Periodic IT audits are not only required; they are a necessity for companies looking to keep up with rapidly changing cyber security threats. Allocating funds to these regular IT checks may not sound like the most exciting way to spend the budget, but we have a few tricks to help you get more out of your next audit.
Assess Locations
We often see businesses addressing security exclusively at their headquarters location. Headquarters generally present the biggest risk for security breaches, but branches may not have the same protection systems and/or the same staff security awareness, which can present serious risks as well. Covering all of your company’s bases and ensuring that each branch passes a security assessment is a good way to prevent a harmful breach in the future.
Inventory Maintenance
Typically, IT audits will uncover dormant or unused systems that are still operating. Removing these extra systems is a good way to reduce high risk vulnerabilities. Make it a point to have your auditors look into any unused resources in your company’s technology infrastructure.
Designate Audit Personnel
In order to improve your business’s audit effectiveness, you need an employee who is involved with and has an understanding of your Cybersecurity needs and goals. When you work with an audit firm, have your designated employee be the main communicator with the auditors. Have them ask about the latest security threats and how to stay abreast on them. Ideally, your designated employee will pick up on the actions and feedback of the auditors. This will help you gain critical knowledge that will be valuable to your organization.
Have Auditors Meet the Board
While you might be tempted to present audit findings directly to the board of directors, it can be beneficial to have the people who conducted the audit do the explaining. Not only can the auditors give detailed explanations of the content in their report, if prompted they can educate the board on the state of security. Board members who have a better grasp of security will make for quicker and more efficient meetings regarding IT security matters in the future.
Keep Legal in the Loop
Auditors provide valuable insight into security regulations. Relaying this information throughout the company will make for smoother transitions when new IT practices are implemented. Don’t forget about your legal team: technology always moves faster than the laws that govern it, so it is very important that they are looped in as soon as possible.
Review Workstation Data Storage Practices and Educate Users on Compliance
Reviewing data storage and access policies on an annual basis is an important and often overlooked area. The principal reason is that people are always busy and sometimes work offline. Assessing where information is stored and who has access to it, has not traditionally been a high priority for most organizations. However, to keep your company, customer and even vendor information secure, it should be stored on your network and not the workstation hard-drives. Ask your auditors about a data storage assessment to gain insight on user practices in relation to their data storage. This will enable you to educate your users on the most secure and compliant method for data storage. This exercise should be conducted at least annually. Findings will identify those not following company data storage policies and those who need continued education on best practices.
Firewall Best Practices Evaluation
Your firewall is a critical component of your overall security posture. Go beyond the typical practice of a simple vulnerability scan. Have your auditors perform an extensive evaluation of the actual setup of the firewall device to ensure the proper configuration. The minimum evaluation should include items like assessment of access controls, VPN setup and encryption levels, as well as firewall rule misconfigurations.
Antivirus Best Practices Evaluation
Malware protection is one of the most vital components of securing your environment from breach activity. Be sure to ask your auditors to evaluate the design, technologies, and configurations used in these systems to ensure they meet the requirements to combat today’s modern breach threats. Have them look for the proper implementation of top-rated desktop and server antivirus software, and have them take a multi-vendor and multi-layer approach, which should include perimeter scanning of email and web traffic.
