Protecting Vital Company Information - Security Audit

In today's world people want easy access to their business information. Some of this information will be considered sensitive therefore it is important to properly secure access to only those that should have access.

A security audit is really the final step in the implementation of your security defenses. Prior to this you undertake a risk analysis. Then you develop a security policy to define what you are going to defend and how you are going to defend it.

Various protective steps will be put into place to prevent unauthorized access. Perhaps access requires establishing a VPN connection beforehand. Almost certainly access will require a username & password and various policies will need to be in place as well. For instance, a requirement that passwords meet certain complexity rules or that all information on laptops be encrypted with password protection. A good security audit should find any gaps in your existing defenses.

Many people opt to have external security consultants perform the audit. If you are a small company you might not be able to afford security consultants and you also might not have the in-house expertise to do a sophisticated audit on your own. This however does not mean that you can or should do nothing. The exercise of understanding what you are securing and how you are trying to secure it is worthwhile on its own.

If in preparing for an audit you realize that vital company information is held on laptop computers then this will lead to questions like what happens if the laptop is lost or stolen? How easy can someone access the information on this laptop? We all know or should know that 100% security is impossible. There will always be risks. However often low cost simple security steps will significantly improve your security.

So how would you go about a simple security audit?

Security List

Begin by creating a list of items that potentially need securing. This list should include things like servers, desktop computers, laptops, routers, other networking equipment, printers, data (sales, customer & employee information), smart phones, PDAs, VoIP phones, VoIP or regular phone call recordings and records, email and so forth.

Threat List

Using your security list determine what is sensitive as well as how an unauthorized individual might access the sensitive data. This will constitute your threat list. Look at things like do all computers have passwords? Who knows the passwords? How strong are the passwords? Do passwords need to be changed periodically? Are laptops taken offsite? How easily could computers be removed from the physical premises? Do you have a list of the equipment? Are you creating backups of sensitive data? How are things being backed up, where are the backups kept, and who conducts the backups? How is access being controlled? Can information be accessed from outside the company premises?

Prioritize Threat List

After determining what threats exist you should prioritize the list. Look at the probability of unauthorized access coupled with the potential harm.

Security Threat Response Plan

Starting at the top of this list think about how you might reduce the risk of each item. This will become your security threat response plan. Remember lots of low cost simple steps exist that will improve your security. Stronger passwords, improved physical security (lock the server in a wiring closet), ensuring all computers are patched with security updates regularly, limiting web access, ensuring antivirus products are being used and are updated properly, implementing encryption of data with password protection, etc. If you do not have a backup of sensitive data you will need to devise a backup policy and plan as well. This should include some form of offsite storage for obvious reasons. Now that you have your security response plan you need to implement it.

Implement Security Threat Response Plan

After implementation you will periodically do a security audit, which essentially, is running through the whole process again. Each time you go through the process you will likely unearth new risks as well as cost effective ways of reducing risks.

Northern Computer - Your Trusted Partner
#1 - 495 Banks Road Kelowna, BC V1X 6A2
Phone: 250.762.7753 Fax: 250.861.1861 Toll-Free: 1.877.257.2896
Email: sales@northerncomputer.ca or service@northerncomputer.ca
Web: http://www.northerncomputer.ca