Prioritizing
network security
vulnerabilities with
threat intelligence

Not all security threats are created equal, but in a world where ransomware, malware and email phishing have become the norm, it's increasingly difficult for organizations to create a security program that consistently and effectively prioritizes its efforts.

Organizations often deal with a broad range of network security vulnerabilities, and prioritizing which of these vulnerabilities to address and at what scale requires balancing business, financial and IT priorities. A threat assessment is usually the best place to start. Undergoing this exercise can help your organization prioritize threats and create a holistic security strategy that protects your technology infrastructure and all the valuable data you collect.

A threat assessment is a crucial part of effective cyber security risk management.

Building threat intelligence typically involves IT teams working across the enterprise to gather comprehensive information about the technologies, applications, systems and databases your organization uses. The process also includes a review of the current security gaps within your network and the current threats your particular industry faces. Then an effective response strategy can be developed to address the most relevant threats facing your organization.

It's likely that your IT team may already keep a thorough inventory of all your technology assets and use threat data feeds with information aggregated from different industry sources to keep track of network security vulnerabilities.

With this information, you can then conduct a threat assessment to evaluate different assets based on the value of the information they store; how vulnerable they are to a particular security threat; what threats are most pressing for your organization (ransomware, social engineering, denial-of-service (DOS) attacks or insider threats from employees, for example); whether the risk of a breach is low, medium or high; and what the potential business impact would be if a breach occurred.

A threat assessment is essential because your organization's risk environment is constantly changing. With remote work becoming the norm and more devices connecting to your network, it's critical to continually assess your network security vulnerabilities. A threat assessment can provide solid threat intelligence that helps you better understand the current threat environment and best determine how to protect your most critical IT assets.

Once you've conducted an assessment and have the threat intelligence you need, you can use that information to inform your overall threat management and cyber security strategy.

Prioritizing which assets to protect requires a clear understanding of your organization's security goals, available resources and each security vulnerability. It's also important to understand that while you can mitigate threats, there's no such thing as zero risks. Your goal should be to protect your most critical data and systems—however you define them—and minimize the risk of a breach that could lead to significant business disruptions, reputational harm and financial risks.

You can prioritize what to protect in several ways, including assessing the likelihood of an attack, how easy it would be to contain the threat and the potential business impact. For example, a legacy government database that is used to store citizen data for a social service program may represent a high risk because it stores high-value information and has several security vulnerabilities hackers can easily exploit in the form of malware.

However, your organization may also face risks due to weak email security, which increases the risk of a successful phishing attack, or issues with privileged access, which increases your risk of leaked credentials or insider threats. You may also face security vulnerabilities and a greater risk of ransomware due to a rarely used virtual private network (VPN) that lacks multi-factor authentication and allows hackers to gain access to your main network. In this case, you may decide it's better to retire the VPN and provide the highest level of protection for the legacy database and your email programs since they are widely used by your employees and store highly sensitive information.

You also may decide to provide the highest level of security for one system over another because it is used enterprise-wide and supports your core business processes, compared to another system that is only used by a single business unit or department for one specific process and doesn't store highly regulated information.