--- title: Start Your Own IT Security Risk Assessment description: With everyone working from home (and your data all over the place), it’s critical for businesses to understand and measure their IT security risk. image: https://blog.trustedinsite.com/hubfs/IT%20security%20risk%20assessment.jpg --- [![insite_logo-transparent](https://blog.trustedinsite.com/hs-fs/hubfs/insite_logo-transparent.png?width=1582&height=556&name=insite_logo-transparent.png "insite_logo-transparent")](https://trustedinsite.com/) - [Core Solutions](https://trustedinsite.com/#coresolutions) - [Managed IT Services](https://trustedinsite.com/managed-it-services/) - [IT Security and Compliance](https://trustedinsite.com/it-security-and-compliance/) - [Modern Work and Learning](https://trustedinsite.com/modern-work/) - [IT Consulting](https://trustedinsite.com/it-consulting-2/) - [Application Development](https://trustedinsite.com/application-development/) - [ERP Services](https://trustedinsite.com/erp-services/) - [Technology Products](https://trustedinsite.com/technology-products/) - Industries - [Manufacturing](https://trustedinsite.com/manufacturing/) - [Distribution](https://trustedinsite.com/distribution/) - [Professional Services](https://trustedinsite.com/professional-services/) - [Leading Businesses](https://trustedinsite.com/it-leading-business/) - Resources - [Roadmaps and Resources](https://trustedinsite.com/resources/) - [Case Studies](https://trustedinsite.com/case-studies/) - [Events](https://trustedinsite.com/events/) - [Blog](https://blog.trustedinsite.com/blog) - [Careers](https://trustedinsite.com/careers/) - [Our Why](https://trustedinsite.com/who-we-are/) [Contact Us](https://trustedinsite.com/contact/) [IT & OT](https://trustedinsite.com/it-and-ot/) a M - [Core Solutions](https://trustedinsite.com/#coresolutions) - [Managed IT Services](https://trustedinsite.com/managed-it-services/) - [IT Security and Compliance](https://trustedinsite.com/it-security-and-compliance/) - [Modern Work and Learning](https://trustedinsite.com/modern-work/) - [IT Consulting](https://trustedinsite.com/it-consulting-2/) - [Application Development](https://trustedinsite.com/application-development/) - [ERP Services](https://trustedinsite.com/erp-services/) - [Technology Products](https://trustedinsite.com/technology-products/) - Industries - [Manufacturing](https://trustedinsite.com/manufacturing/) - [Distribution](https://trustedinsite.com/distribution/) - [Professional Services](https://trustedinsite.com/professional-services/) - [Leading Businesses](https://trustedinsite.com/it-leading-business/) - Resources - [Roadmaps and Resources](https://trustedinsite.com/resources/) - [Case Studies](https://trustedinsite.com/case-studies/) - [Events](https://trustedinsite.com/events/) - [Blog](https://blog.trustedinsite.com/blog) - [Careers](https://trustedinsite.com/careers/) - [Our Why](https://trustedinsite.com/who-we-are/) [Let's Chat](https://trustedinsite.com/contact/) [IT & OT](https://trustedinsite.com/it-and-ot/) ![](https://blog.trustedinsite.com/hubfs/IT%20security%20risk%20assessment.jpg) # Start Your Own IT Security Risk Assessment Published by [Mike Schipper](https://blog.trustedinsite.com/blog/author/mike-schipper) on Dec 17, 2020, 9:05:05 AM ## Why is Security So Important? Anyone else going stir-crazy working from home? It makes you realize how much you took for granted at work: the water cooler chats, in-person meetings, actual flesh-and-blood co-workers, even real handshakes - on a personal level, many of us are missing the camaraderie of the office right now. **On a data security level, your business is DEFINITELY missing the simplicity of securing a single network.** If your business has remote workers, it’s a fact that your data is everywhere these days: Smart phones, Dropbox, shared drives, cloud applications, email clients - you have much less control with so many hosted accounts. More accounts means more vulnerability, so it’s crucial right now for all businesses to understand and measure their IT security risk. [![IT security risk assessment](https://blog.trustedinsite.com/hs-fs/hubfs/IT%20security%20risk%20assessment.jpg?width=620&name=IT%20security%20risk%20assessment.jpg)](https://info.trustedinsite.com/it-security-assessment-checklist) #### *Start Your Own IT Security Audit* *[![Get the IT Security Checklist](https://no-cache.hubspot.com/cta/default/6190050/676b2b64-0897-476f-a2ba-d4a6ae57a75e.png)](https://cta-redirect.hubspot.com/cta/redirect/6190050/676b2b64-0897-476f-a2ba-d4a6ae57a75e)* ### The RIGHT Security Implementing the proper security measures may seem daunting at first, but it’s well worth the effort. In many industries, data security is required for remaining compliant with regulatory requirements such as HIPPA or PCI. Healthcare, DoD, and other highly-regulated industries require strict IT security protocols due to the sensitivity of their data. Did you know that if you process credit cards at all through the course of business, you need to comply with PCI regulations unless your transactions are 100% handled by an outside entity?  The same goes for HIPAA, do you know if you have any health information on your system?  Do you know for sure that you don’t?  **Even if you’re not saving lives or maintaining national security, protecting your business’s (and your customer’s) data should be of the utmost importance**; after all, you don’t know what you don't know, and what you don’t know CAN hurt you.  Sometimes, it hurts a lot. In one particular example, a business contacted us **because they had *lost over $500,000* in a phishing scam**. They managed to recover some of the money, but a huge chunk of it was gone, never to be seen again. The attackers had a big payday, and they got away with it because this business didn’t have proper security measures in place, things like: regular employee cyber-security training, multi-factor authentication, automatic notifications of risky sign-ins, and mobile device management could have helped prevent the phishers from accessing those systems and making out like literal bandits.  **A minimal security investment would have helped protect them from such an attack and saved them all that money**. After the attack and after contacting us, this business had InsITe implement those security measures and much more. Despite evidence of continued attacks, no breaches have occurred since, and continual monitoring will alert of any attempts.  Phishing scams are especially heinous since they rely on human error to bypass much of your built-in security protocols. If you’re not familiar with phishing, it can be very difficult to spot and stop. Attackers gain access to a hosted e-mail system by tricking someone into sharing their login, they then sign in as that person and fraudulently disguise themselves as that trusted entity, then request sensitive information via email/text/phone. This could be passwords, client info, requesting a bank transfer, or even request the bank account information. For the rank and file employee, these fraudulent attempts can be tricky to identify. The good news is that there are ways to slow down the attackers, identify when an attack is happening, and prevent it.  This takes a layered approach, but a great first critical step towards prevention is to ensure that your employees are [trained and educated about phishing scams.](https://trustedinsite.com/wp-content/uploads/2019/02/Simulated-Email-Phishing-Attacks.pdf)  [![Blog-Graphic-Insite-2018_01_09-Securing-Business-01](https://blog.trustedinsite.com/hs-fs/hubfs/Imported_Blog_Media/Blog-Graphic-Insite-2018_01_09-Securing-Business-01.jpg?width=624&name=Blog-Graphic-Insite-2018_01_09-Securing-Business-01.jpg)](https://trustedinsite.com/wp-content/uploads/2019/02/Simulated-Email-Phishing-Attacks.pdf) ## What Systems Are Most At Risk? With more and more employees working remotely, company data is spread out in multiple locations, over multiple services, making it harder to secure. You should pay special attention to the systems your employees are using to communicate: - **Email systems like Gmail and Office 365** - With the wealth of information shared over e-mail; despite the data being encrypted on the system, the system can be logged in from anywhere, on almost any device - **File sharing programs like Dropbox or Onedrive** - Without the right controls, these services are most likely leaving your files vulnerable  - **Phones and laptops** - Even locally-stored data is susceptible to loss or theft - **Internet of Things (IoT) devices** - Any “smart” or network connected device is considered an IoT device. These devices often connect to a service in the cloud.  Your entire network is at risk if your IoT devices are not installed with the correct segmentation and isolation precautions [![Blog-Graphic-Insite-2018_01_09-Security-Risks-01](https://blog.trustedinsite.com/hs-fs/hubfs/Imported_Blog_Media/Blog-Graphic-Insite-2018_01_09-Security-Risks-01.jpg?width=598&name=Blog-Graphic-Insite-2018_01_09-Security-Risks-01.jpg)](https://info.trustedinsite.com/it-security-assessment-checklist) ### Less Cloud = More Security Then Right? Do accessibility and convenience really make up for the potential risks of the cloud? While part of that answer depends on your individual business and industry, there’s no denying that there are TONS of efficiencies to be gained through leveraging cloud services. It’s no secret that in a competitive environment, **agile companies have the edge and cloud services offer superior features, data and services availability and collaboration capabilities.** We have to consider the human part of the equation. People will gravitate towards what takes the least amount of time, whatever is the most convenient, whatever makes completing a task easier. The path of least resistance.  Clarence Bleicher, a former Chrysler executive, put it succinctly: *“Whenever there is a hard job to be done, I assign it to a lazy man; he is sure to find an easy way of doing it.”* The point is that **workers will use whatever tool fits their needs most efficiently, and, in modern-day terms, that means cloud services.** We must provide them a secure way to do that, or they will find their own way - it’s a necessity in today’s business environment.   At the end of the day, investing in security is NOT optional. Whether you embrace the cloud or not, whether your data is in the cloud or stored at your site, every business needs the appropriate security measures in place.  After all, we are all connected to the same global internet. We can understand the thought process that cloud services - services that can be access anywhere, anytime, on almost any device - are more risky than locally installed applications or servers. But contrary to that belief, **cloud services can be secured more quickly and easily than onsite servers or services**. Instead of buying and supporting more hardware or software installed on your system, we can click a few boxes that can achieve the same (or better results) for a cloud service.   We all know we can’t get rid of tech costs (ever!), so why not start taking advantage of the productivity and efficiencies of the cloud, and achieve better security at the same time? ## How Do You Start Measuring IT Security Risk? The best way to assess your IT security risk is to take a structured approach.  We recommend using an Assess, Detect, Protect, Recover, Respond approach. In the interest of only deploying the necessary security for your industry and needs we begin first by understanding the applicable regulatory compliance requirements, and what data is stored within a system. We then select a security framework, such as NIST, ISO or other applicable industry-specific standards. With a framework in hand, we can then measure where the systems and services stack up compared to the applicable standard. In the IT biz, we call this a Gap Analysis.  To get started on this process, use this handy **IT Security Risk Assessment Checklist** to complete your own mini security audit to make some quick improvements and identify any weaknesses you may have. #### *Start Your Own IT Security Audit* *[![Get the IT Security Checklist](https://no-cache.hubspot.com/cta/default/6190050/676b2b64-0897-476f-a2ba-d4a6ae57a75e.png)](https://cta-redirect.hubspot.com/cta/redirect/6190050/676b2b64-0897-476f-a2ba-d4a6ae57a75e)* ## What’s the Takeaway?  IT security is absolutely a necessity, and it's not as daunting as you might think. If you follow the steps in the IT Risk Assessment Checklist, you’ll have a beginning picture of your security health and have much less to worry about going forward; **do nothing, and you’ll have everything to worry about**. The bottom line? It’s not hard to take simple steps to protect your business. Using cloud services? The great news is that cloud services are actually easier to secure than onsite servers or services. The reality is that in today's business climate, you can’t avoid using cloud-based technologies and hope to stay competitive for long. **The danger is real, but with a solid understanding of your IT security risks, it’s very straightforward to secure your business across all onsite and cloud services.** Ready to take your IT Security to the next level? [Contact an InsITe Advisor](https://trustedinsite.com/contact/) to expand on your Security Risk Assessment and give you a roadmap to better network security in the cloud.   ### ABOUT INSITE BUSINESS SOLUTIONS: Most West Michigan manufacturers know they need to connect their shop floor systems with their business systems. But figuring out how to bridge that gap is like playing vendor roulette. They often end up picking either an IT shop or an automation house, or a combination of both.  InsITe has IT and OT engineers on staff. One call, one team, one point of accountability across the full tech stack. Before we recommend anything, we walk your shop floor and then design the solution, execute the implementation, and own the outcome through managed services, security, and ongoing support.  If you're looking for IT or OT help from people who understand the ins and outs of manufacturing, we can help.  [Talk to an Advisor Today →](https://trustedinsite.com/contact/) Tags: [DIY](https://blog.trustedinsite.com/blog/tag/diy), [Security](https://blog.trustedinsite.com/blog/tag/security), [The Cloud](https://blog.trustedinsite.com/blog/tag/the-cloud) [Back to Blog](https://blog.trustedinsite.com/blog) - [Tweet](https://twitter.com/share) ## Related Articles ## [The Cost of Standing Still: The True Price of Downtime in Manufacturing](https://blog.trustedinsite.com/blog/the-cost-of-standing-still-the-true-price-of-downtime-in-manufacturing) There is a moment every manufacturer recognizes. The line is running. Orders are shipping. People... [Read More](https://blog.trustedinsite.com/blog/the-cost-of-standing-still-the-true-price-of-downtime-in-manufacturing) ## [Winner of West Michigan's Best and Brightest Companies to Work For® 2019!](https://blog.trustedinsite.com/blog/winner-of-west-michigans-best-and-brightest-companies-to-work-for-2019) April 9, 2019 - Warren, Mich. — every year companies throughout West Michigan compete to be named... [Read More](https://blog.trustedinsite.com/blog/winner-of-west-michigans-best-and-brightest-companies-to-work-for-2019) ## [Your company data is on your employees' personal devices. What could go wrong?](https://blog.trustedinsite.com/blog/monitoring-employees-personal-devices) Most employees have organizational data on their personal devices, should you be "managing" them? [Read More](https://blog.trustedinsite.com/blog/monitoring-employees-personal-devices) ![Insite Logo](https://blog.trustedinsite.com/hs-fs/hubfs/raw_assets/public/Insite_Business_Solutions_February2023/images/inverse_logo_footer.png?width=200&name=inverse_logo_footer.png "Insite Logo") Lead Your Business With Confidence, Trust Us With IT - - - ### InsITe Business Solutions 8436 Homestead Dr. Ste 100 Zeeland, MI 49464 Phone: [(616) 383-9000](tel:6163839000) Hours: Mon-Fri; 7am-6pm - Core Solutions - [Managed IT](https://trustedinsite.com/managed-it-services/) - [IT Security and Compliance](https://trustedinsite.com/it-security-and-compliance/) - [Modern Work and Learning](https://trustedinsite.com/modern-work-and-learning/) - [IT Consulting](https://trustedinsite.com/it-consulting-2/) - [Application Development](https://trustedinsite.com/application-development/) - [ERP Services](https://trustedinsite.com/erp-services/) - [Technology Products](https://trustedinsite.com/technology-products/) - Industries - [Manufacturing](https://trustedinsite.com/manufacturing/) - [Distribution](https://trustedinsite.com/distribution/) - [Professional Services](https://trustedinsite.com/professional-services/) - [Leading Businesses](https://trustedinsite.com/it-leading-business/) - [Non-Profit Organizations](https://trustedinsite.com/non-profit-support/) - - Resources - [Downloadable Guides](https://trustedinsite.com/resources/) - [Case Studies](https://trustedinsite.com/resources/#casestudies) - [Events](https://trustedinsite.com/events/) - [Benefits of Hybrid Cloud Computing](https://trustedinsite.com/cloud-solutions/) - [Data Security Protection](https://trustedinsite.com/data-security-protection/) - [Health InsITe 365](https://trustedinsite.com/health-insite-365/) - - Company - [About](https://trustedinsite.com/who-we-are/) - [Blog](https://blog.trustedinsite.com/blog) - [Careers](https://trustedinsite.com/careers/) - [Contact](https://trustedinsite.com/contact/)