generation firewalls, email filtering, endpoint protection, staff training and tested backups.
2. Transfer it. Take some of the risk in the contract with the vendors or cyber insurance.
3. Accept it. Accept it. If it's not a big risk, or the repairs are more expensive than the damage, record it and continue.

Despite good controls, there is some residual risk. That is normal. It is important that you know about it, and have a plan for the day it happens and what you would do to limit the damage and restore operations. A written incident response plan, along with immutable backups, can greatly help here.

For instance, if the vendor gets access to your production data and that is deemed to be of high impact, you might restrict access to their accounts to only what they need, require multi-factor authentication, and have insurance as a backup in case of any risk.

Step 4: Monitor Continuously

Every time you bring on a new vendor or add new software, hire new employees, or encounter a new regulation, your risk picture changes. This is why monitoring is the step which sustains the entire process alive. There are three things to monitor:

• Regulatory changes : Any changes in regulation that impact on handling personal information
• Vendor and supplier security: The security of vendors and suppliers, particularly for new vendors.
• Internal technology use: non-authorised app and forgotten accounts

Revisit risk register periodically and following any significant change or incident. Testing—vulnerability scans, backup restore exercises—provides a way of determining if controls are effective.

Use a Framework So You Aren’t Starting From Scratch

You don't have to come up with your own way of doing it. Basically, you have a framework you can use that is widely used, which provides you with a structure that you can use:

• NIST Cybersecurity Framework 2.0 has six functions of security: Govern, Identify, Protect, Detect, Respond, and Recover. It works well for any organization, regardless of size.
• The international standard for the management of information security is ISO/IEC 27001 and it defines how to conduct a consistent and repeatable risk assessment.
• NIST SP 800-30 offers a practical guide for conducting risk assessments in a structured way.

If you select one and adhere to it, you will have a common language, have a more defensible set of decisions, and be able to assist customers with questionnaires, insurance applications as well as insurance audits.

Risk Management Is a Team Effort

A common reason why programs don't work is everyone thinks that someone else has the problem. IT wants to go fast, compliance wants to adhere to regulations, sales wants to provide fast answers to customers, and leadership wants to minimize surprises. A good process provides clarity of priorities and responsibilities for each group. It's not just about staff awareness, either, as a wrong click can cost more than technology.

Where Local Businesses Get Stuck

The majority of the small and mid-sized businesses in Surrey and Vancouver area don't have a dedicated security team. The burden of running assessments, monitoring vendors, keeping controls and monitoring threats day and night is too much for one general IT person or an office manager. This is what a local partner will bring. An experienced consultant can then carry out the first assessment, assist you in determining your priorities and then help you implement the appropriate protections and monitor them after implementation and allow your staff to concentrate on running the business.

If you want to take the guesswork out of this process, our team provides cyber security services surrey businesses rely on, from risk assessments and layered defenses to monitoring, recovery planning and compliance support.

Frequently Asked Questions

What is cybersecurity risk management in simple terms?

This is a continuous exercise in determining what your business is doing to protect, what can go wrong, how bad it would be, and what you will do about it. You identify the risks, prioritize them, select a strategy for each and re-evaluate risks on a regular basis.

How is a risk assessment different from a risk management process?

One part of this process is an assessment. This is the stage that involves identifying risks and assessing the risk level and impact. The entire process includes risk treatment decisions, risk controls and ongoing monitoring to ensure your controls are current with your business.

Do small businesses really need a formal risk management process?

Yes. Smaller businesses are usually easier targets for attack, as they're assumed to be less well defended, and downtime and cost can be significant from a single attack. It doesn't need to be complex; just a document with a brief risk register will get things going. It doesn't have to be difficult to be effective.

What does “risk tolerance” mean?

Risk tolerance is the amount of risk your business will take before doing something. If a company processes sensitive client information, they will tend to have a lower threshold than one that has less information to deal with, particularly sensitive information. If it is defined in advance, it will be easier to determine which risks are important and should be addressed now and which ones can be managed later.

What are the options for dealing with a cybersecurity risk?

It can be reduced by implementing additional security measures like multi-factor authentication, patching, firewall, backup, and employee training. It can be shifted in part through the path of vendor contracts or cyber insurance. Or if it is low enough, it's OK to take it, but with documentation, it is okay.

What is residual risk?

The remaining risk (after the controls) is known as residual risk. It never goes down to zero so your objective is to be aware of how much you have left, manage it within your comfort level and have a response plan in place just in case it becomes a true event.

Which framework should a small business follow?

One of the most used frameworks is the NIST Cybersecurity Framework 2.0 as it is flexible and can be used for any size of organization. If you're interested in having a certifiable, formal information security standard, ISO/IEC 27001 is suitable. NIST SP 800-30 can also be helpful as a practical guide to conducting the assessment.

How often should we review our cybersecurity risks?

At least once a year, or whenever there is a major change in the environment, such as a new software program, a new vendor, a move to the cloud or an incident. Higher priority risks are regularly assessed by many businesses, every quarter.

How does vendor risk fit into this?

Any vendor who has access to your systems or data increases your risk. Review their security practices before hiring; only give them what they need and review them regularly. The weakness of a supplier can easily turn into your failure.

How can a local IT partner help with risk management?

A partner may conduct the initial assessment, assist in prioritizing, implementing, and managing protections, 24/7 monitoring of your environment, and compliance and incident recovery. This is particularly beneficial when you don't have an in-house staff of security guards.

FAQs