printer friendly version

How vulnerable is your company to criminal intent?

Just when you thought it was safe to open the curtains, someone whispers: “Have you done your vulnerability assessment?”

It is an unnerving moment, like being told there is an awful epidemic going around striking fear at the very mention of its unintelligible name.

Your first thoughts are: am I vulnerable and do I need assessing? And if I do, what is the next step?

The first step is to understand what it is and why it is there.

A vulnerability assessment is an analysis of your company’s security weaknesses and the opportunities they offer your competition or the criminal element targeting your assets. Such vulnerabilities can be assessed by a security survey, that systematically takes the operation apart and finds the leaks and other structural weaknesses or signs of hostile intent, such as attempts to intrude actually or virtually to collect information about your organisation or to steal from it. Once you have identified the problem, you have a better chance of dealing with it. Is it that easy?

Sometimes, but not often and you will solve it most frequently in a painstaking and time consuming way. The goal of a vulnerability assessment is to identify and block opportunities for attacks against assets, thwart malicious intent, reduce risk and breathe easier.

But snags abound and in critical and substantive vulnerability assessments, one size never fits all because no two companies are ever exactly the same. So security surveys must be developed that take in to account each firm’s unique operating and security features.

A master plan

A periodic vulnerability assessment should be a primary element in your security master plan, which should itself include a combination of policy and procedure, personnel and physical security. A master plan keylines the security requirements, how they relate to each other, and how they are implemented to achieve the desired security effect. The master plan also defines the intended results and identifies the ultimate goal the security programme sets out to achieve. Security master plans will reflect the organisation’s environment and give substance to its short and long term strategies.

Scroll down the relevant sections of the Internet and you will find dozens of tool kits that “let you do your own vulnerability assessment or security survey”. As tools go, most are competent and offer value for the money you will spend. But for such intricate operations, the tools are only as good as the hands that use them are experienced.

Your company is unique, for a number of reasons: because of what it does, the way it does it, the people who were there, the sector or sub-sectors it specialises in, the skills cross-section of its workforce, recruitment methods and selection – the list is long and complicated. Each aspect impacts upon another, and it is in this complexity – which will be familiar and seem uncomplicated to you and your top management – that a security audit and vulnerability assessment must be conducted if it is to be of value.

Illuminate your weaknesses

I think it was David Ogilvie, the British advertising guru, who noted that “Information is sometimes used like a drunk uses a lamppost – for support rather than illumination”.

The same danger is present in vulnerability testing. Off-the-shelf kits will provide some answers, most superficial, and could skirt around critical issues. They might not encourage the kind of creative thinking that could prevent the attacks the bad guys are so good at. You need to analyse your corporate structure from every angle, because you will not find a replica, and you need to fully understand the security vulnerabilities, and then think creatively about your own space.

Some confusion arises in understanding the difference between threat and vulnerability. Each needs to be dealt with for what they are.

A threat is who might attack what assets, when, where and why and with what probability.

A vulnerability is a specific weakness in security open to exploitation by multiple perpetrators with varied motivations.

Jenny Reid

Notes the Journal of Physical Security: “One must test to tell if someone claiming to do a vulnerability test is actually doing a threat assessment is if they have identified a relatively small number of ‘threats/vulnerabilities’ and if mitigating them is a major undertaking. A vulnerability assessment will identify possibly hundreds of very specific weaknesses and many of the countermeasures will be cheap and relatively painless.”

It is not getting much easier out there. A vulnerability assessment for your company could be a vital next step.

iFacts offers free basic assessments on www.ifacts.co.za and may assist you to make a decision on your vulnerabilities.

Share this article:

Further reading: