|
|
| Security Audit and Consulting |
Sync Solutions provides an IT Security Audit designed to assess the security risks facing any business and the controls or countermeasures can adopt to mitigate those risks. The IT Security Audit is typically a human process, performed as a team with technical and business knowledge of the company's information technology assets and business processes. As part of any audit, Sync Solutions will interview key personnel, conduct vulnerability assessments, catalog existing security policies and controls, and examine IT assets covered by the scope of the audit. In most cases, this relies heavily on technology tools to perform the audit.
Sync Solutions IT Security Audit will not only assess compliance, but also assess the very nature and quality of the policies and controls themselves. In many cases, security policies become rapidly obsolete with the release of new technologies or process overhauls. Security audits are the most effective tool for determining the validity of those policies.
Many businesses have an easy time defining the physical security perimeter that encloses the audit. It is relatively easy for audit team to limit an audit to a physical location (like a data center) or logical grouping of assets (all production storage devices).
What is more difficult, and frankly more valuable, is scoping the audit around security processes or areas. To do this effectively, it is imperative that your businesses prioritize security processes by the amount of risk that they pose to the organization. For example, the process of business continuity may pose a minimal security risk to the business, whereas the process of identity management poses a severe risk. Under this sample scenario, the identity management process would be included in the audit, while business continuity would not.
Typically, the majority of security threats will come from these four key areas:
Network access controls:
This process checks the security of a user or system that is attempting to connect to the network. It is the first security process that any user or system encounters when trying to connect to any IT asset within the business' network. Network access controls should also track the security of users and systems that are already connected to the network.
Intrusion prevention:
This process controls who can access what and when. Authentication and authorization are the usual pillars of this process, but robust policy management and storage are also critical components.
Identity and access management:
This process controls who can access what and when.Authentication and authorization are the usual pillars of this process, but robust policy management and storage are also critical components.
Vulnerability management:
The vulnerability management process manages baseline security configurations across the full range of asset classes. It also identifies and mitigates risks by performing root cause analysis and taking corrective measures against specific risks. |
|
|
|
