Auditing information security covers topics from auditing the physical security of data centers to auditing the logical security of databases and more. From this view point, add the dimension that each business is different and has its own challenges; and objectives in terms of the value they hope to gain from undergoing the process of the internal security audit.

A security audit is a systematic evaluation of the security of a company’s information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system’s physical configuration and environment, software, information handling processes, and user practices. Security audits are often used to determine regulatory compliance. – Techopedia

 

While the business value of an effective audit is not in question, the proposal of an audit is often met with resistance:  the Information Systems department (IS) vs the Auditor. The perception from the IS side is that they feel like they are being policed or deliberately being set up to be caught with their proverbial pants down. The result? The equivalent of digital hide and seek between two company departments who should actually be complementing each other’s role and objectives. Communicating the specific objective, playing open cards with each other and sharing insights of the systems in questions will eliminate conflict from the start.

There is no one-size fits all security audit

While it is important to ensure that your company has an Internal Security Policy that covers all aspects of information security, and audit should focus on one or two areas that will have the biggest impact on business. It could be a combination of any of the following areas:

• Information Security (general)

• Business Continuity Management

• Mobile

• Cloud

• IT Risk Management

• Programme Risk

• Software / IT Asset Management

• Social Media Risk Management

• Segregation of duties / Identity and access management

• Data loss prevention and privacy

“Effective risk management is the product of multiple layers of risk defense. Internal Audit should support the board’s need to understand the effectiveness of cybersecurity controls.”  – Deloitte.

Six Key Benefits

• Improve the “control environment” of the organisation

• Ensure that the organisation process-dependent instead of person-dependent

• Identify redundancies in operational and control procedures and provides recommendations to improve the efficiency and effectiveness of procedures

• Serve as an Early Warning System, enabling deficiencies to be identified and remediated on a timely basis (i.e. prior to external, regulatory or compliance audits)

• Ultimately increase accountability within the organisation

• With an internal audit function, management would have an advocate, a risk manager, a controls expert, an efficiency specialist, a problem-solving partner and a safety net.

Are you considering an internal security audit?

OIC is a security consulting firm based in Cape Town. We get excited about challenging security issues and are ready to provide real solutions to securing your company’s most valuable assets:  your people, processes and technology. Contact us: engage@ongers.com

Source credits:

https://partners-network.com

https://chapters.theiia.org/Orange%20County/IIA%20OC%20Presentation%20Downloads/2015-08-%20Cyber%20IA.pdf

http://www.ey.com/Publication/vwLUAssets/Ten_key_IT_considerations_for_internal_audit/$FILE/Ten_key_IT_considerations_for_internal_audit.pdf

This excerpt from Forbes.com explains the value of the pen test.

Here are a few of the reasons organizations invest in penetration testing:

• Determining the feasibility of a particular set of attack vectors
• Identifying higher-risk vulnerabilities that result from a combination of lower-risk vulnerabilities exploited in a particular sequence
• Identifying vulnerabilities that may be difficult or impossible to detect with automated network or application vulnerability scanning software
• Assessing the magnitude of potential business and operational impacts of successful attacks
• Testing the ability of network defenders to successfully detect and respond to the attacks
• Providing evidence to support increased investments in security personnel and technology to C-level management, investors, and customers
• Meeting compliance  (for example: the Payment Card Industry Data Security Standard (PCI DSS) requires both annual and ongoing penetration testing (after any system changes)
• Post security incident, an organization needs to determine the vectors that were used to gain access to a compromised system (or entire network). Combined with forensic analysis, a penetration test is often used to re-create the attack chain, or else to validate that new security controls put in place will thwart a similar attack in the future.

OIC offers a range of security related services, including pen testing. Read more here.

Full original article here.

ITIL is intentionally composed of a common sense approach to service management – do what works.

And what works is adapting a common framework of practices that unite all areas of IT service provision toward a single aim – delivering value to the business.

The following list defines the key characteristics of ITIL that contribute to its global success:

•  Non-proprietary – ITIL service management practices are applicable in any IT organization because they are not based on any particular technology platform, or industry type. ITIL is owned by the UK government and not tied to any commercial proprietary practice or solution

•  Non-prescriptive – ITIL offers robust, mature and time-tested practices that have applicability to all types of service organizations. It continues to be useful and relevant in public and private sectors, internal and external service providers, small, medium and large enterprise, and within any technical environment

•  Best practice – ITIL service management practices represent the learning experiences and thought leadership of the world’s best in class service providers

•  Good practice – Not every practice in ITIL can be considered ‘best practice’, and for good reason. For many, a blend of common, good and best practices are what give meaning and achievability to ITSM. In some respects, best practices are the flavour of the day. All best practices become common practices over time, being replaced by new best practices.

OIC offers ITIL training from small groups from foundation level. Read more here.

Source credit: myITstudy.com

A great article by flyplugins.com, especially for companies who use wordpress.

Tip #1 – Start with a secure foundation

When it comes to security, you want to start with a secure foundation. That secure foundation is your computer or laptop. If your computer or laptop is compromised, then securing WordPress might be the least of your worries as a hacker may have entry to your financial accounts, email accounts, etc.

Make sure you use a strong password for your the login on your machine. Otherwise none of this matters.

There are sites on the internet that can create complex passwords at random. They are more difficult to memorize, but please stay away from using common passwords like “password” or “password123”. Also, please don’t keep a text file or spreadsheet on your computer or even a sticky note on your laptop that has all your passwords (yes, this actually happens). If you have tons of passwords to remember, use an application like LastPass (free) to help organize all those user accounts and passwords.

Physical security is also a big deal, especially if you use a laptop. Make sure it’s always stored in a safe location. Laptops are prime targets for hackers because they are so easy to grab and go. Your laptop has lots of information that hackers would love to get their hands on.

Make sure you are using an anti-virus program on your computer. There are free virus programs that are just as good as the expensive ones that require a yearly subscription. However, the important thing is to have some protection on your computer. Make sure you have your virus definitions updating on a daily basis.

If you want to take this a step further, you can also install a firewall program on your computer. Sometimes the anti-virus application may have a built-in firewall, however, at minimum have an anti-virus program.

Before you jump on a wifi connection, make sure you can trust it. Hackers can setup wireless routers with “free wifi” and once connected, they can sniff all the data transmitted through the router. If possible, use a VPN connection or make sure you don’t access sensitive information on the internet when on public wifi.

Tip #2 – Get on a secure web hosting service

We are currently hosted on WP Engine which has excellent server level security. Not only that, but since they are a WordPress only hosting company, they take WordPress serious. In fact, they have a “plugin blacklist” which outlines plugins that can’t be used on sites hosted on WP Engine. Those plugins are not necessarily bad, but they may contain vulnerabilities or run inefficiently which affects server speed. WP Engine may not suit everyone’s need, however, the point is to make sure you research the level of security that your hosting company provides.

Another great hosting option comes from our good friends at Pagely. Pagely also offers excellent security methods to protect their customer websites.

Tip #3 – Setup WordPress right from the get go

This could probably be a blog post in and of itself, however, I will just hit a few major points.

• Don’t use “admin” as the primary administrator account
• Don’t begin your database table names with ‘wp_’
• As always, use strong passwords for the admin account(s)
• Consider using two-factor authentication

There are tons of articles available that can help you harden your WordPress site.

Tip #4 – Stay updated and keep the trash out

When you look at your plugin list, do you notice that there are a lot of updates available? Don’t be that guy! These are not always just new features…they could potentially have security updates rolled into the latest version. It’s absolutely critical to keep WordPress up to date as well as your themes and plugins. I know some individuals are reluctant to update because they are afraid to break their site. I get it. However, most people don’t use test sites to test their themes and plugins.

Since we use WP Engine, each one of our sites has a staging site so we can test any updates before rolling them out on our production site. If you don’t have staging site, it would be worthwhile to get one even if it’s just a subdomain of your current site. You could even setup a local development environment on your computer using MAMP (Apple) or WAMP (Windows)which includes the entire development stack.

Another tip to remember is to only install plugins you trust. The plugins available on WordPress.org are typically pretty safe. They do have code reviewers looking at plugins, however, it’s only on the initial plugin submission. Just use caution with free plugins. Be sure to look at the reviews, the support topics, and the download count as they can be indicators as to whether the plugin is good or not.

A very important tip to follow is NEVER download a premium plugin for “free”. There are many sites out there slinging premium plugins for free, however, they are not safe. The plugins could contain malware and essentially you will end up with an infected website. Not to mention, it’s stealing! Most premium plugins will only provide support if the plugin purchase was legit.

Tip #5 – Secure the goods

Any time I spin up a WordPress site, one of the first plugins that gets installed is Sucuri. Sucuri is a free plugin which performs security monitoring, malware detection, and contains tools to harden your WordPress website.

If you’ve ever typed in the URL to your website only to find the “red screen of death”, then you know what it feels like to be hacked.

Believe it or not, I’ve had this happen to me and it’s no fun trying to figure out where in the world the malware has been added into your site. In fact, you could spend hours on end replacing plugins, WordPress core files, and theme files only to get re-infected.

Sucuri’s scan feature will find malware in a matter of minutes. Then you can begin the process of cleaning your site, changing passwords and hardening your site.

Here is a list of Sucuri’s primary features:

• Security Activity Auditing
• File Integrity Monitoring
• Remote Malware Scanning
• Blacklist Monitoring
• Effective Security Hardening
• Post-Hack Security Actions
• Security Notifications
• Website Firewall (cloud based firewall add-on which requires a subscription)

When you first install the plugin, it’s a little overwhelming, however, the first thing you may want to do is scan your site for malware. Go through each option carefully and configure the plugin to meet your needs as it will be well worth the time investment.

Full article source at flyplugins.com.