The journey to improve your industrial security strength, or posture, may seem complex, and for good reason. With many different methodologies, industrial standards, and available technologies on the market, the path forward may not be clear. You may wonder: "Where do we start?"
One way to begin this journey is through the use of security assessments. In its simplest form, a security assessment is a structured measurement of the security posture of a system or organization.
When used appropriately, assessments can be an extremely effective method to evaluate your current security posture, identify the gap between your current state and ideal target state, and lay out clear steps to achieve your target security posture.
Types of Assessments
The phrase "security assessment" can mean many different things, so it's important to properly scope the assessment based on the intent of the initiative. The most common types of assessments may each yield different findings that can impact the steps you take in your security program.
- Vulnerability Assessment: Identifies known vulnerabilities that exist within an environment, in an effort to put an action plan in place to remediate them.
- Gap Analysis: Identifies the gap between an organization's existing security posture and the ideal target state of its security posture. Gap analyses are typically in consideration of a corporate or industry standard and are intended to clearly define the steps required to achieve the desired target security posture.
- Risk Assessment: Provides a more holistic view of an organization's security posture. A risk assessment combines elements of a vulnerability assessment and gap assessment to identify and assess known risks against the risk tolerance of the organization and its ideal security posture.
- Security Audit: This assessment-based service audits an organization's security posture and practices against a given industry standards or requirements body, usually to help ensure compliance such as NERC-CIP or other standards.
Bear in mind that while the above are common types of security assessments, it’s important to begin with an understanding of the intended objective prior to making a selection. This will be critical to help ensure proper expectations are both aligned and met, and the most effective assessment is selected to progress your cybersecurity program.
Be Realistic
When considering which type of assessment is right for your organization, remember that an assessment is a snapshot of one point in time. It should not be viewed as the sole solution to an organization’s security program. Rather, it is like a regular check-up to confirm maintenance, management, and technical controls are appropriate for your intended risk tolerance.
If you’re dealing with restricted budgets and limited resources and cannot perform an assessment across the entire organization, you may want to take a “representative sample” approach, which reduces the scope of the assessment to a portion of your organization that will offer a baseline.
Putting it all together
Security assessments can be effective tools to evaluate your current security posture, but must be properly selected, scoped, and paired with an actionable roadmap that lays out clear, actionable steps to achieve your target security profile. The right provider can help you with assessments and building a robust security program.
