One of the most pressing cybersecurity sub-topics for enterprise environments is Governance, Risk & Compliance (GRC). This area is concerned with ensuring that an organization’s information security program is aligned with company rules, threat management, and legal requirements. Depending on the sector of an individual organization, there may be extremely stringent GRC requirements, or more lax requirements. For example, organizations in the health industry will be bound by HIPAA, while organizations handling large amounts of raw financial data may be bound by GLBA, SOX, PCI DSS, etc.
Even if an organization does not have major regulatory requirements to fulfill, it should still maintain good cybersecurity governance and compliance. This framework, while just a personal project, tries to provide many industry standard controls and best practices so that smaller organizations can still have some form of quality cybersecurity governance.
Regardless of its specific requirements, an organization’s information security program needs to be continually assessed to ensure it stays in compliance with applicable standards and regulations. This is usually done via auditing. An audit is a formal assessment to determine if controls were selected properly, that they continue to function properly, and that the organization meets all the requirements to comply with necessary standards and regulations.
The requirements for audits depend on the specifics of the organization, and this framework cannot guess them. However, it will give a brief overview of the basic terminology and process for audits.
There are two main types of audits:
- Internal Audit: performed by employees internal to the organization. These audits are typically used by the organization to assess control effectiveness, identify missing requirements, and prove due diligence to customers/collaborators/regulators.
- External Audit: performed by third parties that are licensed to provide auditing services. Since these auditors are external to the organization, there is a sense of independence and reliability that is often lacking from internal audits. External auditors are expected to be neutral, lack conflicts of interest, and immune to pressure politics. Results from external audits can be used for the same purposes as internal audits; guiding refinement of specific security controls. However, they are also often used to prove compliance to the public and can be issued to customers/collaborators that request proof of ongoing compliance.
Before an audit is done, the specific parameters need to be negotiated between the organization and the auditors. Such parameters include:
- Duration of the audit
- Locations covered (physical and logical)
- Out of scope locations
The key parameter to agree on is the scope; how much of the network to cover and specific precautions/exclusions for different areas.
The organization and the auditor(s) also need to mutually understand the methodology for the audit. Smaller organizations may be able to perform deep inspections of every single piece of infrastructure. Larger organizations with hundreds of users and devices likely cannot feasibly scrutinize every single one. In such cases, a sample size is usually selected from the overall scope, and said sample is then assessed. The sample needs to be reasonably reflective of the organization so that the results can be reasonably assumed to represent the whole population.
During the actual inspection, auditors will need to keep rigorous documentation of various factors and observations such as:
- Uncovered vulnerabilities
- Nonfunctional controls
- Gaps between current state and desired state
- EOL/EOS systems
- Licensing issues
After the audit is complete, the auditors gather their findings and prepare an official report for the organization. The report outlines the findings, highlights noncompliance, and usually gives the organization some form of a score or pass/fail. The auditors should not recommend solutions to any issues, as this goes beyond their line of duty and creates a conflict of interest. However, auditors can highlight areas of the information security program that they find troubling or unsatisfactory in meeting specific standards/regulations.
The organization must take audit results very seriously, regardless of whether they are internal or external. Organizations that deal heavily with technological/online business operations should consider publishing their audit results as proof of due diligence to the public. This can help improve trust and preserve a good public image. However, it is important to ensure that the audit reports do not expose to much information about the organization’s network architecture and specific platforms, as this can help threat actors craft targeted attacks.
Audit results should be used as input for the next iteration of the information security program. In Stage 2, we outlined performing an initial Gap Analysis that clearly breaks down where the organization’s information security capabilities are vs where they need to be. Think of audit results as new rounds of gap analysis, highlighting areas for improvement that will be re-assessed, planned, and implemented in regular re-iterations of the CyberLadder Framework.