About Us | Contact Us
View Cart

Where to Begin

By Sara Fultz | Monday, May 3, 2021 - Leave a Comment

…a Crash Course of Security Measures


The first article by Sara Fultz, Creative Assistant of infotex!


Introduction:

As the managing partner of infotex, I am proud to introduce the “debut article” for Sara Fultz.  I told Sara “write an article showing us what you’ve learned that the technical staff will appreciate.” As I read her first iteration, I found it to be very serendipitous that Sara would title her article, “Where to Begin,” as we are very proud she chose to begin her career with us.

– Dan Hadaway, CRISC CISA CISM

As the rest of the world begins to “wake up” to the need for information security, we’re often asked, “where should a company like ours start?”  The answer to this question can be very nuanced and can depend upon many factors, but the most common answer is that you almost always start with risk measurement.

Security is about risk management, and risk management is a never ending, cyclical process.  At a high level, we provide a variety of services to help with this never ending mission of technology risk management, including services to help with risk measurement, risk response, and risk monitoring.

This article is meant to introduce you to several “risk measurement” tools you can use to determine where you should start.  It can help you to decide what tools would be best for your company.

Risk Assessment

Like managing anything, the best way to start is to determine where you are.  We measure risk with risk assessments.

Risk assessment is where everything begins.  And if you’re going to do a risk assessment, you might as well focus on the “treasure” that you are needing to protect.  We call this “treasure” information assets, and a good risk assessment will start by brainstorming all assets at risk.  Obviously if you are collecting information protected by regulation or law, any device, person, or storage containing this information would be treasure that you want to protect.  After you have a good solid asset inventory, you then begin brainstorming vulnerabilities and threats to each asset, as well as prioritize those assets based on confidentiality, integrity, availability and volume.  This helps to measure inherent risk.  You then identify key controls meant to prevent a threat from exploiting a vulnerability.  As this is very tedious, most organizations prioritize this process by inherent risk (why ignore high risk assets in order to declare controls on low risk assets).  The process can be daunting, and we have been helping people with it since the year 2000.  In fact, at one time Dan was so busy helping banks write their risk assessments, he actually wrote a song called the GLBA Risk Assessment while driving from one bank to the next.

Social Engineering Tests

The people in our companies are our biggest security risk, so there are several tests that can be used to keep them on their toes and help them not be the next big security breach.  There is pretext calling, which makes sure no sensitive information is being shared over the phone.  There are also multiple kinds of phishing tests that teaches how to look out for “fishy” emails and links.  Depending on your risk profile, there can also be physical breach attempts and dumpster diving.  Testing the people at your company, instead of telling them what protocols they should follow, allows them to better understand why these specific, and often tedious, steps are taking place.

Technical Vulnerability Assessment

We do an internal and an external scan of your network.  The external blind scan is in a similar vein to our phishing tests.  Here we utilize the latest attack methods that hackers use in an attempt to access your internal network.  This is done blind to better mimic what a real security breach would look like.  We then do an internal network scan by installing a proprietary device that connects to our operations center to scan for vulnerabilities that could have been missed.

IT Governance Review

An IT Governance Review looks at policies, procedures, and people.  Are we properly responding to risk?  Are we actually enforcing controls we declare in our risk assessment, or is this process giving us a “false sense of security.”  People can be the Achilles heel of a financial institution, and to help combat this we review your IT management practices, which then allows us to assess the IT controls related to policies, procedures, processes, and training.  infotex will also perform a risk-based Policy Gap Analysis relating to policies and procedures, human threats, vendor threats, and compliance related threats.

Network Configuration Audit

How do you know the network is set up securely, safely, and for best practices?

We perform an assessment of your current network configuration in accordance to vendor and industry best practices using automated tools like the Microsoft Baseline Security Analyzer or CIS benchmarks.  This includes all client and server applications as well as IT practices, as practice makes perfect.  We review vendor documentation for AVS, spyware defense, firewalls, and more.

Virtual Environment Review

Like a network configuration audit, we can review the configuration of your virtual environment using SANS Institute publications and vendor publications as a best practice framework.  This review takes into consideration visibility, configuration management, network management, and disaster recovery as well as security.  Even though people can be the weakest link, we know it isn’t the only one to look at.

Places to Start:

Like I said earlier, people are our biggest security risk, because of that we test your user-level awareness with various social engineering services.  We obviously offer many more assessment services, but the above services are a great place to start!

 


Original article by Sara Fultz, Creative Assistant at infotex. Her fresh perspective hopefully makes technology security a little more fun!


same_strip_012513


 

Latest News
    You’ve heard it from every MSSP you’ve met: the definition of a SIEM is in the eye of the beholder. But at infotex, we are not talking about the database – an asset whose definition is continuously evolving. We’re talking about the way three teams collaborate in an overall Technology Risk Monitoring process. And whether […]
    A new study shows organizations are responding to cyber attacks faster than ever, so why is that bad news? An article review. When it comes to cyber attacks, the sooner an organization can begin to respond to an attack the better, so the results of a new study showing a drop in the amount of […]
    …a Crash Course of Security Measures The first article by Sara Fultz, Creative Assistant of infotex! Introduction: As the managing partner of infotex, I am proud to introduce the “debut article” for Sara Fultz.  I told Sara “write an article showing us what you’ve learned that the technical staff will appreciate.” As I read her […]
    infotex Programming Coordinator, Michael Hartke, introduces a high level overview of the upcoming update to the infotex SIEM. Look for more movies in the coming months informing our Clients, and those just now learning about us, about the SIEM and its features and functions.
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    As the investigation of the SolarWinds Hack was ongoing, another hack stole some of the limelight… This is the final update on the SolarWinds hack unless a major development comes to light. You can see the previous article here: “Autopsy of the SolarWinds Hack Update“. One of the largest cyber-espionage campaigns in the history of […]
    Employees working from home may find it more difficult to follow security policies… An article review. The surge in employees working from home during the pandemic created many headaches for IT departments around the world, many of whom had no telecommuting policies or procedures before the start… but what about the employees who had to […]
    A Webinar-Movie infotex presents the 2021 update of a previously released webinar presented by our Lead Non-Technical Auditor, Adam Reynolds. This movie-short is intended for those who are planning to participate in an infotex Incident Response Test. Not sure about the importance of an Incident Response Test? Check out onetest.infotex.com for more information! Please let […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS INFOTEX PROMOTES BRYAN BONNELL TO DIGITAL MEDIA MANAGER infotex, the Managed Security Service Provider, announced Bryan Bonnell’s promotion from Senior Data Security Analyst to Digital Media Manager.  “He will continue his normal DSA duties on a limited basis, because we want everybody to stay in touch with […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS RYAN HENSLER OF INFOTEX, EARNS CISSP CERTIFICATE Ryan Hensler, Senior NOC Associate of infotex, Inc., recently received the CISSP certification. “Ryan has proven himself to be a seasoned security professional both in his work for infotex and now through achieving this certification.” said Sean Waugh, Information Security Officer. […]