Chris Wiser walks through the core activities of a strong cybersecurity risk assessment: network scans for SSNs and credit card numbers, dark-web breach searches, and phishing tests to measure user vulnerability. These basics show what actually exists in your environment and where people are the weak point.
We are going to be scanning for personal identifiable information, those Social Security numbers, credit card numbers, bank account numbers that most of our customers and prospects don't think that they have on their network, but we all know that they do. We are looking for things like passwords. We are scanning the dark web to find breaches that they've already been a part of that they're probably not even aware of. We're typically doing phishing campaigns to send fake phishing emails to their staff to see who's opening and clicking on things. All we're trying to do is show them what currently exists in their environment and what risks they have, which a lot of times revolves back around their people. So that, you know, sometimes those, those phishing assessments, the dark web, the information that's out there showing that their users are using the same passwords over and over and over again, these are all things that they take for granted and are not aware of and don't know about. So we're able to take that information, put that together. That's kind of the bare minimum of what you want to grab in a csra. The more information that you can put together, the better.