The Components of Strong Cybersecurity Plans Part Three: Security Auditing
Get a taste of one of what one of our key note sessions will be like with this blog post. One of the authors of this blog post, Mark Lanterman, will be presenting the first general session on Tuesday, called "Easiest Catch: Don’t be Another Fish in the ‘Net’".
By Mark Lanterman, Chief Technology Officer, Computer Forensic Services
Carolyn Engstrom, Director of Corporate Compliance
In the last two articles of this series, I discussed the role of maturity assessment and security assessment as connected though distinct aspects of a strong security program. This article will delve into a third and comparatively more in-depth component. Security auditing builds upon the information reached as a result of the security assessment portion in order to come to conclusions about the efficiency of an organization’s internal controls.
A security audit focuses on the completeness, design, implementation, and efficacy of internal security controls. While controls are identified during the security assessment to mitigate identified risks, a security assessment provides only a rudimentary evaluation of the control design. Perhaps more importantly, a security assessment is conducted under the assumption that the controls are effective in mitigating risks. Conversely, a security audit will delve much deeper into how a particular control is designed and how it is implemented over a period of review. Periods of review are decided by management based on the amount of assurance desired that a control is operating as expected. This period typically lasts twelve months, but can ultimately be any length of time depending upon the needs of the organization.
Security audits can vary widely in their scope and rigor. Although some controls are identified during the security risk assessment, security auditing is another method of independently reviewing the completeness and accuracy of the risks and controls. Controls have many different potential categorizations to identify potential vulnerabilities in their design and implementation. Read More of the blog post here.
See Part One of this series | See Part Two of this series
Register for the Compliance and Ethics Institute now and see Mark Lanterman in person.