What Will a Cyber Security Assessment Report Show? 10 Common Findings & Recommendations

If you're thinking about getting a cyber security assessment, it's likely because you have questions.

You may be wondering: Do we have vulnerabilities that open us up to a cyber attack? Are we using the right technology for security? Does my IT team have the cyber security expertise that we need? Is IT handling everything that needs to be done?

A cyber security assessment can answer those questions, but it will undoubtedly answer questions that you didn't think to ask, like – Is an employee using our network resources for their side hustle?  (True story!) Or – are we undergoing a cyber attack right now?  (Another true story!)

The executives who receive this information are very happy to get it, as you can imagine, but business leaders are equally pleased to learn –

• If their firewall is the right one and working correctly
• If their staff is susceptible to social engineering
• If they can count on their data backup and recovery processes
• If security for their remote workforce is adequate

Cyber Security Assessments Guide Your Plan for Security Improvements

What you learn from your assessment depends on the type of assessment performed and your particular goals.

The overall purpose of a cyber security assessment is to give you an objective view of your security stature right now. This gives you the information you need to make a plan for improvement, make security activities more efficient, effectively budget for security, or even qualify for cyber insurance.

Wondering what the plan for improvement might look like? Here are some common recommendations that come from cyber assessments.

Common Cyber Security Assessment Recommendations

1. Implement Best Practices for Software Updates

Unpatched and out-of-support software create security vulnerabilities. Cyber criminals use programs that search for computers connected to the internet that have old and unpatched software. If they’re successful in exploiting these vulnerabilities, it gives them a back door into the affected computer and corporate networks.

Keeping software up to date and never using out-of-support software is a best practice that keeps those back doors closed.

2. Upgrade and Properly Manage Firewalls

Firewalls continue to be a must-have layer of protection in your cyber security strategy. Missing or sub-quality firewalls won't do their job in keeping unwanted traffic out of your network and can become a point of failure for your whole network if it goes down.

Additionally, if you have a modern firewall, the way that it's set up and managed makes a big difference in its effectiveness.

3. Control Network Traffic

Security is supposed to control network traffic, but your cyber assessment might find open ports, unmanaged switches, missing domain controllers, or even publicly accessible servers that can leave your network vulnerable and open to an attack.

4. Implement Endpoint Detection and Response (EDR)

It used to be that the best you could do regarding the detection of threats was to recognize known threats. Unfortunately, that's not good enough anymore. Because cyber criminals use Artificial Intelligence (AI) to continually create new tactics, your defenses need to be just as smart.

Endpoint Detection and Response (EDR) is a must-have layer of modern cyber security strategy. EDR tools learn the regular patterns of your network so that when something out of the ordinary happens, like a cyber intrusion, it can take care of it right away.

5. Upgrade Your Email Spam Filter

Your email provider's basic spam filter isn't enough to keep out the phishing emails that lure your people into downloading malware. Even if you have a great email provider like Microsoft 365, configuring the spam filter takes some expertise to allow the email you want in and keep the email you don't want out.

6. Implement Multi-Factor Authentication

Password management is a simple way to keep accounts secure, yet many people consider it an inconvenience to regularly change their passwords or use passwords that aren't easily cracked.

While strong passwords are recommended, they aren't as secure as you think they'd be. Adding multi-factor authentication (MFA) protects your accounts from being compromised.

7. Improve Data Backup and Recovery Processes

Too many companies have tried to use their backed-up data to recover from a cyber incident only to find that the amount of data they could retrieve was inadequate, or worse yet, wasn't there at all.

Your data backup and recovery processes should be formulated for your unique business needs by answering the questions – how much data can we live without and for how long?

8. Update and Document Security Policies

Cyber security strategy includes both technical and non-technical layers. Non-technical layers have to do with how people access data and networks. While you can sometimes use technical means to restrict access, it's vital that you document expectations and permissions for that access, and train and enforce the acceptable practices that match your business processes.

9. Start Cyber Security Awareness Training

In a world where 90% of all cyber attacks involve social engineering, it's vital that everyone at your company, including executives, know how to recognize and respond to potential cyber attacks. Once a year training won't cut it. The only way to keep security top of mind with employees is to have them engage in ongoing training.

10. Improve Physical Security

The physical environment where your people work should also be considered in your security strategy. You may have to improve how you monitor and allow access to your facility, and be more aware of the comings-and-goings of visitors and vendors who don’t need to have eyes on your data or network setup.

Also, whether they’re in the office or working from home, employees should lock their computers when they step away. 

Is It Time for Outsourced Cyber Security Services?

With the recommendations you get from a cyber security assessment, another question arises - Is it time to outsource security services?

Cyber security has become a discipline all its own and requires 100% focus to stay up to date with all the evolving trends and tactics. Even if your IT team is doing well with managing your network, they might not have the depth of knowledge to lead security.

🔎 Related: Managed Services Provider (MSP) vs Managed Security Services Provider (MSSP): What’s the Difference?

That's where VC3 comes in. We provide Southern California companies with a whole cyber security department of expertise. Whether you’re looking for an IT service one-stop-shop, or you just want to outsource security services, we can help.

Contact us to explore how you can get an objective view of your security stature with a cyber assessment.