In October, I had the opportunity to attend the Information Systems Audit and Control Association (ISACA) conference in Chicago. My team and I were surrounded by security professionals from other organizations to learn about the latest research and developments when it comes to keeping our clients secure and prepared to face today’s greatest threats.  

One of the topics of the conference was Artificial Intelligence (AI) Security. Incorporating AI technology into your organization can be intimidating, especially with how quickly it’s evolving. At times, it may seem like the easiest option to avoid adopting new technology, but, when used correctly, AI technology can be an asset to your organization, improving security and, at times, efficiency.  

Facing Reality: We Need AI 

Cybersecurity threats are constantly evolving and becoming more common. They are becoming overwhelming and nearly impossible for security teams to manage on their own.  

AI can be one solution to this onslaught of threats organizations are facing. New AI technology can help identify suspicious login attempts, mitigate phishing attacks, and help prevent fraud. By implementing AI technology, some of the pressure security teams are experiencing may be alleviated.  

Not only are security threats becoming more common but they are also growing in expense. According to IBM’s Cost of a Data Breach Report, the average cost of a data breach is over $4.35M globally, and $9.44M nationally. However, the biggest cost savings were due to deploying incident response, XDR, and AI/automation.  

Breach costs at organizations with fully developed security AI/automation had an average $3.05M less than organizations with no security AI/automation deployed.  

Three cost amplifying factors for data breaches today include: 

  1. Compliance Failures—Compliance enhances and confirms security. Without it, your organization is left at risk. 
  1. System Complexity—The more complex your system is, the more likely a breach will occur without the proper encryption.   
  1. Cloud Migration—Cloud migration allows for vulnerabilities within your environment, making a data breach more likely to occur.  

IBM reports that the number one way to help mitigate the above vulnerabilities is through the implementation of AI platforms. Although AI may not solve all your organization’s problems and vulnerabilities, it can certainly strengthen your defenses and help mitigate risk.  

Trustworthy Technology 

Practical uses for AI technology can be challenging to identify, especially with the differing opinions and research surrounding the topic. However, in his presentation, “The Evolution of AI Security,” Michael Melore from IBM believes organizations have a great opportunity for growth when adopting AI technology. He highlighted five things to look for when identifying and developing trustworthy AI. 

  1. The technology should be transparent and open to inspection. 
  1. The technology should be explainable and easy to understand outcomes and decisions. 
  1. The technology should be fair and impartial, having mitigated any bias. 
  1. The technology needs to be robust and able to handle exceptional conditions effectively and minimize security risk. 
  1. The technology should be private and fueled by high integrity data that is business compliant. 

By keeping these factors in mind, we can start to identify trustworthy AI and leverage it to benefit our organizations. So, what are some tangible ways AI can help make your job easier?  

There are a plethora of ways you can leverage AI when working to secure your organization. Here are a few examples: 

  • Use AI to automate invoices and follow-ups. 
  • Use AI for threat hunting, analysis, and insights, analysis, and insights.   
  • Use AI to gather compliance evidence to assist in your upcoming SOC 2 audit. 
  • Use AI to help compile the latest versions of your organization’s policies or logs.   

Just as Melore mentioned, there are ways to create and leverage trustworthy AI technology that will become invaluable to your organization. Remember, automation should assist your compliance efforts, not replace your manual efforts. 

At KirkpatrickPrice, we are working to incorporate trustworthy AI technology into our OAM (Online Audit Manager). We envision a day when our integrations and automations will assist our clients with organizing their evidence as they prepare for their next compliance audit. 

Still wondering if implementing more AI technology will benefit your organization?  

I mentioned earlier that AI is somewhat of a controversial topic. Although AI may not be right for every security function within your organization, when built correctly and used hand-in-hand with human intuition, it can be an asset to your organization’s security.  

At KirkpatrickPrice, we care about helping you become unstoppable in your compliance journey. Connect with a KirkpatrickPrice security expert today to talk more about how we can help your organization meet its security and compliance goals.  

Last year, tens of billions of records were breached and tens of thousands of businesses suffered ransomware attacks. Every company operating in this dangerous environment should have a cybersecurity plan for keeping company and customer data safe—especially data within the scope of information security regulations and standards.  

A cybersecurity plan outlines the policies and procedures a business considers essential to maintaining security and regulatory compliance. It is a written document that results from a comprehensive survey of the company’s risks and the actions it intends to take to mitigate them. 

For example, a business that relies on third-party software tools and libraries may be at risk from code vulnerabilities if they allow software to become outdated. One component of a cybersecurity and security compliance plan would outline how the business intends to mitigate that risk with patch management or update procedures. 

 In this article, we’ll detail the 5 most important questions you should ask when developing a cybersecurity and compliance plan so you can make sure your business is prepared to face today’s threats confidently.  

1. Which Data and Infrastructure Assets Does the Plan Cover?

A cybersecurity plan can only be effective if it accounts for all the business’s security risks. But a business can’t understand those risks unless it knows which data it stores, how sensitive it is, how it is stored and processed, and potential breach scenarios. 

Information gathering is often one of the most challenging steps of preparing for a cybersecurity plan. Many businesses do not have complete insight into data storage and processing, especially if it has previously been managed on an unplanned ad-hoc basis. IT professionals often find it helpful to follow a templated discovery procedure like the Data Protection Impact Assessment created by GDPR.

2. Do We Need a Professional Security Risk Assessment?

One of the first questions you should ask before creating a cybersecurity plan is: Do we have adequate internal security and compliance expertise? If the answer is no, you may want to consider hiring an expert third party to carry out a comprehensive information security  risk assessment. 

A professional risk assessor examines your IT environment and practices to identify potential risks. A risk assessment is typically conducted under the guidance of a recognized framework like the NIST Special Publication 800-30. It results in a report with the information you need to create an effective cybersecurity plan.  To receive guidance on the effectiveness of your business’ risk assessment, upload your risk assessment here  to receive a free analysis of your risk assessment by a KirkpatrickPrice risk expert. 

3. What Are the Relevant Information Security Laws, Regulations, and Standards?

Many businesses that handle sensitive data are required to comply with regulatory frameworks and may choose to comply with information security standards. These regulations and standards should shape their cybersecurity plans. 

Regulatory frameworks may include:

  • PCI DSS for businesses handling credit card data
  • HIPAA for businesses handling sensitive healthcare data
  • GDPR for businesses that operate in the EU
  • FERPA for educational information and records
  • FISMA for businesses interacting with government information and assets

Information security  standards may include:

  • SOC 1 and SOC 2
  • ISO 27001
  • Cloud security standards

Businesses should also consider a compliance audit to ensure they comply with relevant frameworks and standards. 

4. Who Is Responsible for Implementation, Monitoring and Incident Response?

Assigning security responsibilities is a crucial aspect of developing a cybersecurity plan. Security policies must be implemented as procedures and processes that are the responsibility of managers and employees. If no one is responsible, then a cybersecurity plan is a worthless piece of paper. 

For a plan to be implemented, it must have executive support from the company’s leadership. In larger companies, that often takes the form of a Chief Security Officer (CSO) or Chief Information Security Officer (CISO). They ensure that plans and policies are turned into procedures and controls overseen by competent managers and employees throughout the business. 

5. Do Employees Have the Knowledge They Need to Comply?

A cybersecurity plan is a great starting point, but information security is more than policies and procedures. People play a critical role—over 85% of security incidents involve a human element. To successfully implement a security plan, you must ensure employees have the information and the security awareness training they need to do the right thing. 

Check out our recent article on building a positive security culture for your business to learn more about how you can set your employees up for cybersecurity success. 

KirkpatrickPrice Helps Businesses to Create and Audit Their Cybersecurity Plan

KirkpatrickPrice’s team of cybersecurity and risk experts can help your business to achieve its security and compliance goals. We offer a comprehensive range of security services that include:

Contact an information security specialist today to learn more about how we can help you. 

Amazon Web Services (AWS)  and its peers in the cloud market have transformed infrastructure hosting for companies of all sizes.  However, making the move to the cloud can be intimidating and overwhelming, and it may seem more work than it’s worth.  So why has AWS cloud hosting proven to be so successful?  

Having the first-mover advantage played a substantial role: Amazon entered the cloud infrastructure market before its competitors. AWS kicked off the cloud revolution two decades ago.  But being first wasn’t enough—the platform’s success stems from real-world AWS benefits that help businesses to build profitable products and services. 

The following years saw the introduction of EC2, S3, RDS, and a host of other storage and compute services. Today, AWS offers over 100 services in domains as diverse as database hosting, virtual networking, cloud security, and machine learning. AWS is by far the biggest cloud platform globally, with a 33% market share, compared to Microsoft Azure’s 21% and Google Cloud’s 10%. 

 We believe AWS cloud hosting could benefit your business in 5 distinct ways.   Let’s take a look at these beneficial reasons below: 

1. Reduced Infrastructure Cost with On-Demand Pricing

On-demand pricing is a significant benefit of AWS and other cloud services—you pay only for the resources you use. If you need a server, you can deploy one in minutes and only pay for the compute, storage, and network resources it consumes. AWS allows users to share the underlying hardware, reducing lead times and costs compared to bought or leased IT infrastructure.

2. Scalable Compute and Storage

In the pre-cloud era, businesses bought infrastructure to accommodate peak loads, which meant they paid for resources that were idle most of the time. In contrast, the cloud’s scalability allows businesses to scale up and down as demand changes. In a well-managed cloud environment, businesses make significant savings by not paying for idle infrastructure. 

3. Outsourced Infrastructure Management

Cloud platforms like AWS take care of the physical infrastructure and much of the virtual infrastructure. Cloud users are free to focus their IT resources where they generate the most value. Instead of monitoring and managing physical servers and their components, they can spin up virtual machines or take advantage of higher-level Platform-as-a-Service and Software-as-a-Service tools. Users don’t have to worry about the implementation details because they are outsourced to the cloud provider. 

4. A Diverse Array of Enterprise-Grade Services

The variety of enterprise-grade services AWS provides would be extremely costly for a business to build independently. For example, AWS makes it straightforward to build highly available cloud environments with redundant infrastructure distributed across availability zones, data centers, and even continents. These redundancy and availability features are baked into the platform, and they are available to all businesses, from sole traders to giant corporations. 

5. Best-in-Class AWS Security

AWS offers many services and tools to help businesses improve security and compliance. We’ve written extensively about AWS security services and best practices in previous articles, including:

In the early days of cloud computing, businesses worried moving to the cloud would increase security risks.  They thought giving up infrastructure and software control would lead to more security vulnerabilities. In fact, the opposite is the case. Most cloud security and compliance issues are the results of cloud user error and misconfiguration. 

AWS provides tools and services to help improve security, but it’s up to businesses to use them correctly. Another way of putting it is that businesses and AWS share responsibility for cloud security. The dividing line between the user’s responsibility and the platform’s responsibility is not always clear, and it can be challenging for businesses without cloud expertise to make the right decisions. 

KirkpatrickPrice is here to help make sure your transition to the cloud is smooth and secure. We provide a comprehensive array of cloud security services to empower businesses to make the most of AWS while maintaining excellent security and compliance, including:

To learn more about cloud security and compliance, check out our cloud security resources or contact a KirkpatrickPrice information security specialist.

Ransomware is perhaps the most disruptive and infuriating security threat facing businesses in 2022. A ransomware infection is a symptom of an information and infrastructure security failure that may hurt a business’s reputation and pose a compliance risk. Ransomware not only deprives a business of data essential to its operations; it also forces business leaders to decide whether to pay off criminals—an action that has ethical, financial, and legal implications.

Over the last few years, ransomware has become a persistent threat to businesses of all sizes. According to Sophos’s The State of Ransomware 2021, 37% of businesses were hit by ransomware over the last year. The average ransom paid was $170,000, but the total cost of ransomware attacks—taking into account the ransom, downtime, mitigation costs, and staff time—averaged $1.8 million. Most chillingly, the average victim who pays retrieves only 65% of encrypted data—most ransomware victims suffer permanent data loss even when they pay.

Ransomware is likely to become more prevalent in 2022. It remains a high-value revenue generator for cybercriminals. The Treasury Department estimates that criminals made $600 million from ransomware in the first six months of 2021 and expects the year’s total to exceed the combined ransom payments of the previous ten years. The true cost is likely much higher because businesses are motivated to hide successful attacks once they pay a ransom.

What is Ransomware?

Ransomware is malicious software that encrypts files using a key known only to the ransomware operator, who then demands a ransom in exchange for providing the key to decrypt the data. The ransom demand typically asks for payment in an untraceable cryptocurrency. If the victim pays, they usually—although not always— receive the key and can therefore retrieve the lost data.

The most commonly encountered variants in 2021 included REvil/Sodinokibi, Hades, and DoppelPaymer, although one of the most impactful attacks of the year was carried out by the Darkside cybercriminal group, whose attack against Colonial Pipeline disrupted the supply of fuel to the East Coast for a week in May and resulted in a ransom payment of 75 bitcoins, equivalent to $4.4 million at the time the ransom was paid.

What Causes Ransomware?

Ransomware depends on an existing vulnerability to infiltrate a target system. The most common methods of infiltration are phishing attacks, brute force attacks, attacks against insecure RDP services, and the exploitation of software vulnerabilities. For example, the REvil/Sodinokibi ransomware spread through brute force attacks and server exploits, among other vectors. It initially used a vulnerability in Oracle WebLogic to download the code which encrypts the victim’s files, but the method used changes over time because ransomware is constantly evolving as criminals seek to exploit new vulnerabilities.

Can Data Encrypted By Ransomware Be Recovered?

Businesses should assume that once their data is encrypted by ransomware, it cannot be retrieved. Ransomware uses sophisticated cryptographic technology that cannot be reversed without the key. In the past, security experts have managed to reverse the encryption of poorly coded ransomware, but that is unlikely to happen for modern ransomware.

In some cases, including REvil/Sodinokibi, law enforcement agencies were able to identify and infiltrate the ransomware operator’s infrastructure, allowing them to extract the master key and build decryption software. However, it’s rare that this happens on a time-frame acceptable to businesses, and the most likely outcome of a successful ransomware attack is that data is irretrievably lost until the victim pays a ransom and the attacker provides a decryption key—although there is no guarantee the data will be retrieved even if the ransom is paid.

Should Businesses Pay the Ransomware Ransom?

The temptation to pay a ransom is understandable, especially if your business is facing severe disruption because critical data is no longer available to employees or customers. Many businesses choose to pay. But, as we mentioned earlier, businesses that pay get an average of 65% of their data back. Only 8% get all of it back. Even if you do pay, it’s unlikely your business will be made whole.

Furthermore, the attackers may not delete their copy of the data. It is increasingly common for ransomware attackers to sell or otherwise disclose stolen data. In fact, some ransomware attackers don’t encrypt the data at all. They steal it and promise to delete what they stole if paid a ransom. Needless to say, criminals are not always honest.

It is not usually illegal for U.S. businesses to make ransomware payments. However, the U.S. Department of the Treasury’s Office of Foreign Assets Control issued an advisory in 2020 declaring that it is unlawful to facilitate ransom payments to attackers on the Department of Treasury sanctions list. The FBI advises businesses not to pay ransoms for the reasons we’ve discussed. It also encourages businesses to report ransomware attacks to the Internet Crime Complaints Center.

How to Prevent Ransomware: 6 Ransomware Protection Best Practices

Once the sole copy of a business’s data is encrypted by ransomware, its options are limited. Therefore, it is preferable to prevent ransomware infection in the first place and to ensure that important data is copied to a location ransomware cannot reach.

Regularly Update Software to Apply Security Patches

Many ransomware infections start with software vulnerabilities. The attacker exploits the vulnerability to gain access to a network and then uses that access to infiltrate their malware. It is not possible to guarantee a system is free from exploitable vulnerabilities, but updating software regularly ensures that known vulnerabilities are repaired.

To underline the importance of regular software patching: the EternalBlue vulnerability, which was widely exploited by the catastrophic WannaCry ransomware campaign, was fixed by a software patch months before attacks began. Victims were vulnerable because they had not updated the relevant software.

Back-Up Data to a Secure Remote Location

Ransomware is effective because it deprives businesses of the data assets they need. But that can’t happen if the data also exists in a secure offsite location the malware cannot access. Sophisticated ransomware is capable of finding and encrypting local backups on connected systems, so an effective backup must copy data to a system that is not easily reachable over the local network.

If the business has an up-to-date backup, they can simply delete the infected systems and restore or deploy cloud disaster recovery infrastructure with their apps and the backup data.

Implement Least-Privilege Access Policies

Data should be accessible only to users and services who need it. The more people who have access, the greater the likelihood credentials will be leaked or stolen. If an individual no longer needs access, revoke their permissions.

Limit permissions to those that are required. For example, if a user needs to see information but not to change it, ensure they only have read permissions and not write permissions on the database, disk, or cloud storage service that stores the data.

Follow Cloud and Physical Infrastructure Configuration Best Practices

Cloud configuration errors often lead to vulnerabilities a ransomware attacker can exploit. For example, incorrectly configured access permission on AWS S3 buckets may allow ransomware attackers to download, edit, and delete data. Ensure your business follows industry best practices for data security. If your business lacks the expertise to secure its data, hire a professional who can assess your security implementation and provide guidance.

We wrote more about cloud security best practices in 10 Top Tips For Better AWS Security Today

Carry Out Regular Security Risk Assessments

Ransomware attacks often occur because a business misunderstands risks associated with their behavior or their system’s implementation. The BlueEternal example discussed above is a useful illustration; most businesses know that updating software is a good idea, but they choose not to because they don’t apprehend the seriousness and potential cost of living with that risk.

Risk assessments help businesses to understand potential security threats, including threats that may lead to a successful ransomware attack.

Implement Security Awareness Training

Phishing attacks are one of the most widely exploited ransomware vectors. Attackers send an email to employees or managers containing a link. The link takes the target to a site that infects their system with malware or that dupes them into entering authentication credentials.

One way to combat phishing is to ensure that employees recognize the signs. To achieve that you’ll need to train every employee who might pose a risk. Security awareness training is required by several regulatory frameworks and organizations, including FINRA, HIPAA, and AICPA.

Prevent Ransomware with KirkpatrickPrice

Ransomware is a pressing security threat facing businesses in 2022. If you’d like help to identify and mitigate ransomware risks with remote security services, security awareness training, or a compliance audit, contact a KirkpatrickPrice information security specialist today.

As we enter a new year, it’s traditional to look back at the successes and failures of the last twelve months. The information security world is no different, and as the year draws to a close, information security writers publish a flurry of articles with titles like The Top Data Breaches of 2021 and The Top 5 Scariest Data Breaches in 2021. They are sobering reading: each listicle entry represents hundreds of millions of people hurt by data breaches that expose their private details to criminals and the wider world.

However, these articles don’t mention the thousands of smaller businesses targeted by cyber-criminals. The headline-grabbing data breaches are the tip of the iceberg. While most of the corporations featured will weather the storm, smaller businesses are less able to bounce back from a catastrophic exposure of sensitive data. Over half of small companies go out of business within six months of a data breach or cyber attack.

Data breaches are avoidable, but any business can significantly reduce the risk that a data breach will hurt its employees and customers, not to mention its reputation, bank balance, and regulatory compliance.

What Causes Data Breaches?

Data breaches occur when bad actors exploit weak security and privacy controls. In a secure system, sensitive data is only accessible to authorized and authenticated users. To build a secure system, businesses should implement controls that allow access to authorized users and deny it to everyone else.

Data breaches are more likely when essential controls are missing or improperly implemented. A weak password is an example of a poorly implemented access control. If a user with administrative privileges on a sensitive system chooses a password such as “123456,” an attacker can easily guess it and gain access.

Weak credentials are among the most common causes of data leaks, but there are many more, including:

  • Stolen credentials: shared or stolen passwords and authentication keys are a leading cause of data breaches.
  • Phishing attacks: attackers use email to trick employees into disclosing credentials or installing malware.
  • Software vulnerabilities: vulnerabilities in network-connected software allow attackers to access sensitive systems.
  • Insider threats: employees or ex-employees work with criminals or steal data for their own purposes.
  • Physical attacks: people who have direct physical access to servers and networks can bypass security controls.
  • Configuration mistakes: incorrectly configuring software or hardware may give an attacker access to sensitive data. This is a common cause of data breaches from cloud platforms, as we discussed in 10 Top Tips For Better AWS Security Today.

What Happens During a Data Breach?

There are many potential techniques an attacker might use to compromise a business’s network and exfiltrate sensitive data. But, at a high level, most data breaches follow a predictable course.

  • Target identification and surveillance: The attacker probes your network and organization for weaknesses. This stage may be automated: many attackers use bots to probe thousands of networks for specific security weaknesses. However, an attacker may manually probe and investigate a high-value target.
  • Social engineering: In addition to probing networks and software, the attacker may contact employees and managers, usually misrepresenting their purpose with a spurious pretext. Their aim may be to learn more about the organization and its systems, steal authentication credentials, or influence an insider to install malware.
  • Compromise: The attacker uses the information they have gathered to gain entry to the network. For example, they may have discovered a misconfigured database, which they now access over the internet. Once the attacker has compromised one network component, they may use that access to “island hop” to more sensitive systems.
  • Exfiltration: The data is copied from the business’s network to servers under the attacker’s control.

Once the attacker has the data, they can release it to the public, sell it to third-party data brokers, use it for identity theft, or extort the businesses.

How to Prevent Data Breaches

We’ve looked at some of the most widely used techniques to compromise business networks and steal data. To prevent data breaches, businesses should focus on implementing processes and controls that render those techniques ineffective.

Regularly Update Software to Apply Security Patches

Older software often contains bugs that create security vulnerabilities. The recent Apache log4J vulnerability is a perfect example. Log4j is a logging tool for the Java programming language ecosystem. It is included in over 35,000 Java packages used by thousands of businesses.

Log4J contained a security vulnerability an attacker could exploit to execute code remotely. Remote code execution vulnerabilities are severe, and the log4J vulnerability could allow an attacker to break into systems, steal data, and upload malware.

Once the vulnerability was discovered, developers quickly fixed it. But, to get the non-vulnerable version, users have to update any software that uses log4J. Although the log4J vulnerability is particularly serious, software vulnerabilities are common, and the best way to fix them is to update all business software regularly.

Encrypt Data and Store Encryption Keys Securely

Businesses should not entirely rely on their ability to keep bad actors out of their networks. It’s always possible that an attacker will find a vulnerability or an employee will make a configuration mistake. It’s best to assume that an attacker will find their way in and implement additional layers of security to deal with that contingency.

If a business ensures that all data is encrypted, an attacker who penetrates network security cannot access the original data. However, a sophisticated attacker may discover encryption keys if they are not also stored securely. The details of secure key storage differ depending on the business’s platforms, but we discussed how to store access securely and encryption keys on Amazon Web Service in How to Keep AWS Access Keys and Other Secrets Safe.

Implement Least-Privilege Access Policies

Employees, contractors, and service providers should have the least access consistent with their role within an organization. They should be able to access only the data they need and have only essential privileges. For example, an employee who needs to download data to generate a report does not need write permissions to edit that data.

Implementing least-privilege access policies limits the risk of leaked or stolen access credentials. It also helps to reduce insider threats by limiting the data assets a malicious insider can access.

Follow Cloud and Physical Infrastructure Configuration Best Practices

Many data breaches are the result of improperly configured software and hardware. To mention just four examples:

  • AWS S3 buckets that are accidentally configured to be publicly accessible.
  • MySQL databases deployed without password authentication.
  • Improperly assigned access permissions that allow users to access information they should not be authorized to see.
  • Inadequate firewall rules or a failure to use a firewall.

Configuration errors have two leading causes. First, the business doesn’t invest the time and resources necessary to secure its infrastructure adequately. Second, the business lacks the knowledge and expertise to configure its infrastructure securely. Both scenarios introduce significant compliance and financial risks.

If a business does not have the knowledge or resources to secure its infrastructure or understand the risks, it should consider employing a third-party information security specialist to assess its security and suggest opportunities for improvement.

Carry Out Regular Security Risk Assessments

A security risk assessment can help your business identify and remediate potential vulnerabilities. A comprehensive risk assessment begins with a survey of your infrastructure before identifying risks, assessing their importance, and creating a risk management plan, which can be implemented to remove identified risks.

A third-party risk assessment by qualified information security auditors may help businesses significantly reduce the risk of a damaging data breach.

Conduct Security Awareness Training

Employees have privileged access to sensitive data, but they may not understand their part in keeping that data safe. Phishing attacks and other forms of social engineering deliberately target non-technical employees who may not understand the security implications of clicking a link in an email or sharing their password with someone who claims to be a manager or executive.

Security awareness training helps employees understand the threats their business faces and what they can do to limit exposure. It can be tailored to the company’s specific needs and relevant security frameworks, including HIPAA and PCI.

Prevent Data Breaches with KirkpatrickPrice

As a licensed CPA firm, KirkpatrickPrice specializes in information security audits and security assessments that can help protect your organization from being vulnerable to data breaches. Contact an information security specialist to learn more about our risk assessment services, security awareness training, and compliance audit services.