Frequently Asked Questions

A virtual Chief Information Security Officer or vCISO is an experienced security practitioner, hired on a part-time basis, who utilizes the accumulated knowledge and experience they have gained over their 20+ years of experience in the IT/cybersecurity industry to help organizations manage their cybersecurity risk.

This typically involves the vCISO:

• performing an initial assessment to determine the organization’s business critical assets and overall security posture;
• identifying and prioritizing by level of criticality the risks and threats that the organization is exposed to;
• defining a remediation roadmap or ‘cybersecurity program’ designed to address all the gaps in the organization’s security posture;
• managing the implementation of the roadmap.

The vCISO can also provide services such as:

• providing cybersecurity strategy thought leadership;
• acting as a mentor for less-experienced permanent CISOs; and
• acting as an interim CISO whilst an organization is going through the lengthy recruiting process for a permanent CISO.

There are a number of fundamental things all business owners can do to dramatically reduce the level of cyber risk their business is exposed to:

#1 – Know Your Cyber Risks – Every business has a different risk appetite and a specific set of business-critical assets. Until you know that, it will be very difficult to identify the types of cyber risk a business is specifically exposed to.  vCISOs are experts in identifying your key business-critical assets, the unique risks and threats that those assets are exposed to and the most relevant and cost-effective controls that need to be implemented to mitigate those risks and threats.

#2 – Ensure You Have Incident Response and Disaster  Recovery Plans In Place – The classic saying in the cybersecurity industry is ‘it’s not if, but when a cyberattack will occur’. Cyberattacks are one of the most destructive threats to a business and without comprehensive incident response and disaster recovery plans in place, a business can be wiped out overnight.

#3 – Ensure You Have A Security Aware Culture – Security awareness training is one of the most under-rated security mitigation strategies. All the technology in the world will not prevent malicious (or accidental) insiders stealing information or bypassing security controls. Social engineering attacks such as phishing are on the rise and can result in huge losses for businesses that haven’t bothered to spend time or money providing their staff with regular security awareness training.

#4 – Adequate Investment In Cybersecurity – Many businesses still don’t take cybersecurity seriously and consider any investment in technology or services as a waste of money. All business leaders should at least take some time to invest in a risk-based assessment of their organization and evaluate what level of investment in cybersecurity technologies and services are appropriate and relevant for the continued safety of their business operations.

#5 – 3rd Party Vendor Management – Businesses in today’s highly connected world are more prone than ever to vulnerabilities introduced by 3rd party vendors. It is vitally important that businesses ensure that all 3rd party vendors they connect to and do business with a contractually obligated to adhere to at least some level of security and ideally are continuously monitored. Recent legislation like GDPR and CCPA make businesses liable to hefty fines if they are shown to be non-compliant with the controls stipulated by these regulations. Responsibility for maintaining privacy for customer data remains with a business, even if an external vendor is providing a hosting environment, so 3rd party vendor management has become extremely important in recent years.

A common misconception is that small business are less prone to cyberattacks due their perceived small footprint on the Internet – i.e. ‘security through obscurity’. The reality is that small businesses are just as exposed as large organizations. Hackers use automated scripts to target thousands of businesses on a continual basis and don’t care who they are attacking.

Recent figures have shown that businesses with less than 500 employees suffer losses of $2.5 million per successful attack and that 60% of businesses are forced to close due to cyberattacks.

However, businesses can reduce their level of risk dramatically just by having a general understanding of what the top 5 cybersecurity threats are and knowing what security controls to implement to prevent them.  

#1 – Phishing Attacks – Phishing remains a prevalent threat, where attackers use deceptive emails, messages, or websites to trick individuals into disclosing sensitive information, such as passwords or financial details. These attacks often appear as legitimate communications from trusted entities and can lead to unauthorized access to business systems.

#2 – Ransomware – Ransomware attacks involve malware that encrypts a victim’s files or systems, with the attacker demanding a ransom in exchange for decryption keys. These attacks can cripple business operations and lead to significant financial losses, both from the ransom payments and the impact of operational downtime.

#3 – Data Breaches – Unauthorized access to or exposure of sensitive data, including customer information, intellectual property, and internal communications, can have severe consequences. Data breaches can result from various factors, including weak passwords, unpatched software vulnerabilities, and insider threats.

#4 – Insider Threats – Threats from within an organization, whether intentional or accidental, pose a significant risk. Employees, contractors, or business partners with access to the company’s networks and data can cause harm, whether through malice, negligence, or being compromised by external attackers.

#5 – Advanced Persistent Threats (APTs) – These are sophisticated, prolonged attacks where hackers gain access to a network and remain undetected for extended periods. APTs are typically aimed at stealing data over time and are often orchestrated by nation-states or highly organized criminal groups targeting specific industries or entities for espionage or financial gain.

Businesses must adopt a multi-layered security approach, including employee training, regular security assessments, and the implementation of robust security technologies, to protect against these and other emerging threats.