Cyber security self-assessment: find the security controls you need

How to choose cyber security controls

Security controls are the safeguards that stop, detect or limit an attack: email filtering, endpoint protection, central logging, access controls and the people who watch them. The right set depends less on the size of your organisation than on where your systems run, what you already have, and who would notice if something went wrong.

Most organisations do not need every cyber security tool on the market. They need the few controls that close their biggest gaps, set up well and actually watched. A practical way to choose is to work through four questions:

1. What are you most worried about? Start from the attacks that would hurt you most, such as ransomware stopping operations or a fake invoice email being paid.
2. Where do your systems and data live? On-premises servers, public cloud, SaaS such as Microsoft 365 and industrial equipment each need different protection.
3. What do you already have? A control you own but have not configured or monitored is often a quicker win than a new product.
4. Who responds to an alert? Detection only helps if someone acts on it. If nobody is watching, that gap usually comes before any new tool.

The finder on this page asks exactly these questions and scores the answers with fixed rules, so the same answers always give the same result. It is a cyber security self-assessment, a starting point for a conversation rather than a full assessment of your environment.

The control areas in plain English

These are the areas the finder can recommend, with the security platforms TOM SHAW supplies, implements, integrates and supports in Australia as an authorised partner.

• Email and human risk: stopping phishing, impersonation and malicious attachments, and helping people spot what gets through. Mimecast.
• Endpoint and ransomware protection: detecting and stopping malicious activity on laptops, desktops and servers, including ransomware. SentinelOne and Halcyon.
• Network detection: watching network traffic for attackers who are already inside. Vectra AI and OpenText.
• Remote access and SASE: giving staff and branch offices secure access to applications from anywhere. Cato Networks, Netskope and Akamai.
• Cloud security: finding misconfigurations, exposed resources and risky permissions in AWS, Azure and Google Cloud. Wiz.
• Data security: knowing where sensitive data lives and stopping it leaking. Cyera and Netskope.
• Asset visibility: a complete, current list of devices, users and systems, because you can only protect what you know about. Axonius.
• Security validation: safely testing whether your defences stop real attack techniques. Pentera.
• External threats and attack surface: seeing your organisation as an attacker does from the internet, including brand abuse and exposed systems. CYFIRMA and watchTowr.
• Applications and APIs: protecting websites and APIs from attack and finding flaws in applications. Akamai and OpenText.
• Software supply chain: securing the open-source packages and build pipeline behind the software you make. JFrog.
• Logging and detection: collecting security events in one place so attacks can be detected and investigated. Our SIEM service, Cloudera and OpenText. New to the idea? Read what is SIEM.
• Managed detection and response: security analysts who watch, investigate and respond to alerts for you. Our SOC, MDR and XDR service and Motorola Solutions ActiveEye. See also EDR vs XDR vs MDR.
• Industrial and OT devices: visibility and protection for connected industrial equipment. Stealth Connect, TOM SHAW's industrial IoT security platform.

Cyber security for small business

A smaller organisation rarely has a security team, so the controls that matter most are the ones that work without constant attention: strong email protection, endpoint protection on every device, and someone, in-house or managed, who will act when an alert fires. Larger organisations usually add asset visibility, central logging and regular testing of their defences. Either way, a short cyber security checklist beats a long list of products: know what you have, protect the obvious entry points, make sure someone is watching, and check that it all works.