20 Cybersecurity Questions for Executives to Ask Security Teams
Measuring cyber risk effectively
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Related Stories: Cybersecurity for Executives
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*YL3cLVPZ_SX_mgHr9lLEIQ.png)
In this series on Cybersecurity for Executives, I previously explained how cybersecurity risks contribute to financial losses. In the second post, one of the recommended strategies for mitigating cybersecurity losses was for top executives to review cybersecurity risk reports just as they review other financial matters. Consider the potential losses and damage from cybersecurity threats and prioritize accordingly.
Determining what should be on a report starts with asking the right questions. Here are twenty high-level cybersecurity questions executives can ask their security team. I based these questions on years of security research into what causes data breaches, including for some time at a security vendor that sells firewalls, endpoint security, and wireless security products. By asking these questions, you will understand how many problems exist in your organization that could lead to a data breach. Once you know what is creating the risk, you can work on fixing it to reduce potential exposure and losses.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*lRI3XT_KRmEyVW_aRw3OIw.jpeg)
If you don’t know what all these questions mean, don’t worry. I’m going to explain each one in the remaining blog posts on this topic. Please make sure to follow me here or on Twitter @teriradichel for updates.
- How many of our systems are running out of date software with known security flaws (otherwise known as CVEs)? Consider not only operating systems, but any application, printers, IOT devices, and anything that could have out of date firmware or software. Read more: CVEs: Security Bugs that Bite
- What is the percentage of systems exposed to the Internet? Could the systems run in private networks? How many systems expose administrative and high-risk ports include such as 22, 3389, 23, 445, 137 — 139? Read more: How network traffic got me into security | Exponential increases in cyber risk from Internet exposure | High-risk ports: The chink in your network armor
- How many systems expose data to the Internet and what kind of data? PII? Financial data? Include cloud storage services like S3 buckets, Google Drive, and Box.
- What are the total number of attack paths on our network? Every network path between two systems is a potential attack path that increases overall risk.
- What is the potential damage if any one person’s credentials are stolen — via phishing or any other sort of credential compromise? How much could an attacker access?
- What percentage of accounts in our organization require MFA? What percentage of activities in our organization require MFA before a user can execute an action?
- What percentage of our data is encrypted when stored?
- What percentage of our network communications are encrypted?
- How many outstanding high, medium, and low-risk findings are in the results of assessments, penetration tests, or audits? For example, even though you have encryption, are encryption keys handled properly?
- In the event of a security incident or disaster, could we restore our systems from a backup? Have we tested this? Recently? Are our backups air-gapped so malware cannot infect or access them?
- Do our developers understand network, application, and data security? Do we perform threat assessments before building systems? Are security teams and developers working together closely?
- Do we have policies in place that limit mistakes that can lead to increased security risk and potentially a data breach? How are they enforced?
- Who is generating the most exceptions to security policies — and why?
- Are security checks built into our deployment systems to prevent vulnerabilities from being deployed?
- How are we vetting our vendors? Do your vendors follow the same security practices you do? Are you monitoring vendor activity and security as it pertains to your business? Where and how are security products designed, developed, manufactured, and tested?
- How many attacks have our current security solutions and processes prevented that could have led to significant financial loss? What have they missed? In other words, what is the efficacy of the security systems we purchased?
- Do we have an incident handling team? Do our developers, IT staff, and business executives know what to do in case of a security incident and how to respond? When is the last time we practiced incident handling?
- What percentage of our activities are automated? How can that percentage be increased?
- What is the overall risk level? Is it going up or down over time? Are risk reports based on quantifiable metrics? Can risk items be tested? Or is the risk score a purely subjective estimate?
- How is the threat landscape changing? How is your organization monitoring for new threats that could impact your business?
I offer these questions as a starting point. The questions, answers, and recommended solutions will differ for each business based on size, industry, and other factors. Use these questions to create cybersecurity reports that help executives quantify risk and prioritize cybersecurity spending appropriately. I will explain each of these items in future blog posts, as well as how they relate to cloud security.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2019
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg)