-: Audits and assessments.
I can't count the number of times
I've gone into an organization
and they have great policies.
They have great procedures.
They have great guidelines and great standards,
all of that stuff you need
for a good cybersecurity foundation and framework,
but they're not following any of it.
And so when you look at this, you have to remember
that quality control is important.
You look at the chairman from IBM and he said,
"You get what you inspect, not what you expect."
Now what does that really mean?
Well, it means that you need to evaluate
your cybersecurity program to make sure
that it's been effectively run and efficiently run.
Evaluation is going to occur as an audit or an assessment.
When you're doing an audit, an audit is a formal review
of your organization's cybersecurity program,
and it's usually done internally,
but there are specific things like PCI DSS
that do require external audits as well.
In this, you're going to see rigorous, formal testing
of all of the controls done through vulnerability analysis,
by reading your policies and procedures,
and maybe even doing a penetration test,
and at the end of all that you'll get a formal declaration
by the auditor that you're compliant.
Auditing is a serious thing
and you gotta make sure you do it,
and it's recommended you do it internally
at least quarterly and externally at least annually.
Now, when we start talking about assessments,
this is a much less formal review.
This is where you kind of are requesting it
by the organization itself for process improvement purposes.
You can gather your information through interviews
with the employees, or by doing a review
of your policies and procedures,
but really you're taking people's word at it.
So if I was coming in to do an assessment
of your organization, I might sit down
with your system administrators and say,
"Well, how do you check before somebody is given
"permission to that directory?"
And they could say,
"Oh well, I go and call their supervisor."
But I don't check that they actually did it,
I just ask them about it.
Or I say, "Do you have a policy on this?"
"Oh yeah, I have a policy on that."
But they never have to show it to me.
In an audit, they would actually have to show me
that policy, and I would go through and scrutinize it.
But with an assessment, it's much more lax.
It's really just a checklist kind of a thing.
Which should you do?
Well, both.
You should do assessments, but really you want to make sure
you're doing auditing at least annually
to ensure you're getting the quality
out of your cybersecurity program that you're looking for,
and ensure you're maintaining those standards.