Continued from page 1
Companies must also consider value of audits deliverables/results. Deliverables must not only detail all of current vulnerabilities, but also prioritize what issues are important, document proven methodologies for remediating vulnerabilities, and provide cost-effective methods to mitigate risk. The majority of companies cannot afford to maintain staff and application software necessary to conduct an audit at this level. Even those companies that do have such a significant security budget often use an outsourced firm to validate their own efforts.
Some additional benefits of a professional outsourced audit are: recording an objective baseline and changes on a periodic basis, having a trusted security partner to turn to as issues arise, and ability to meet industry requirements for objective third-party auditing. For those companies outsourcing audits as a secondary check, it also assists in justifying security budgets, by validating current security-related expenditures.
Although it was mentioned that companies are sometimes challenged with prioritizing security matters, based on our own experience there is a trend with technology executives, to place a higher priority on network security. The newfound emphasis applies to both internal and external audits and really comes into play with those companies that have a great reliance on Internet and business continuance.
Finding all of your vulnerabilities is increasingly difficult without a full suite of auditing tools, but remember, finding vulnerabilities is only half battle. In order for audit deliverables to be truly effective they have to include professional feedback on what issues are important, remediation efforts detailed and prioritized, as well as describe how all of effort and expense will affect level of risk.
If you feel your systems environment could pass a security audit, but haven ít had one, our experience shows you might be surprised by a failing grade. If you have had an audit and vulnerabilities were exposed, hopefully you have an action plan you are utilizing to eliminate vulnerabilities. Once action plans are complete, you might consider outsourcing your next audit to validate your efforts.
Michael Bruck is the founding partner of Bruck and Associates, Inc. an 8 year old Information Security consulting firm. Mr. Bruck leads his security team with a successful 16-year background in IT management and senior engineering positions. He can be reached through the website at http://www.bruck-inc.com or by email: firstname.lastname@example.org.