The Four-Part Formula to Preventing Cyberattacks

Recorded live on October 23, 2024.

The four-part formula to preventing cyberattacks

Most organizations think about cybersecurity as something that kicks in after something goes wrong. Detection, response, recovery. But that reactive posture leaves a lot of value on the table. In this webinar, Earl, Director of Service Strategy at Field Effect, walks through a more structured approach: proactive risk management, built around four repeating phases that help organizations get ahead of threats before they become incidents.

What is cybersecurity risk management?

Risk management, as a discipline, is already embedded in most of what IT teams do day to day. The goal here is to add a bit of formality and structure to that existing work. At its core, cybersecurity risk management is the process of identifying where risk exists in your environment, assessing the likelihood and potential impact of that risk being realized, responding to it through mitigation or acceptance, and then monitoring continuously so the cycle keeps running.

The payoff is significant. Removing attack opportunities before they can be exploited reduces the cost of recovery, makes your organization less attractive as a target, and frees IT teams from the constant reactive scramble that makes the job so draining. As the analogy goes: everyone goes to the dentist, but the point of brushing and flossing in between is to make sure there is as little to deal with when you get there as possible. Risk management works the same way.

The four phases

Phase 1: Identification

Everything starts with knowing your environment. You cannot protect what you cannot see.

This means building a thorough inventory of your IT footprint: the devices present, the accounts and users, the services running, the owners of those systems, and the software installed on them. Think of it like understanding all the points of access in a building. You need to know where the doors and windows are before you can evaluate how well they are secured.

This identification phase is also where you begin cataloguing where vulnerabilities or risks might be present. Asset management is one term for this work. The depth and quality of everything that follows depends on how well you know your environment at this stage.

Phase 2: Assessment

Once you understand your environment, you need to assess the risks within it. That means evaluating two things: the likelihood of a given risk being exploited, and the impact it would have if it were.

An unpatched system on an internet-facing server carries very different risk than the same vulnerability on an isolated internal machine. Understanding that context is what separates a raw list of vulnerabilities from something actionable.

One important nuance here is that not all risk is the result of malicious actors. Misconfigurations are a prime example of risk that is often realized by accident rather than intent. The assessment phase needs to account for both possibilities.

Tools like CVE (Common Vulnerability Enumeration) scoring provide a practical starting point for prioritization. High likelihood combined with high impact is where attention should go first. The goal is to move from a list of known risks to a ranked order of what needs addressing.

Phase 3: Response

With priorities established, the response phase is about taking action. This can take several forms.

The most familiar is remediation: patching software, updating systems, closing exposed services. But response also includes implementing higher-order security controls, whether technical or policy-based, that will reduce risk on an ongoing basis. A simple example is restricting employees from installing unauthorized software on their devices. That is a one-time policy decision that carries forward and improves your overall security posture over time.

Not every risk can be fully mitigated. Some must be accepted, ideally as an informed decision made with a clear understanding of likelihood and impact rather than simply overlooked. Knowing you have accepted a risk is fundamentally different from not knowing it exists.

Phase 4: Monitoring

The fourth phase closes the loop and turns the process into a cycle. Monitoring is where ongoing visibility into your environment feeds back into identification, surfacing new risks as they emerge.

A firewall gives you a powerful but narrow view of your environment. The broader your monitoring aperture, the better positioned you are to do effective risk management. This phase is not just about detecting active threats or malicious activity. It is also about surfacing patch management gaps, misconfigurations, weak encryption, and other vulnerabilities that accumulate quietly over time.

Monitoring and identification have a natural synergy: the telemetry from your devices, network, and cloud services is a continuous source of insight for risk management, not just a tool for catching attackers in the act.

Common cyber risks to manage

Unpatched software

Unpatched software is the most common and recurring risk IT teams face. Web browsers are a particularly high-frequency example: vulnerabilities are discovered regularly, exploited quickly in the wild, and often the subject of active exploitation programs. Many browsers can be set to auto-update, but most software environments contain far more than browsers, including legacy applications where patching is harder to manage.

A quick survey of CVE publications for any given year gives a sense of just how frequently new vulnerabilities emerge and how often they recur across familiar software vendors.

Vulnerable operating systems

Operating system vulnerabilities are closely related to software patching but warrant separate attention. End-of-life OS versions are a particularly common challenge: extended support arrangements are sometimes forgotten, patching lapses, and organizations find themselves running systems with no vendor path to remediation. Managing OS lifecycle across a mixed environment of Windows, Mac, and Linux machines adds another layer of complexity for IT teams.

Exposed RDP

Exposed remote desktop protocol is a classic risk that remains persistently relevant. RDP and other network gateway or remote access entry points are routinely probed and attacked, whether through brute force or by leveraging compromised credentials. This risk often surfaces in organizations going through IT transitions, where a previous team left services inadequately secured or where the natural evolution of technology has weakened configurations over time.

Exposed RDP represents a broader category of gateway and access point risks. Any service that provides a foothold into the network will attract attention from attackers once discovered.

End-of-life software

End-of-life software is distinct from unpatched software in that there is no longer a vendor roadmap for updates. Organizations sometimes inherit legacy software that a department still relies on, or find that lifecycle management has simply lapsed. The risk here is often realized as a secondary vector: an attacker who has already gained access to a network will look for legacy software they can leverage to move laterally or escalate privileges. Old communication tools, administration software, and VoIP systems are common examples.

Weak or outdated encryption

Encryption standards that were considered reliable even a few years ago may no longer offer adequate protection. This applies to data both in transit across networks and at rest in storage. IT teams sometimes lose track of what encryption is in use across their environment, particularly for older services and systems.

This matters for more than just attack prevention. Compliance frameworks, insurance requirements, and accreditation regimes typically mandate specific encryption standards. Understanding whether deprecated encryption suites are active in your environment is important both for security and for meeting those external obligations.

The real challenges

Understanding the four phases is straightforward. Executing them consistently is harder.

Complexity. The range of risk types, the paths by which risks might be realized, and the scale of a modern IT environment, particularly with remote workforces and cloud services in the mix, make risk management genuinely difficult terrain. Managing that complexity is itself a skill, not just a technical problem to solve.

Expertise. Doing risk management well across the full range of software, network, cloud, and human factors requires broad knowledge. Not every organization can maintain that depth in-house, and knowing where to supplement internal expertise is an important decision.

Time. New vulnerabilities emerge daily. Tracking threat intelligence, maintaining user awareness training, running through the four phases repeatedly, and keeping pace with a dynamic IT environment all require ongoing investment of time. This is not a one-time exercise. The relationship between monitoring and identification means the cycle never stops, and that has real resource implications for decision makers.

How to make it manageable

Start with full visibility. Gaining a broad, clear view of your IT environment, hardware, cloud services, and users is the essential foundation. Anything that gives your IT team a wider aperture into their environment is a significant advantage for risk management.

Automate prioritization where you can. A ranked list of risks based on likelihood and impact is far more actionable than an undifferentiated list of vulnerabilities. CVE scoring is one practical tool. Building or borrowing a risk roadmap that sequences remediation efforts helps decision makers understand where resources should go and why.

Find the right expertise. Whether that means building it internally or working with a security service provider, the guidance you act on should be clear, jargon-free, and relevant to your specific context. If your team cannot operationalize the information they are given, it is not useful, regardless of how technically sophisticated it is. Organizations with no dedicated IT staff need simple, step-by-step instructions. Those with a full IT team can engage more deeply with the underlying analysis.

Build in proactive threat hunting. Beyond passive monitoring, there is value in actively looking for changes, anomalies, and new vulnerabilities in your environment. This might mean periodically examining data sets that do not get regular attention, or looking at corners of your environment that are not part of normal day-to-day monitoring. This is where new and emerging threats often reveal themselves before they become incidents.

Choose a security solution that matches your context. The right solution gives you the level of insight you need and delivers it in a way your team can actually act on. Visibility and actionability are the two criteria that matter most. Complexity is inherent to cybersecurity and risk management, but that complexity should be absorbed by the solution and the people supporting it, not passed through to the person trying to run their business.

The bottom line

Risk management is not a replacement for detection and response. It is the layer that sits in front of it, reducing the likelihood that detection and response ever need to be invoked. Attacks can unfold very quickly once a foothold is established, whether through ransomware spreading across a network or a business email compromise escalating into financial fraud. The further upstream you can intervene, the better the outcome.

The goal is to make an attacker's job as hard as possible. That means shrinking your threat surface systematically, giving your IT teams the tools and information they need to do it without burning out, and treating risk management not as a one-time project but as a continuous cycle that keeps pace with a constantly changing environment. An ounce of prevention, as the saying goes, is worth a pound of cure.