Development and implementation of a security plan is essential to safeguard your company’s data and minimize risks to unintended privacy disclosure. There are many aspects to security and a good place to start is to hire a services company to perform an audit to assess your current risk exposures.
Here is a list whereby United Force can help you create a security policy and focus on the following areas in our report.
Security Controls
Reference: ISO/IEC 27001
- Physical controls: e.g. fences, doors, locks and fire extinguishers
- Procedural controls: e.g. incident response processes, management oversight, security awareness and training
- Technical controls: e.g. user authentication (login) and logical access controls, antivirus software, firewalls
- Legal and regulatory or compliance controls: e.g. privacy laws, policies and clauses
A similar categorization distinguishes controls involving people, technology and operations/processes. Information security controls protect the confidentiality, integrity and/or availability of information (the so-called CIA Triad).
Risk-aware organizations may choose proactively to specify, design, implement, operate and maintain their security controls, usually by assessing the risks and implementing a comprehensive security management framework such as ISO/IEC 27002, the Information Security Forum’s Standard of Good Practice for Information Security and NIST SP 800-53.
Risk Management Framework
Assessment Methodology Phases
Why Do an Assessment?
- Help confirm that systems are properly secured
- Identify any organization security requirements that are not met, and other security weaknesses that should be addressed
- Meet requirements to periodically assess systems
Examination Techniques (generally conducted manually)
Evaluate systems, applications, networks, policies, and procedures to discover vulnerabilities. Techniques include:
- Documentation review
- Log review
- Ruleset and system configuration review
- Network sniffing
- File integrity checking
Testing Techniques (generally performed using automated tools)
Identify systems, ports, services, and potential vulnerabilities. Techniques include:
- Network discovery
- Network port and service identification
- Vulnerability scanning
- Wireless scanning
- Application security examination