Nimish Chandiramani

Discuss on thinkdigit forum

Posted on 01-07-2008

Comment on article

Tweet

• Million Dollar Admin
• Are You Secure For Sure? - August 2008
• Mapping Out Of Disasters

Other Audits

You also need to check up on your backup solution—the frequency of backups, and so on, and perhaps build some redundancy by storing some critical data on an online backup solution —just in case.

Your e-mail server needs to have proper anti-spam and anti-phishing measures built into it— just one successful phishing attack can become a slap in the face of all you’ve done so far.

Failing An Audit

If you’re done with an audit and have passed with flying colours, chances are you didn’t do it right. Around 99 per cent of companies who undergo a security audit fail, but it’s a part of life. What you need to do now is start addressing issues immediately. Based on your audit, you’ll be able to figure out the probability of a scenario more accurately, so you need to make your risk assessment calculations with new values. Once that’s done, you’ve got yourself a prioritised list of the problems you should be attacking.

With the laptop problem we saw before, there’s plenty of potential for damage if it were to get stolen or misplaced. To mitigate this risk, encrypt the laptop’s hard disks. This way, even if the laptop does fall into the wrong hands, it’s virtually useless in them, and more importantly, none of your data can be read.

The Aftermath

Once you’re finished with a security audit, make sure you keep the results handy for your next audit. The results of the audit will give you enough food for thought, and will help you correct flaws in your security policy. Share an overview of the audit with your team, so they too can know what they can do to reduce your risks. If you found a lot of critical flaws in this audit, make sure you schedule a new audit as soon as you’ve addressed these flaws. If this is your first audit, schedule another one very soon, and ensure that you’re auditing your security at least thrice a year.

Finally—and we’ve mentioned this many times in these pages—there is no substitute for an informed and educated team. Therefore, security shouldn’t be just your concern—it should be everyone’s.

nimish.chandiramani@thinkdigit.com