Most companies believe that their computer systems are secure because they trust their in house IT department or IT provider.While you need to have fate in your IT dept, you also have to be realistic.
Let’s start with some examples.
Say you need to write an important email concerning a job application. Do you just write it and mail it straight away?
No, we all know a mistake is easily made and because of the importance we usually do the following:First, you write the email, check it for spelling mistakes. Second, you let the spelling checker run.And third, you ask another person to check it. Sounds familiar right?
Now let’s look at a recent IT incident I’ve come across.
A fairly big company called us to do an Incident Response because their mail server was hacked.
We knew this company has a well known security provider that installed their firewall, did 27/7 monitoring etc. Still, they called us to have a look and help them out because of other successful projects.When we arrived, they updated us on the current status and we started looking.
Now, the other Security provider already checked some firewall logs but gave little feedback and said they couldn’t find anything.We also started with the low hanging fruit, in this case the point of entry: their firewall.Within 5 minutes we found the issue with a firewall rule pointing to the mail server. Apparently, this faulty rule has been there sitting there for over a year and nobody saw it!While there were other security issues that lead to the hack, this the was main cause.This example clearly shows why a biannual security audit should be done by a third party provider. As stated before, it’s easy to look over your own mistakes.
$21,155 is the average cost of a data breach, per day and it takes an average of 46 days to resolve the cyberattack!
IT security has become huge with a lot of niches, so rely on the people who work 24/7 in IT security. We know it’s hard to convince upper management for security audits, because in the end: they are paying 3 different IT engineers for the ‘same’ job in their eyes.
But we all know it’s not. Even having a small breach will do a lot of damage to a company’s reputation and funds. Bare in mind, that with the upcoming GDPR law; you’ll even be penalized if you can’t provide a decent security policy!
Not investing in security because there’s no ROI is a thing of the past. A security audit is a 100% guaranteed return on your investment.
About the Author
Pieter Rubensis a vendor-neutral IT Security Professional. He performs professional security audits, security training, phishing campaigns. He designs secure networks and engineers high-assurance systems in the Cloud.
You can connect with him via www.netfend.be