Conducting A Cyber Security Audit: Key Benefits and Steps

Cyber Security Audits can be a useful process to help identify poor internal practices, improve your company’s security controls, and protect against cyber attacks. Whether looking to arrange an external or internal audit, it can be useful to understand what a cyber audit can involve and try to incorporate some security best practices into your business, such as the NCSC guidance or CIS Benchmarks.

Rather than conducting a vulnerability scan or penetration test, aiming to find specific vulnerabilities in your devices or software, a security audit aims to review your business activities as a whole, to identify security weaknesses in key areas of your current operations and methods that can be implemented to improve your information security policies without significant disruption or cost to your existing processes.

What is a Cyber Security Audit

A cyber security audit is intended to provide a comprehensive review of how each aspect of your company’s cyber security is managed, including:

• How you identify security risks for your company and devise plans to protect against cyber attack.
• How you intend to manage your security controls through plans, policies, or procedures
• How these intended plans are applied to your information systems, services, and devices
• How effective this implementation is at securing your company
• How you monitor the security of your company and systems over time
• How you identify and respond to a data breach or cyber security incidents when they do occur
• How you review and report on the effectiveness of your organisation’s security controls
• How your organisation can work towards improved protection and increased security over time

Why Conduct a Cyber Security Audit

A security audit has multiple benefits for the security of your organisation.

• A security audit can help to identify risks, cyber threats, and security weaknesses that may not have been previously considered, and can therefore help to put security measures in place to mitigate or remove possible risks.
• Following through on any security weaknesses that are identified, cyber security audits can help recommend improvements to your organization’s security posture to protect your company’s sensitive information or client data. This can help to improve your overall information security and data protection standards.
• In addition to providing reassurance to your clients, regarding your standards, if there is a security incident that affects your company, setting up controls and access restrictions in advance can help to minimize any potential impacts the security incident may present.
• Conducting a security audit, particularly against a recognized information security standard such as ISO 27001 or IASME Cyber Assurance, can also help to meet regulatory requirements and provide assurance to your clients that you have taken a considered approach to secure your business and the client’s information.
• In some instances certain suppliers or contracts can have a requirement to conduct regular audits of your cyber security or adhere to compliance standards, allowing additional opportunities for work to become available.

Internal Audits and External Audits

External Security Audit

It can be beneficial to arrange an external audit of your systems through a third-party for several reasons:

• A third-party will have more specific experience with conducting a security audit.
• The third-party will be able to provide an unbiased opinion of the state of your security.
• A third-party can help you to achieve compliance certifications as part of the audit.

Internal Security Audit

However, managing an audit internally is possible, with some information about the methodology, time to dedicate to the process, and if you are not seeking an external certification standard.

An internal audit can also be a great initial step to help your company improve its security controls, before contacting an external auditing company and investing in cybersecurity certifications.

One of the primary reasons for conducting an internal audit is also cost. An external auditor can become expensive as the number of days required to understand and assess your company’s risks increases.

Conducting an internal audit, while sometimes difficult to completely avoid bias, can also be helpful when providing specific context to your business operations and how this may apply to your risk assessment, or risk treatment options.

Conducting A Cyber Security Audit

While there will inevitably be some specific considerations for your company that will either vary or not apply, there are a range of considerations that any company can consider when looking to improve their security.

Identify Your Company Assets

An initial task for any company is to:

• Identify and document what assets you currently have, which can include:
  • Your employees and their specific skills/roles/responsibilities
  • Your company files and information and where it is stored, who manages it, and who has access
  • Your company-issued user accounts, their permissions, and who has access to the accounts
  • Your equipment, such as laptops, phones, servers, firewalls, where they are located, who has access to them
  • Your Suppliers and third-party services, how they are used, who has access to them, what data the third-party stores or processes.

Identify Cyber Security Risks

Once you have identified each of your company assets, you can begin to identify each of the security threats which may impact your company and its assets through a risk assessment, while also taking into consideration the impact that each risk may have on your company.

Some of the risks that can impact every business include:

• Risk of loss, theft, or damage to your equipment and offices.
  • Depending on your current security controls, this could result in your company information or accounts becoming compromised.
  • Your ability to continue running your daily business operations may be severely impacted.
  • There could be a heavy financial impact to recover from such an issue.
• Risk of compromise to your devices and user accounts.
  • Where your accounts are compromised, this may have knock-on impacts on your company data and client data, which may also become compromised.
  • A compromise of accounts may result in access to your website, which could be altered, resulting in financial or reputational damage.
  • A compromise of the accounts that access your email systems could lead to Phishing attempts issued from your email address to each of your business and client contacts.
• Risk of services or suppliers becoming unavailable.
  • Where you make use of third party services or systems to run your business, a continual risk will be from the service becoming inaccessible. This may be due to the supplier going out of business, having internal issues preventing them from providing the service, or from their own internal compromise.
  • Where this issue occurs, a consideration for your business can be:
    • How important the service is for your day-to-day operations,
    • Does the service impact your confidential company data or client data.
    • Will your business be able to continue without the service
    • What would be the impact and cost of setting up a new similar service
• Risk of your key personnel and employees leaving the company, or suffering from an accident or illness.
  • For many companies, it can be a common occurrence that there will be individuals considered critical to the operation of the business. This can be due to their specific skills, or their individual roles and responsibilities within the company.
  • In an unfortunate situation where your company loses someone important, a consideration will become how your business can continue.
    • Do you have anyone else in your company with similar skills, training, or qualifications to try and fill the role.
    • How quickly can you recruit someone else with similar skills to fill the same role
    • How much impact will this loss have on your daily operations or ability to continue as a business
    • What would the financial impact of this loss have on the short-term and long-term operation of your business.
• Risk of your company or client information being disclosed accidentally or intentionally.
  • During the operation of any business, mistakes can happen and there can be risks which are introduced from your employees having access to information and either accidentally or intentionally leaking information.
  • In a scenario where your company information is accidentally sent outside of the company or intentionally leaked there can be a few considerations to account for:
    • How much access to confidential information, private company or client data do each of your employees have.
    • Will the disclosure of data result in potential reputational or financial impacts to the ongoing operation of your business.

Identify Your Current Cyber Security Controls

After you have identified the potential risks that can impact your business, a further consideration is to define any current security controls you have in place to manage or mitigate this risk, how effective this current solution is, and if can you implement any additional controls to improve your cybersecurity or to introduce new security measures.

When considering the above example for types of risks that could impact any business, a set of security controls can also be considered, however, when identifying methods to improve security, it is also necessary to take into account:

• How effective the new solution is expected to be,
• How much the solution will cost to setup,
• What the running costs will be,
• And importantly, how likely the risk is to occur, how likely the risk is expected to be after implementing the new security control, and whether the cost of the new security control is worth considering.

Identify Options To Improve Your Cyber Security

For the risk of loss, theft, or damage to your equipment and offices, multiple options can be considered to mitigate this type of risk which will vary in applicability between different companies and different budgets:

• For improved security within your offices, some improved security systems, such as cameras, alarms, and security doors could be considered. However, in the event of an incident where your offices become inaccessible, a power cut occurs, or you suffer from an internet outage, your ongoing business operations could still be impacted.
• An alternative approach could be to minimize the equipment kept within your premises. By issuing equipment such as laptops, which are designed to be mobile, and maintaining Cloud-based infrastructure, your company can minimize the dependency on a rigid workplace. However, the additional risks of this setup need to be accounted for, such as:
  • Compromise of cloud-based infrastructure
  • Loss of services from third-party providers
  • Increased risk of loss or damage to devices that are now more mobile.

For the risk of compromise to your devices and user accounts there are several security configuration options which could be enabled, in addition to user security training, to improve your companies security and minimise the risk of compromise.

• Password configuration settings can be applied to your devices to increase account security and users can receive training on selecting secure passwords for use with company-issued accounts.
• Multi-factor authentication measures can be applied to your accounts to further increase user verification measures and decrease the likelihood of account compromise.
• Account login restrictions and lockout options can be enabled to avoid the potential for a large number of login attempts issued against your online accounts.
• Your devices can be setup to automatically lock after a short period of inactivity, which can help to avoid device compromise in the event of theft.
• Several platforms support monitoring and alerts, which can be configured to provide warnings of suspicious activity, signs of compromise, new device logins, or logins from unusual locations.
• Vulnerability scanning solutions and vulnerability tests can be regularly conducted against your devices and systems, to identify and address vulnerabilities, helping to avoid compromise and unauthorized access to your organisation.

For the risk of services or suppliers becoming unavailable, there are several approaches that can be considered to minimize the likelihood of issues that may arise through third-parties.

• When considering a service to be provided by a supplier, you can develop a list of requirements for that supplier to meet. This set of requirements can be developed to minimize the risk that the supplier could pose to your business, including such options as:
  • Whether they conduct their own cybersecurity audits or compliance standards,
  • A track record of service,
  • Whether they have considered redundancy or backups as part of their service.
• Maintain a list of secondary suppliers which have been preapproved to provide a similar service. This can help to minimize the time between changing providers in a scenario where this becomes necessary.
• Limit the access to devices and information that each supplier maintains to ensure minimal impact in the event a supplier suffers from data breaches.

For the risk of your key personnel and employees leaving the company, or suffering from an accident or illness there are also options available to minimize your risk and ensure your business operations can continue.

• Where your budget may allow for several members of staff to be employed, ensuring there is an overlap of skills, knowledge, and responsibilities can help to ensure that if any one individual suddenly leaves the business, your ability to continue operating remains.
• However, many organisations are considered as small businesses, in which case there may only be a limited number of employees and no options available for overlapping roles and responsibilities. In situations such as this, it can be useful to maintain relationships with preapproved third parties, contractors, and business partners who meet your supplier requirements and can fill the gap in knowledge, skills, or tasks that need to be completed. Although there can be a short-term increase in cost to utilize third parties, it can allow for the sudden staff and skills shortage to be filled and daily business operations to continue.

For the risk of your company or client information being disclosed accidentally or intentionally, there are several technical solutions available which can be implemented to minimize such risks, in addition to staff security training, which can help to avoid instances of accidental disclosure.

• To protect your information, it can be useful to first organize your data into separate categories, such as:
  • Restricted, for information only intended for specific individuals.
  • Private, for information made available to all your staff members
  • Public, for information made available to anyone.
• With data categories in place, and documents clearly marked and labelled, in addition with staff education and training, it can help to avoid documents intended to be restricted from being shared outside of the business.
• For several platforms such as Google Workspace and 365, there are options available to restrict or provide warnings for the type of files and data that can be sent to anyone outside of the organization.
• Email attachments can also be setup with links to files, rather than a direct attachment. In this scenario, access to the link and associated file can be removed after the email has been sent or setup to expire after a set period of time. This allows file access to be removed if considered necessary to limit accidental information disclosure.

Identify The Effectiveness Of Your Implementation

With any current security controls or new security controls that have been implemented, it is important to understand how effective the setup is for its intended purpose and for securing your business.

To ensure the effectiveness of your setup, devising a method of testing your security solution is vital. The specific test can vary depending upon the security solutions that have been implemented, for example:

• To verify any email restrictions are working as intended, an attempt could be made to send files labeled as Restricted outside of the organization.
• For password and account restrictions, tests could be made to create weak passwords or enter several incorrect passwords to verify lockout measures are working as intended.

The tests you conduct can also form part of a periodic review of your security implementation, to ensure that continued monitoring of your system is in place.

Identify Security Reporting And Response Solutions

While it is possible to implement security controls for your systems and cyber security training for your employees, there may inevitably be a security incident that needs to be addressed.

When this happens it is important to have a plan in place to identify, respond to, and resolve different types of security issues.

This ensures your company can react quickly and minimize any impact or disruption to your typical business operations.

As part of your employee training on cyber security, it is helpful to include specific information that can help your staff report any suspected security incident such as:

• What type of issues or incidents to be aware of
• What type of information to detail when reporting
• How quickly to respond and report on a potential issue.
• Who to report the information to within your management team
• How to report the information, such as via phone, email, messenger apps

Identify Opportunities To Continually Improve Your Security

For any company, there will likely be opportunities to improve. This could be as current processes and procedures are refined, a larger budget becomes available for more advanced automated software solutions, or more employees join the company allowing for roles and responsibilities to be shared and divided more evenly.

As part of the efforts to continually monitor and review the performance of your current cyber security procedures, it is also important to identify weaknesses, potential areas for improvement, and how your systems can be refined over time.

As part of the efforts to work towards continual improvement, employees should also be trained and encouraged to offer solutions to improve current processes. This can help to improve collaboration, and engagement with company security standards, and ensure that security policies are adhered to by those involved in their day-to-day operation.

Conclusion

While an external cybersecurity audit can be useful for reviewing your cybersecurity controls and protecting your business, particularly if you are unfamiliar with the process and procedures, it can also be an expensive proposition, especially for small businesses that are operating on a limited budget.

An internal audit can help to improve your security controls where there may currently be some weaknesses or opportunities to improve and further strengthen your security.

This can be a cost effective approach, however, this can also be a time-consuming process which requires an objective review of your current assets and controls to implement improvements to your security.

As an alternative to an expensive cyber security audit or an internal review, a compliance standard such as Cyber Essentials could also be followed.

Although not as detailed as other more complete cyber security audits, Cyber Essentials can provide a security review of your processes and devices, and ensure your business adheres to a known and recognized information security standard.

Where you have any further questions regarding different cybersecurity solutions, our consultants are available to address any concerns you may have.