There’s a lot of security jargon floating around in the news. Security experts tend to speak their own technical language, and often they use terminology that seems familiar. But often, IT security uses specific contexts for security terms.
As you start thinking more and more about cybersecurity strategy going forward, you should understand the context of the terms to understand why they are business concerns and know how to properly communicate with your IT security team (or security auditors). (Note: if you are concerned about whether your current IT support team is addressing your security, many business opt for a third party security assessment.)
By the end of this post, you should be able to understand 5 key terms in computer security. And more importantly, be able to discuss why these terms are important:
Information—I want to start with information because it may have many definitions, depending on your context. Cybersecurity’s core objective is to information safe, whether it is a medical record, social security number, or banking information.
Information comes in many forms and from many places. Your business is required (in most cases) to keep sensitive information safe. The problem is that those sensitive records have particular value to criminals. Just to put in perspective how much value a single record has on the dark web (where cybercriminals sell information), take a look at this list:
Date of Birth: $11
Health Record: $50
Social Security Number: $30
Credit card number: $2 to $90
Remember these values are just for individual records! If you have tens or hundreds of employees, you probably are storing their sensitive data somewhere.
That also goes for client info. Identifying where information is stored on your network and understanding how it is being protected is one of the primary concerns your IT support team should be constantly thinking about.
Do you keep track of where your sensitive information is stored? Is that information encrypted? Do users on your team have unwarranted access to any of it? Knowing where this information is at all times and who has access to it are some of the first steps in mitigating risks of data breaches and leaks of your most sensitive files!
Threat— A threat is anyone or anything that can do harm to some part of your business. You can think of threats as hackers or hacktivists. But a threat does not need to have an intent to do anything malicious. A threat may be something that may be important to keeping your business running, and if damaged or broken, could cripple operations. Perhaps an old server on its last legs or a power outage if you don’t have appropriate measures to either work from the cloud or from a backup power source.
The bottom line: threats tend to disrupt business functionality and IT support and security need to identify threats—be they processes, equipment or cyber, and have strategies to rid your business from the threat or to at least mitigate the risk of the threat negatively impacting your business. The purpose of your IT Support is to identify where risks lie within your network infrastructure and present strategic solutions to mitigate your security risks.
Vulnerability— A vulnerability is a flaw or weakness in the design or implementation of process, communication or IT infrastructure that could lead to a threat undermining your security. An example of a common vulnerability on many business networks is an improperly system configuration.
When I perform security assessments for potential clients, I often see a default administrative password used across the network. Hackers know all of the default passwords and will have an easy time cracking into your network if your passwords aren’t secure.
Another very common vulnerability I see is that most businesses do not have an accessible copy of their backed up data (or their data is not getting backed up properly—even though they are assured it is). IT Security and Support teams need to test their backups regularly to ensure that in the unfortunate event that something goes down, that you can restore your systems and get back to work quickly—if not tested regularly, back up restores may take weeks or months to get your team back running (costing you much more than the original outage!).
Risk— Risk is the probability that a threat will take advantage of some vulnerability on your network. While vulnerabilities are happening right now, risk is a vulnerability’s possible future.
Let’s say that you only have one copy of your critical payroll data on a main computer. If you lose that file on the main computer, you risk not being able to run payroll for last month (yikes!). With no known backup, your risk of not being able to successfully run payroll goes up considerably.
You should expect IT Support to communicate risks with you and your leadership and come up with strategies to alleviate risks. One of the easiest ways you can assess the current state of your network is by identifying what security flaws—for instance, unpatched software, out-of-date antivirus, old routers, and poor administrative passwords—may lead your business to risk cyberattacks. Your IT Support should then outline steps to remediate your vulnerabilities with actionable security measures.
Mitigation and Compensating Controls—Mitigation is use of any tool or service that lessens your risk of an attack. A compensating control is any specific tool, system, or service that lowers that risk.
One good example is having a smart firewall. If you had a computer sitting on a network that could directly access the internet, it is essentially sitting on the edge of your network with no protection around it.
Just allowing your users to jump into the internet may lead in more frequent successful attacks on your network because you are not doing anything to lessen the risk of an attack (mitigation) and are not using any tools to protect your users (compensating control).
IT Support should be constantly assessing the current threat landscape and evaluating what measures your business need to take to lessen your risk of an attack. By identifying specific tools or user behavioral changes, they can reduce the likelihood of a breach or attack on your network.
Not sure that sensitive information is stored securely? Don’t understand your threats? What risk your business has getting attacked? Are you worried about what controls you have in place to keep your users safe? Contact Us today for a FREE security assessment.