Hannah Grace Holladay, Author at KirkpatrickPrice

Audits are hard, but when done well, they are always beneficial.

We understand if you don’t believe us. We know that audits are overwhelming and complicated. They can feel like daunting tasks that will only create fines or more work for your organization. But that doesn’t have to be the case. There are many benefits of an audit, and even more when you have a partner to help you.

If you don’t believe that an audit can ever be beneficial, allow us to convince you.

What Doesn’t Kill You Makes You Stronger

To make sure that your audit is worth it, you need an experienced audit partner who cares about helping you reach your security and compliance goals.

Audits strengthen business operations, yet many organizations are fearful of the process. Rather than seeing the benefits of information security audits, most people only worry about what will happen if they “fail.”

In short, you can’t fail an audit. Any “failure” or exception identified in an audit exposes potential threats or vulnerabilities that your organization may not have been aware of before the audit. An audit is simply one of the tools you can use to verify that the way you keep your data safe is actually doing that.

Choosing to work with an experienced information security auditor is a great way to make sure your controls are being tested thoroughly so that your organization knows its security program is designed well and operating effectively. This gives you a chance to inspire the entire organization to show a greater commitment to security and compliance and will give you assurance that you are doing everything you can to protect your business.

The Audit Lifecycle

We’ve noticed a pattern in the audit lifecycle, divided over the first three years of an audit journey. In the first year, you may be starting the auditing process for a certain reason; a major client may require proof of some type of compliance, or you may be looking to distinguish your business from the competition. Your organization is probably asking, “Do we have to do this? Do we have to go through this audit? How can compliance help our business?” You’re almost in denial, questioning if this audit is really necessary. You may get stuck in the checkbox mentality, rather than reaping the benefits of information security audits.

In the second year, though, your mindset can switch to, “We are doing this audit.” Your organization should have a little bit more confidence knowing that you completed the audit and reached compliance last year. You may have already seen some of the benefits of audits. You know the process, you know what you need to do, and you’re going to get it done.

With the third year comes the mindset that we hope to get your organization to. We want you to say, “I’m glad we’re doing this audit. This is important for our business.” In this phase, you’ve moved on from the checkbox mentality and you recognize the value and benefits of audits.

When Does an Audit Become a Benefit?

So, when does an audit actually become a benefit?

When it helps your organization maintain customers and attract new ones
When it helps your organization operate more efficiently
When it helps your organization’s processes and controls mature
When it helps distinguish your business from the rest, giving you a competitive advantage
When it helps you avoid fines for non-compliance or breaches
When it creates the Safe Harbor Effect for your business
When it prevents a data breach
When you need to answer to any sort of regulatory body
When you can give a vendor evidence from an auditor who has seen the controls in place operating effectively
When you realize that your organization constantly strengthening its processes and controls

How to Leverage Audits for a Competitive Advantage

In this webinar hosted by LockPath, Joseph Kirkpatrick shares his insights on the auditing process, how your organization can leverage audits to gain a competitive advantage, and the benefits of information security audits and compliance.

Topics like application development, business continuity, data retention, disaster recovery, incident response testing, risk assessment, and audit trends are also discussed in this webinar. By listening to the full session, you’ll also hear from Sam Abadir, Director of Product Management at LockPath. In his position, Sam helps companies automate compliance and policy management for better performance and productivity. In this webinar, he will discuss the beneficial aspects of Lockpath’s Keylight Platform.

About LockPath

LockPath is a leader in integrated risk management solutions. Their suite of applications empower companies to manage risk, demonstrate compliance, monitor information security, and achieve audit-ready status. Companies ranging from 10-person offices to Fortune 10 enterprises in over 15 industries address the Gartner IRM use cases with LockPath solutions. In 2017, they are expanding their application portfolio to provide more efficient and effective programs. Learn more at lockpath.com.

When you work with KirkpatrickPrice, you can make sure your audit will end in success.

When you undergo an audit, you can’t lose. One of our clients recently said,

“If we fail, it will be good for us.”

We hope that you can see the truth in this statement. You aren’t a failure if your auditor identifies an exception.  These exceptions, when remediated properly, give you the power to strengthen your security measures and protect your valuable data from a threat you didn’t even know was possible.

Your audit findings only make you stronger if you let them.

Audits give you the opportunity to create an even more secure environment.

When we work together, we will partner with you to turn these vulnerabilities into your greatest strengths.  Connect with one of our experts today and make your organization unstoppable in the face of today’s threats.

Can I ask you a Question…? Does your organization have a vulnerability management program in place? Do you trust that it’s strong enough to protect what is most important to you? Have you ever thought about what Taylor Swift could teach you about security best practices?

Musical superstar Taylor Swift is appearing in all corners of the internet recently. Whether you or someone you know managed to snag tickets to her much-anticipated Eras Tour or you’re a Chiefs fan, you’ve probably seen Taylor pop up recently. And, what can we say, we couldn’t resist either.

Besides her 12 Grammy Awards and more number 1 albums than any other woman in history, Taylor can also teach us some valuable lessons about security, compliance, and vulnerability management. She knows a thing or two about protecting a reputation. So, here’s what we think some of T-Swift’s songs can teach us about vulnerability management.

This Is Why We Can’t Have Nice Things

Attackers are looking for any chance to exploit the blank space in your infrastructure. And we know all too well that in today’s treacherous threat landscape, we cannot be innocent. We have to be ready for it or else we put our reputations and valuable data at risk.

We know that these threats are overwhelming and maintaining your rep is vital. These attacks can feel like death by a thousand cuts, but luckily there are some practical steps we can take to ensure you aren’t having to tell your boss, “I did something bad.”

Long story short, vulnerability management is critical to your organization’s security program. It means implementing automated vulnerability scanning and patch remediation processes. It also means regularly verifying that the automations are configuring and running properly. This is critical to protecting your company and customer data from attackers and therefore reputational damages.

I Wish You Would Create a Proper Vulnerability Management Program

Attackers are continuously scanning corporate networks from the outside, looking for vulnerabilities to exploit. One of their many goals is compromising networks to exfiltrate data or install ransomware, both of which can be profitable for them but create some bad blood for you.

They generally look for easy targets, or companies with insecure practices. Don’t let your company be an easy target.

According to CIS Control 7, proper vulnerability management programs must:

Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.

Information security teams must continually scan their networks for vulnerabilities to remediate them before attackers find them. Attackers have the same access to vulnerability information that infosec pros do. They also have sophisticated tools to quickly exploit those vulnerabilities.

We can’t wait to remediate vulnerabilities until there’s a convenient time. We must prioritize vulnerability management as the consequences of neglecting it are catastrophic and can lead to some pretty illicit affairs.

Companies that are victims of attackers have paid millions of dollars to ransomware gangs to retrieve their data and have later paid even more millions of dollars to clean up their networks and pay claims in lawsuits from customers and shareholders.

A Vulnerability Management Program is Better Than Revenge

The good news is you’re *not* on your own, kid. This is me trying to help you develop the defense you need to have some peace. You may not be fearless when facing these threats, but hopefully with a well-designed vulnerability management program, there at least won’t be any teardrops on your guitar.

Call it what you want, but there are certain processes you should incorporate into your vulnerability management plan. Let’s take a look at some of the best practices to include in your program:

Quarterly vulnerability scans

Vulnerability scans are a main component of vulnerability management, allowing you to evaluate your systems, software, and infrastructure for unpatched holes and gaps in need of remediation. The frequency of vulnerability scanning depends on a few factors: organizational changes, compliance standards, and security program goals. Vulnerability scans should be conducted after any major system, organization, or infrastructure change to ensure you’re aware of any security gaps. And, of course, to comply with various regulations, annual, quarterly, or monthly vulnerability scanning may be required as part of your information security program.

Overall, an industry best practice is to perform vulnerability scanning at least once per quarter. Quarterly vulnerability scans tend to catch any major security holes that need to be assessed, but depending on your unique organizational needs, you may end up performing scans monthly or even weekly. The best way to assess vulnerability scanning frequency is to thoroughly understand your own security structure and the threats you face.

Patch management

According to NIST, “Patch management is the process for identifying, acquiring, installing, and verifying patches for products and systems.” It involves updating pieces of code that would likely be compromised by malicious individuals and updating security features to software.

It’s likely that patches will need to be made on a regular basis. For this reason, using automated patch management processes is the most effective way to ensure that patches are addressed on a timely, regular basis. By using an automated patch management system, your organization will also save time and financial resources. However, there are instances when manual patch management processes are also useful. For example, in the event that certain software and technologies are not supported by automated patch management, manual patch management techniques should be used.

Remediation plans

Unfortunately, no matter how many controls we put in place, attacks are inevitable. Some of the most important controls and plans to have in place are remediation plans. Establishing strategies for risk management and disaster recovery are essential to the survival of your business processes and your reputation.

Your risk management strategy should prepare your organization through the identification and protection of your valuable assets. When you know what you have to protect, you can decide how best to protect it. Without a risk assessment, you can’t implement the proactive processes that can mitigate the impact of an event.

When an event occurs, you’ll need a disaster recovery and business continuity plan to guide your organization through the remediation process. By creating robust recovery plans, your organization should be able to limit reputational damage, prevent extensive loss, and help your organization maintain or restore business processes as quickly as possible.

Deploy anti-virus software

Anti-virus software can identify and prevent viruses before they infect or damage your systems. The software will scan your files and computer systems to identify any new or wrong patterns that could indicate the presence of a virus. It’s important to keep your anti-virus software up to date so it is capable of identifying all of the latest types of malware.

Unauthorized wireless access point detection

The exploitation of wireless technology within a network is one of the most common paths for malicious users to gain access to your network. Rogue access points can be added to your network through unauthorized Wi-Fi access points. These connections are made without the permission of the network administrator. Wireless access point detection tools can be used to monitor and detect when these connections are made on your network so you can properly deal with them and keep your network secure.

Intrusion-Detection and/or Intrusion-Prevention techniques

Establishing a strong intrusion detection and prevention system (IDPS) – although they are sometimes separately referred to as intrusion detection systems (IDS) and intrusion prevention systems (IPS) – is a core component to any cybersecurity strategy.

An Intrusion Detection and Prevention System (IDPS) monitors network traffic for indications of an attack, alerting administrators to possible attacks. IDPS solutions monitor traffic for patterns that match with known attacks.

IDPS solutions are usually deployed behind an organization’s firewall to identify threats that pass through the network’s first line of defense. Typically, an intrusion detection and prevention system accomplishes this by using a device or software to gather, log, detect, and prevent suspicious activity.

Change-detection mechanisms

Change management systems provide organizations with policies and procedures for making updates to their IT infrastructure, which in turn helps mitigate the potential for overlooking any new vulnerabilities or risks created while changes are taking place. If change-detection mechanisms are not implemented properly, a malicious individual could take advantage and could add, remove, or alter configuration file contents, operating system programs, or application executables.

Think of it this way: a firewall’s purpose is to act as a barrier to prevent malicious users from gaining unauthorized access to an organization’s network. If a developer makes and deploys a change to the firewall configurations without gaining approval, critical vulnerabilities could be missed or introduced into the system.

Be The Man and Make Your Org Untouchable

Long live all the data you’ve made.

Don’t wait until an attack makes you question what you would’ve, could’ve, should’ve done. Every program can have a glitch, but you can be the mastermind of your organization’s security defenses. By implementing a program that can help you identify your weaknesses, you’ll be able to shake it off and stay out of the woods.

If you need some help creating a vulnerability management program you’re confident in, please speak now. Working with you to implement or strengthen this type of program would make our wildest dreams come true.

Jump then fall into our arms by connecting with an expert today.

Threats are constantly evolving. We know you want to be ready to face them, but what happens when you’ve already experienced a breach? How do you restore not only your business operations, but your reputation?

According to Pew Research Center, half of Americans feel that their personal information is less secure than it was five years ago. Even more so, 64% of American adults have experienced data theft via credit card, account number, email account, social media accounts, Social Security number, loan, or tax return compromises.

Yahoo, eBay, Equifax, Target, Anthem, Home Depot – it has become habitual to worry about data breaches, identity theft, and other privacy concerns. Why am I being shown this ad? How much does Facebook know about me? Has my data been sold? Is Google tracking me?

At KirkpatrickPrice, we talk a lot about how to prevent a data breach and put a heavy focus on the “before,” rather than the “after.” But what happens after a data breach has occurred? Can your business recover?

In short, yes. But it’s going to take some work. In this blog we’ll discuss some tactics your organization can implement to rebuild any lost trust, as well as examine some companies who have successfully done it.

Tactics for Rebuilding Trust

Data breaches affect way more than just your data; they can also damage your reputation and break the trust you’ve established with your customers and stakeholders. While restoring the integrity of your data after a breach is critical, you also need to work to rebuild the trust that you lost. How do you do that? These five steps are a great place to start:

1. Notify the affected parties.

If personal data is stolen or compromised as a result of a data breach, private firms must notify affected parties as required by law. Even if your organization isn’t legally required, this is still a good idea. Honesty and transparency are vital to rebuilding or maintaining trust with your stakeholders. It allows stakeholders to take appropriate actions and shows your organization’s dedication to remedying the damage caused by the breach.

2. Investigate the root cause.

You have to identify the cause of the incident so that you can be sure you have adequately contained and fixed it. Without knowing what actually occurred, you won’t be able to fully remedy the incident or implement the correct controls to protect against it in the future. Additionally, you won’t be able to confidently tell stakeholders that the issue is (or will be) fully remedied.

3. Implement corrective measures.

Once you investigate and fully understand the incident, you can implement the corrective measures or controls that fix the issue.

4. Learn from the experience and demonstrate your commitment to cybersecurity.

It’s not enough to just fix the issues that led to your breach. You must evaluate and learn from the experience to demonstrate your commitment to cybersecurity. This is the best way to protect your organization from future breaches, but also to rebuild trust with your clients. By showing your security program improvements, and participating in industry events, you can prove to your stakeholders that you are serious about protecting their valuable data.

5. Improve your data security strategy.

The final step to responding to a data breach is to ensure that your data security strategy or procedures have been reviewed to reflect any lessons learned or new controls added as a response to your incident. This will allow your organization to formally prepare for any future incidents.

Companies That Rebuilt Trust After a Data Breach

While the five steps listed above provide a helpful roadmap to rebuilding trust after a data breach, we all know it’s much easier said than done. Let’s take a look at three advertising campaigns to examine how three well-known companies sought to rebuild trust after a breach.

Facebook Data Scandal

With GDPR enforcement on the rise and data privacy at the top of digital consumers’ minds, the Facebook-Cambridge Analytica data breach has become one of the largest of all time. Out of the 2.2 billion Facebook users, 78 million were impacted by this breach. The data was used to build a software program that predicts, profiles, and influences voter choices. Now that Facebook’s data privacy practices are in the spotlight, more and more questionable practices are rising up.

The scandal is still unfolding, as Mark Zuckerberg is questioned by Congress and the GDPR enforcement date has officially passed. In an effort to win back user trust, Facebook launched a major advertising campaign, “Here Together,” which promises to protect users from spam, click bait, fake news, and data misuse.

How has the Facebook scandal impacted your use of the platform?

Uber Cover-Up

When Uber announced its breach in 2017, it hit close to home for the millions of drivers and riders who use the app every day. Uber reported that not only did hackers steal 57 million credentials (phone numbers, email addresses, names, and driver’s license numbers) from a third-party cloud-based service, but Uber also kept the data breach secret for more than a year after paying a $100,000 ransom.

The New York Times points out, “The handling of the breach underscores the extent to which Uber executives were willing to go to protect the $70 billion ride-hailing giant’s reputation and business, even at the potential cost of breaking users’ trust and, perhaps more important, state and federal laws.” Uber recognizes that driver and rider trust is the core of their business, and when they announced this cover-up and breach, they knew they’d be facing major backlash.

In response to the breach, Uber began their “Moving Forward” campaign in an effort to rebuild trust. What do you think of this commercial – have they regained your trust? Would you still use the app?

Wells Fargo Incentives

The 2016 Wells Fargo breach was incredibly eye-opening to many consumers because it wasn’t a malicious hacker taking data; it was Wells Fargo. The bank was fined $185 million because of the 5,300 bank employees who created over 1.5 million unauthorized bank and credit card accounts on behalf of unsuspecting customers. Their reason for doing this was incentives; bank employees were rewarded for opening new bank and credit card accounts.

What is Wells Fargo doing now? In an effort to rebuild trust, Wells Fargo completely restructured its incentive plans by ending sales goals for branch bankers. Do you think that firing the 5,300 guilty bank employees and restructuring their incentive program is enough?

We believe that client trust is one of the most valuable benefits of compliance. Undergoing information security audits can help your organization maintain customers and attract new ones, distinguish your business from the rest, avoid fines for non-compliance, and answer to any sort of regulatory body.

How do you perceive this trend of public rebranding – is it convincing? Do you believe that companies like Facebook, Uber, and Wells Fargo have changed enough to rebuild trust?

Prepare to Face Today’s Confidently with KirkpatrickPrice

We know that when it comes to threats you want to make sure that you’re ready. In order to do that, you need quality cybersecurity and compliance audit reports with results you can trust. With quality testing of your unique environment, you can prepare to face threats before they become a data breach and gain a partner to help you if they do.

Partner with an expert today to make your organization unstoppable.

More Resources

Turning Audit Into Enablement

Incident Response Planning: 6 Steps to Prepare your Organization

What Is an Incident Response Plan? The Collection and Evaluation of Evidence

Regularly training your employees is a critical component of compliance and security in your organization. The risk of an employee not understanding the potential security threats facing them as a frontline target could be just the opening that an attacker needs to create a security breach. This is why many information security frameworks and regulations, like SOC 2, PCI DSS, and HIPAA, have security awareness training compliance requirements. What are those requirements? What does your organization need to do to ensure compliance? Let’s take a look.

The Importance of Security Awareness Training

The importance of continually educating your employees on the cybersecurity threats they’re up against can’t be stressed enough. Why? Employees are often the weakest link at an organization. Whether it’s because of the limited number of personnel, lack of funding, or misunderstanding of how to follow cybersecurity best practices, focusing on security awareness training can easily become an afterthought. But here’s what you need to know: every single person at your business needs to understand how they could unintentionally compromise your organization by falling for phishing attempts, using recycled passwords, neglecting to follow company-wide policies, or via the plethora of other ways malicious hackers can compromise the integrity of your security.

What Do Common Information Security Frameworks Require?

In order to demonstrate your compliance with many common information security frameworks, organizations must implement security awareness training programs. Take a look at what some of those common information security frameworks and laws require.

SOC 2: According to the AICPA, in order for entities to be compliant with the Common Criteria 2.2, entities must “communicate information to improve security knowledge and awareness and to model appropriate security behaviors to personnel through a security awareness training program.”
PCI DSS: According to Requirement 12.6 of the PCI DSS, entities must implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures.
HIPAA Security Rule: According to the administrative safeguard, 45 CFR § 164.308(a)(5), covered entities and business associates must “implement a security awareness and training program for all members of its workforce.”
HIPAA Privacy Rule: According to administrative requirements under the HIPAA Privacy Rule, 45 CFR § 164.530(b)(1) says, “A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information…as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.”
GDPR: According to Article 39(1)(b), Data Protection Officers are responsible for “monitoring compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits…”
FISMA: According to U.S.C. § 3544.(b).(4).(A),(B) under FISMA, entities are required to implement “security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of information security risks associated with their activities and their responsibilities in complying with agency policies and procedures designed to reduce these risks.”
ISO 27001/27002: According to Requirement 8.2.2 of ISO 27001, “All employees of the organization and, where relevant, contractors and third-party users should receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function.”

Whether your business has a team of two or five hundred, investing in security awareness training from the beginning reinforces a culture of compliance and helps mitigate the risk of human error causing a security incident.

Partner with KirkpatrickPrice to Create an Effective Security Awareness Training Program

If you’re looking for a cost-effective security awareness training solution for your company, KirkpatrickPrice offers several courses for various frameworks, industries, and experience levels. For more information about the courses we offer or to learn how KirkpatrickPrice can help you meet the security awareness training requirements of many of these common information security frameworks, contact us today!

Audits are hard, and automation doesn’t fix that. Automation can be a really helpful tool in making your audit more manageable, but it doesn’t mean an entire quality audit can be completed through automation. You still need an expert to review and test your controls to determine that they are designed and operating effectively.

Audit Director Kyle Pardue further explains these risks and benefits in the video below:

Choose the audit partner who will help you accomplish all of your security and compliance goals.

We know that audits are hard and overwhelming. That’s why we promise that when you work with KirkpatrickPrice, your audit will be worth it. We’ve issued over 20,000 reports to 1,200+ clients and have been able to give them the assurance they deserve. You deserve to be confident that your organization is ready to face today’s threats confidently.

Connect with one of our experts today to start your compliance journey with an experienced partner who will make sure you meet all of your security and compliance goals.

The Buyer’s Guide to Compliance Tools.

Looking for the right compliance tool is overwhelming. With so many options, it’s hard to know that you’re making the right choice for you. This guide will prepare you for the compliance journey ahead.