How vulnerable is your company to criminal intent?

February 2013 Security Services & Risk Management

Just when you thought it was safe to open the curtains, someone whispers: “Have you done your vulnerability assessment?”

It is an unnerving moment, like being told there is an awful epidemic going around striking fear at the very mention of its unintelligible name.

Your first thoughts are: am I vulnerable and do I need assessing? And if I do, what is the next step?

The first step is to understand what it is and why it is there.

A vulnerability assessment is an analysis of your company’s security weaknesses and the opportunities they offer your competition or the criminal element targeting your assets. Such vulnerabilities can be assessed by a security survey, that systematically takes the operation apart and finds the leaks and other structural weaknesses or signs of hostile intent, such as attempts to intrude actually or virtually to collect information about your organisation or to steal from it. Once you have identified the problem, you have a better chance of dealing with it. Is it that easy?

Sometimes, but not often and you will solve it most frequently in a painstaking and time consuming way. The goal of a vulnerability assessment is to identify and block opportunities for attacks against assets, thwart malicious intent, reduce risk and breathe easier.

But snags abound and in critical and substantive vulnerability assessments, one size never fits all because no two companies are ever exactly the same. So security surveys must be developed that take in to account each firm’s unique operating and security features.

A master plan

A periodic vulnerability assessment should be a primary element in your security master plan, which should itself include a combination of policy and procedure, personnel and physical security. A master plan keylines the security requirements, how they relate to each other, and how they are implemented to achieve the desired security effect. The master plan also defines the intended results and identifies the ultimate goal the security programme sets out to achieve. Security master plans will reflect the organisation’s environment and give substance to its short and long term strategies.

Scroll down the relevant sections of the Internet and you will find dozens of tool kits that “let you do your own vulnerability assessment or security survey”. As tools go, most are competent and offer value for the money you will spend. But for such intricate operations, the tools are only as good as the hands that use them are experienced.

Your company is unique, for a number of reasons: because of what it does, the way it does it, the people who were there, the sector or sub-sectors it specialises in, the skills cross-section of its workforce, recruitment methods and selection – the list is long and complicated. Each aspect impacts upon another, and it is in this complexity – which will be familiar and seem uncomplicated to you and your top management – that a security audit and vulnerability assessment must be conducted if it is to be of value.

Illuminate your weaknesses

I think it was David Ogilvie, the British advertising guru, who noted that “Information is sometimes used like a drunk uses a lamppost – for support rather than illumination”.

The same danger is present in vulnerability testing. Off-the-shelf kits will provide some answers, most superficial, and could skirt around critical issues. They might not encourage the kind of creative thinking that could prevent the attacks the bad guys are so good at. You need to analyse your corporate structure from every angle, because you will not find a replica, and you need to fully understand the security vulnerabilities, and then think creatively about your own space.

Some confusion arises in understanding the difference between threat and vulnerability. Each needs to be dealt with for what they are.

A threat is who might attack what assets, when, where and why and with what probability.

A vulnerability is a specific weakness in security open to exploitation by multiple perpetrators with varied motivations.

Jenny Reid
Jenny Reid

Notes the Journal of Physical Security: “One must test to tell if someone claiming to do a vulnerability test is actually doing a threat assessment is if they have identified a relatively small number of ‘threats/vulnerabilities’ and if mitigating them is a major undertaking. A vulnerability assessment will identify possibly hundreds of very specific weaknesses and many of the countermeasures will be cheap and relatively painless.”

It is not getting much easier out there. A vulnerability assessment for your company could be a vital next step.

iFacts offers free basic assessments on and may assist you to make a decision on your vulnerabilities.

For more information contact iFacts, +27 (0)82 600 8225,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Convergence of cyber and physical security
Integrated Solutions Security Services & Risk Management
The overlap between cybersecurity and physical security will necessitate the integration of cyber and physical security in order to enable the sharing of events to the same security operations centre.

Reduce electrical risks in commercial and industrial buildings
Security Services & Risk Management
Eaton’s new whitepaper aims to help professionals reduce electrical risks in commercial and industrial buildings and prevent faults that can endanger workers, damage property and disrupt business continuity.

Sustainability School opens for enrolment
Education (Industry) News Security Services & Risk Management
Three-part programme, first developed for Schneider Electric employees, is now available for free for companies worldwide. Attendees learn how to future-proof their businesses and accelerate their decarbonisation journeys.

Success in business process best practices
Technews Publishing Kleyn Change Management Editor's Choice Integrated Solutions Security Services & Risk Management
This month we commandeer time with the woman who is spearheading our national conversation on Women in Security, Lesley-Anne Kleyn, to get to know the lady herself a little better.

Security awareness training
Training & Education Security Services & Risk Management
It is critically important to have a security awareness solution that uses the limited time available to train effectively, and one that provides targeted education that is relevant to users.

Technology to thwart solar panel thieves
Asset Management, EAS, RFID Security Services & Risk Management Products
A highly efficient industrial network is coming to the rescue of the solar industry, as solar panels, inverters and batteries are being targeted by thieves and threaten to destabilise the industry.

Banking the unbanked comes with security risks
Financial (Industry) Security Services & Risk Management
As grim as it was, the pandemic of recent years and its resultant global economic crisis were a prime catalyst for record number of first-time bank users, the previously unbanked.

Security is like infinity
Alwinco Security Services & Risk Management
Security needs constant attention, dedication and input. The scary thing is that most people think that security is something that you buy, install, and then forget about.

Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

SAFPS to launch a platform to combat fraud
Editor's Choice News Security Services & Risk Management
In response to the growing need for a proactive approach to fraud prevention, the SAFPS is developing a product called Yima, which will be a one-stop-shop for South Africans to report scams, secure their identity, and scan any website for vulnerabilities.