If you’re considering how to get the most value from your information security risk assessment—or whether you even need one—use these best practices shared by Pratum vCISO Ben Hall. Ben and the rest of the Pratum team conduct numerous information security risk assessments each year, giving them deep insight into how you can maximize this key part of your cybersecurity strategy.
We always see issues with access controls, whether that be access to the network, access to applications or access to the facility. There is always some gap in control when it relates to giving an individual user access to those resources. A lot of times, we see organizations give administrator privileges to an end-user that may not be doing development activities. So not only can they make changes to their local workstation, but they can also make changes to an application or to something like customer data when it may not be necessary for their job role.
Change management comes up a lot as well. A lot of organizations think they have pretty robust change management controls in place, but we can typically identify that it’s not the case when we ask for selections. So if it’s firewall changes and you make changes every Wednesday, we’re going to ask if there are tickets to back that up. If you’re doing development changes where you’re going from one version to another, where’s the development process within that? How are you evaluating that the development change is actually good and will fit within the environment? Is there a quality assurance (QA) test?
Incident response comes up now more than ever based on all the news we’re seeing, the ransomware events, the actions of malicious employees, etc. With all that going on, it’s crucial to be able to get your team together and properly respond to an incident.
They almost always find something surprising in there. Most people tend to think their environment is more secure than it really is. And that’s the benefit of bringing in a third-party for the risk assessment. We can provide that objective view. We’re not intimate with those controls, so we can ask the questions of why they exist in the first place. So the risk posture they expect versus the reality comes up a lot, and it can make those meetings a little interesting.
Something that comes up often is a lot of shadow IT controls and applications that exist. You may be aware, for example, of what your Accounts Payable department is using to make sure all the statements are paid. But there may be additional things like cloud-sharing tools that you were unaware of and that the team tells the external auditor about. We also like to meet with the finance team and CFO or others in the C-suite to get that additional insight as to what’s existing today and what their expectations are for IT. It sheds a lot of light on what the CEO expects IT to do but has never told them about and that IT has never even considered.
One thing we do with every report is identify the 5-10 items that we’d start with if it was our program. So we help you set that prioritization focusing on Implementation Level 1: This is what needs to take place, all the way through. We also provide a risk register that lists any additional opportunities for improvement discovered through the risk assessment. So that way you not only have that executive overview of these 10 things to do immediately, but you have that other comprehensive list of activities that can be incorporated throughout the year.
The thing that surprises me the most is the lack of multifactor authentication across the board. You would think that with 2020 and that immediate shift to remote workforce, everyone would have widely implemented some kind of MFA or 2FA by now, I’m surprised that it’s still a gap with a lot of organizations that still have pretty substantial applications open to the network. A lot of times you’ll see that maybe they have put in some kind of VPN, but even that still doesn’t have MFA or 2FA tied to it. This remote shift is going to stay a while, so if you don’t already have plans to implement MFA or 2FA, that would probably be my #1 thing to start working toward this year.
Best practice is to do it at least annually. Even better practice is to have that annual risk assessment, but then have some kind of risk management committee. So not only are you evaluating those controls identified in the risk assessment and utilizing your risk register to manage a lot of that, but you’re also meeting on a quarterly or even monthly basis to look through what exists, adding new risks that have been identified throughout the year to that list and talking through a remediation plan. So you need that continuous evolution of quarterly processes reviewing that process in addition to the annual formalized risk assessment.
You could, and we often encourage that. But if you look at it like going to a gym and hiring a trainer, you really benefit from getting an expert opinion on what kind of workout makes the most sense for you. That can tie into risk assessments, too. You want that external opinion from subject matter experts who do this on a daily basis and can truly assess your organization with that independent lens. As a control owner within that organization, you tend to be a little guarded as far as to what some of those activities could be. In comparison, an independent auditor or assessor can look at those processes objectively and point out potential flaws that exist in the remediation activity. Hard questions will be asked during a good risk assessment. But that said, it’s not a tough engagement. We’re there to help you get better. So it’s best to give us those open, honest answers. We’re here to help you get stronger and get better. There are no wrong answers in a risk assessment.
If you’d like to talk with a Pratum consultant about how to plan a risk assessment in your environment, contact us today.
A thorough penetration testing campaign involves social engineering, vulnerability scanning, and the manual hacking of computer systems, networks, and web applications. This overview shows how a professional team uses multiple types of penetration testing to exploit a variety of attack vectors, just as a real hacker would.
Automated tools seek known security vulnerabilities in your systems such as unpatched software or open ports. The scans reveal risks that may directly impact your organization and point penetration testers to areas they can try to exploit.
Here, penetration testers take a more adversarial approach as they go after specific targets. This type of advanced, focused test emulates Tactics, Techniques and Procedures (TTPs) of mature threat actors. The Red Team attempts to remain invisible to the systems’ defenders (known as the Blue Team).
To learn more about Pratum's penetration testing services, contact us today.
SOC 2® reports are probably coming up in a lot of conversations among your industry peers and key partners. But do you need to get a SOC 2® report? The process represents a significant investment of both money and time (about 18 months to complete a typical SOC 2® Type II reporting process). As you weigh whether the investment is worth it for your business today and in the future, consider these factors. (And if you need a summary of how SOC 2® works, jump to the bottom of this post.)
Companies use the widely accepted SOC 2® compliance model to confirm that their vendors/partners handle information securely. Rather than simply trusting vendors who declare themselves secure, companies can demand a SOC 2® report as third-party proof of the vendor’s security. In a SOC 2® audit, a firm recognized by the American Institute of CPAs (AICPA) reviews a company’s controls over a specific period of time and issues an opinion on its compliance with the standard.
Companies can seek either SOC 2® Type I or Type II. Type I examines the design of controls at a specific point in time. Type II evaluates the operating effectiveness of those controls over a period of time. While a Type I report can be completed fairly quickly, a Type II audit can take up to 18 months, including the readiness and audit periods. Retaining SOC 2® validation requires repeating the audit on a regular basis (usually annually).
Pratum consultants help numerous companies each year determine whether they would benefit from a SOC 2 report and then prepare for the SOC 2 process if they move forward. To learn more about how Pratum can help simplify the journey for you, contact us today.
Get our blog articles delivered
to your inbox: