Secure in reality.
Security starts with taking stock of the way things really are at this moment. Don't assume someone in your organization knows where the weaknesses are — be certain. If you can't tell within minutes that your critical assets aren't at risk, then they are indeed at risk.
In fact, they may not even be your assets any more.
What you need to know
- Threats are rising as hacking becomes more profitable to data thieves
- More than 90% of reported incidents take advantage of known vulnerabilities and human error
- Vulnerabilities are rising with poor software quality, increased connectivity and data mobility
- Legal and financial ramifications of noncompliance with State and Federal regulatory standards (such as SOX, HIPAA, GLBA and others) are astounding
- Private firms — most notably those in the Payment Card Industry (PCI) — are forcing obligation contracts with downstream suppliers and business partners to safeguard information
- Expectations of due diligence and a growing body of legal precedent are driving firms to implement information governance programs
What you should be asking yourself
- Security Operations
Do we manage our information security program according to established best practices?
- Compliance
Do our security practices comply with a specific regulatory program?
- Data Privacy and Confidentiality
Are we doing the right things well enough to protect our data?
- Incident Detection and Response
Do we have the visibility we need to detect and respond to threats as they occur? If our network was breached, how would we know?
- Network and Host Vulnerability Management
Is our network implemented in a manner that keeps intruders out? Is vulnerability data current and readily available?
- Penetration Test
Could someone break into our network?
- Security Awareness
Are our people knowledgeable about their role in the security program?
- Web Applications
Are our web applications secure? And would we know if they were attacked?