A long time ago—about 1.5 billion years to be exact—in a galaxy far away, two massive black holes collided. The impact of this collision set off a distortion of the time/space fabric known as "gravitational waves.” The concept of gravitational waves is a heady one. Albert Einstein first theorized they existed over a century ago, then spent the rest of his career waffling back and forth on whether he was right. Then on September 14th, 2015, scientists at the Laser Interferometer Gravitational-Wave Observatory (LIGO) detected the waves from this collision using lasers over 2 miles long. This breakthrough has the potential to change the way we understand the origins of the universe. It's now possible that we'll be able to see what happened within seconds of the big bang over 13.8 billion years ago—something that was not possible with previous technology.

So, what does this have to do with cyber security? Like astronomers and astro-physicists, cyber security professionals need more than one way to measure what's happening around them. To get the full picture of what's happening, you have to be able to measure things from different angles, and overcome barriers that exist with just a single way of looking at things. It's not enough to look at things from the "outside," you have to get a comprehensive picture to really understand your environment. If you rely on a single approach to assessing your security, you are at risk of missing key issues that can compromise your posture.

For a comprehensive view of your security, you need to employ several different assessment techniques, including:

Vulnerability and best practice assessment. This includes scanning your existing infrastructure for known vulnerabilities and configuration shortcomings, both internally and externally. Ask yourselves:

  • Are our systems patched properly?
  • Are we running software with known security vulnerabilities?
  • Do we have sensitive ports opened to the outside world?
  • Are our cloud environments set up in a secure fashion?

A good vulnerability assessment and management process can help identify obvious gaps in your security posture, allowing you to focus on closing the most critical gaps.

Additional resource: For a detailed guide to vulnerability assessment scans, download our ebook.‍

Security controls assessment. By comparing your existing security controls—processes, policies and procedures—to industry standard frameworks (such as NIST, CIS, SOC, etc.), you can identify where your organization is most vulnerable to security attacks. Standards organizations have identified the key attributes of a secure company, and you can use this as a measuring stick on how you stack up. And most importantly, regularly assessing your organization against these standards will help you prioritize improvements to your security infrastructure.

Resources in small businesses are often limited, so a prioritized and methodical approach to improvement can help you invest wisely.

In Part 2 of this series, we’ll examine simulations and threat assessments as two other ways to look at your organization’s vulnerabilities.

Watch the video demonstrating Trava’s risk assessment tool along with some practical insight.