Skip to main content
SolarWinds MSP
  • Login
  • Support
  • Partnerships
    • Partnerships Overview
    • Solution Provider Program
    • Technology Alliance Program
    • Distributor Program
SolarWinds MSP
  • Products
    • SolarWinds N-central Automate what you need. Tackle complex networks. Try this remote monitoring and management solution built to help maximize efficiency and scale.
    • SolarWinds RMM Start fast. Grow at your own pace. Try this powerful but simple remote monitoring and management solution.
    • SolarWinds EDR Defend against ransomware, zero-day attacks, and evolving online threats with Endpoint Detection and Response
    • SolarWinds Backup Manage data protection for servers, workstations applications, documents and Microsoft 365 from one SaaS dashboard.
    • Mail Protection & Archiving Protect users from email threats and downtime.
    • Password Management Easily adopt and demonstrate best practice password and documentation management workflows.
      • Passportal Demo
    • PSA & Ticketing Manage ticketing, reporting, and billing to increase helpdesk efficiency.
    • Remote Support Help support customers and their devices with remote support tools designed to be fast and powerful.
  • Solutions

    I'm looking for...

    • Security Solutions
    • Monitoring Solutions
    • Efficiency Solutions
  • Resources
    • Blog
    • Webcasts & Events
    • Ask the N-central Experts
    • Daily Live Demos
    • RMM Foundations Training
    • Upcoming Events
    • Upcoming Webcasts
    • Resource Center
    • COVID-19 Resources
    • Resource Library
      • Case Studies
      • Product Information
      • eBooks
      • White Papers
      • Infographics
    • SolarWinds MSP Free Tools
    • GDPR Resource Center
    • Security Resource Center
    • MSP Institute Webinar Series
    • MSP Advice Project
  • About
    • Contact
    • Customer Success
    • Worldwide sales and support
    • Careers
    • Awards and Recognition
    • Get A Quote
    • Newsroom
      • Press Releases
      • In The News
      • Media Contacts
      • COVID-19 Response
    • Leadership Team
    • Legal
      • Cookie Policy
      • Privacy Notice
      • Software Services Agreement
      • Terms of Use
      • Backup Fair Use Policy
    • Security
      • SolarWinds Security Statement
      • Vendor Data Protection Requirements
    • Support
  • IT Departments
  • Contact Sales
    • Get A Quote
    • General Inquiry
  • TRY NOW
    • SolarWinds RMM
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Passportal
    • SolarWinds N-central
    • SolarWinds Mail Assure
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
  • Request a Quote
  • Try Now
    • SolarWinds RMM
    • SolarWinds N-central
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Mail Assure
    • SolarWinds Passportal
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
Request quote
Filter Blogs
  • Filter by:
  • MSP Business
    • Automation
    • Backup & Disaster Recovery
    • Security-series
    • Best Practices
    • Business
    • Business Growth
    • Business Risk
    • Cloud Computing
    • Customer Service
    • Cybersecurity
    • Cybersecurity Awareness Month
    • Data
    • GDPR
    • Internet of Things
    • IT Support
    • ITSM
    • LOGICcards
    • Machine Learning
    • Mail
    • Managed Services
    • Marketing
    • Mobile
    • Networking
    • Operations
    • Podcast
    • Product
    • PSA
    • Remote Management
    • Research & Trends
    • Risk Intelligence
    • Security
    • Security Vlog
    • Service Desk
    • Services & Support
    • The Head Nerds
    • Tips & Advice
    • Training
Home Blog MSP Business Security 10 Steps to Cybersecurity—Understanding Customer Risk and Where Their “Crown Jewels” Are
Security

10 Steps to Cybersecurity—Understanding Customer Risk and Where Their “Crown Jewels” Are

By Tim Brown
10 April, 2018

Having established that you need to shift the conversation from security to risk with your customers (read my previous blog here), the emphasis has to now be on measuring and quantifying that risk. The first step here is to understand the company’s line of business and what exactly the “bad guys” might be after. 

Doing this across an entire organization or group is a massive undertaking and can be very hard to quantify, so finding a way to break this into digestible chunks is essential. Here, we can learn a lot from a contact of mine who is a CISO for a large multinational financial institution. In order to manage risk across the entire organization, they work with what they define as their “crown jewels”—their most important assets. 

In this particular scenario, one of the criteria for getting on this list is that if compromised, these assets would lose the company $1 billion or more per day. They isolated 20 of these assets across the organization.

At every board meeting, these crown jewels are on the agenda, and the board discusses whether they are sufficiently protected and if the level of risk they face is appropriate to their impact on the business. The board also regularly discusses the organization’s other assets and reviews whether anything else should be included on the list.

Providing concrete security answers

mostvaluable.jpgBy reducing the question to, “can we protect these 20 things?” rather than, “can we protect these 1,000 things?” they have made the question far easier to respond to with concrete answers.

This isn’t saying they are not bothered about protecting anything else in the organization; they naturally have to have robust security to protect all their assets. What they are doing is putting in place a weighted scale of protection, and by defining those assets that potentially have the biggest impact on the company, they are able to quantifiably justify the additional spend required to protect them. 

While this is a much more extreme example than the average MSP or security professional is likely to be dealing with on a regular basis (or indeed ever), working with the concept of crown jewels is the basis for providing companies with an actionable security plan. 

Defining and protecting your crown jewels

So how do you define crown jewels within an organization?

This can be as simple as what the mission of the organization is. For example, with a hospital, the number one priority is always patient care, and everything else goes around that. In this case, the patient becomes the crown jewel, and the patient data is a target that must be protected. As we have seen with the latest ransomware attacks targeting hospitals, it is critical to protect access to patient data, as it is hugely valuable to cybercriminals and very saleable on the dark web. You need to protect these “crown jewels” better than you protect other things.

One of the big mistakes that security professionals often make is they try to put the same level of security across the whole organization, smattering it across like peanut butter. This is not the right approach. You want to be able to give a higher level of security to your crown jewels. By doing this, you are spending appropriately on what is most important to your company and the most attractive targets for any potential intruders.

Expanding your risk assessment to people 

protectingpeople.jpgIt’s not just about data, it’s also about people. You should have a level of security that also includes crown people; these are the people within your organization that could compromise your business or that have the most impact on your environment. The majority of the time, they have access to the highest value IT assets—your super users and root users. Sometimes it’s the CEO. You need to understand how you protect these people at the same time as protecting systems and data. 

In a world where we are constantly striving to make it harder for our cyber-adversaries to achieve their goals, insider threats become very real. We need to be constantly evaluating how we protect crown people, crown apps, and crown systems and put appropriate levels of defences around those things that are the most attractive to adversaries—and can do the most harm to our organizations if compromised. 

As an MSP, one of your first conversations needs to be around what your customer’s crown jewels are. This is a very practical conversation, and one that MSPs are in a great position to have. The majority of MSPs have an in-depth understanding of their customers’ businesses, so they can come into it with enough background knowledge to guide their customer to an understanding of what their crown jewels are and what they should be protecting and monitoring on a regular basis. They can help customers see what is an appropriate level of risk for these assets. It’s this that forms the basis of a weighted security plan that has real visibility and benefit for the organization.

 

 In my next blog, I’ll look at implementing and understanding good cyber-hygiene. 

 

Tim Brown is VP of Security for SolarWinds MSP. He has over 20 years of experience developing and implementing security technology, including identity and access management, vulnerability assessment, security compliance, threat research, vulnerability management, encryption, managed security services, and cloud security. Tim’s experience has made him an in-demand expert on cybersecurity, and has taken him from meeting with members of Congress and the Senate to the Situation Room in the White House. Additionally, Tim has been central in driving advancements in identity frameworks, has worked with the US government on security initiatives, and holds 18 patents on security-related topics. 

 

© 2018 SolarWinds MSP UK Ltd. All rights reserved.

 

The SolarWinds and SolarWinds MSP trademarks, service marks, and logos are the exclusive property of SolarWinds MSP UK Ltd. or its affiliates. All other trademarks are the property of their respective owners.

You might also like...
Automation

What the Head Nerds Were Up to in 2020

Security

January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be

Security

December 2020 Patch Tuesday—A quiet(er) finish to a busy year in vulnerabilities

Security

Documentation Management API and Why It’s Important for the MSP Business

Security

What Is FIPS-140-2 Standard and When Is It Required?

Security

Malware-as-a-Service: A Crucial Reason Why Security Has Grown More Complex

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a subscription.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site

Recent Posts
  • What the Head Nerds Were Up to in 2020
  • RMM and PSA Tools: How to Make the Most of Both
  • How to Empower an IT Help Desk Team for Success
  • Six Tips That Will Make Managing Your MSP Company Easier
  • January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be
Categories:
  • Security (230)
  • Tips & Advice (122)
  • Best Practices (94)
  • Managed Services (86)
  • Backup & Disaster Recovery (83)
  • The Head Nerds (75)
  • Business Growth (75)
  • IT Support (42)
  • Business (39)
  • Automation (37)
  • Cybersecurity (37)
  • Operations (34)
  • Mail (33)
  • Remote Management (28)
  • ITSM (25)
  • Cloud Computing (21)
  • Networking (21)
  • Data (21)
  • Marketing (14)
  • Product (11)
  • PSA (11)
  • Service Desk (5)
  • Services & Support (5)
  • Mobile (4)
  • Risk Intelligence (4)
  • Internet of Things (3)
  • Customer Service (3)
  • GDPR (2)
  • Research & Trends (2)
  • Training (2)
  • Business Risk (1)
  • LOGICcards (1)
Show moreless
SolarWinds MSP

Products
  • SolarWinds RMM
  • SolarWinds N-central
  • SolarWinds Backup
  • SolarWinds EDR
  • SolarWinds MSP Manager
  • SolarWinds Mail Assure
  • SolarWinds Risk Intelligence
  • SolarWinds Take Control
  • SolarWinds Passportal
  • All Products Use Cases
Solutions
  • Security Solutions
  • Monitoring Solutions
  • Efficiency Solutions
  • Identify which RMM solution is right for me
  • Drive Efficiency with Automation
  • Manage my MSP Business More Efficiently
  • Manage my IT Department More Efficiently
  • Layered Security
  • Cross-Platform Support
  • Data-Driven Insights
About
  • About Us
  • Careers
  • Newsroom
  • Leadership Team
  • Upcoming Events
  • Subscription Preferences
  • SolarWinds
  • SolarWinds Trust Center
  • COVID-19 Response
Support
  • SolarWinds RMM
  • Solarwinds N-central
  • SolarWinds Backup
  • SolarWinds Mail Assure
  • SolarWinds Take Control
  • SolarWinds MSP Manager
  • Solarwinds Risk Intelligence
  • Solarwinds Threat Monitor
  • SolarWinds Passportal
  • SolarWinds Take Control Downloads
  • Backup & Recovery Downloads
  • Service Status

Footer 2

  • Legal Documents
  • Privacy
  • California Privacy Rights
  • Security Information
  • Sitemap

© SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.
All Rights Reserved.