Russian interference in the American elections, the WannaCry-virus in May and the Petya-virus just one month later. Information security is hitting the headlines more than ever. With European GDPR regulations taking effect on the 25th of May 2018, interest in this subject is bound to increase. Many organisations are worried about their security position as all these factors start to affect them. Doing nothing is not an option, but where do you start? Well, step one is knowing what the current state of your information security is. We can help you do that – in just one week. And once you know what your current position is, you can start making improvements. In this blog, I’ll explain what our approach is.
We are currently talking to many organisations who want to analyse the current status of their security quickly and simply. What are we doing right and where could we be making improvements. Which improvements should be given priority? That’s why we developed the Cyber Security Assessment Tool (CSAT). This is a practical tool which you can use to analyse your entire company network. All endpoints, fileservers, configurations, security rights and roles can be scanned and analysed. On the basis of the scan, the CSAT comes up with practical recommendations and a roadmap to improve your information security.
Don’t forget your Processes
Kresko 360 offers the full IT Asset Management training portfolio of the International Association of IT Asset Managers IAITAM, including CAMSE (Certified Asset Management Security Expert) and CITAD (Certification in IT Asset Disposition).In addition to the technical scan, it’s crucial to take a look at the processes in your organisation. Have your employees been trained correctly? How can you make sure that sensitive company data is not exported to your employees private devices? What actions should you take following a malware infection?
Processes are a crucial element of information security. That’s why we combine the technical scan in the CSAT with a questionnaire in which we analyse the policies, culture and processes. The full scan can be carried out in four days – from the initial installation of the CSAT to presentation of the results and roadmap.
Security and Data Privacy training
The GDPR regulations became active on the 25th of May 2016 but will only be enforced from 2018 – with associated measures and fines. For many organisations, that’s the reason that they are relatively late in taking action to comply with the GDPR regulations. The CSAT helps you to identify what you need to do to move towards compliancy. For example, it will locate personal data and identifiers in your network and where this is used in your processes. We also work together with IsoSecure – an auditing company – to provide a GDPR audit. By bringing together the technical scan with the processes in this way, you will identify the actions you need to take to become compliant and which ones should be given priority.
Continuous improvement of your information security
A common mistake is to attempt to achieve the highest level of information security straight away. That puts an enormous amount of pressure on both your budget and your organisation. That’s why the CSAT provides a maturity score for thirteen different areas of security. That let’s you know where the priority actions are and where you should be focusing your efforts. The priority could, for example, be the implementation of an improved firewall, replacing the network printers, simulating a hack or drawing up security guidelines. The CSAT scan helps you to determine the next big step, so that your investment stays in sync with the risks your company faces.
This approach will give you a clear cyber security roadmap. What is your organisations current position with regard to information security and what is your growth path? This is exactly what the government organisations responsible for the GDPR, are looking for: are you aware of the risks and are you constantly improving your security position with regards to these risks?
CSAT covers the entire Microsoft infrastructure
The CSAT has been designed to work in the Windows infrastructure: Office 365, SharePoint and Fileshares. CSAT collects information about accounts, firewall settings, installed applications, the OS/Service Pack and fileshares. CSAT exports users and groups from Active Directory and Azure AD. The software identifies external users and unused accounts and also flags suspicious accounts. CSAT uses agents on the endpoints which self-delete following the scan. This means that only minimal effort is required from the internal IT department during the scan.
From analysis to action
CSAT identifies areas requiring attention and produces a practical action plan and roadmap. For example, in the CSAT discovers that employees are sharing sensitive information outside the organisation, this will result in a recommendation to implement document encryption and security. This approach means that you will know, within a week, what your current security position is and what your action plan and roadmap should be. We will also be making the CSAT available to partners so that we are able to satisfy the high level of interest expected.
