A Guide To Cyber Security Audits

With ever-increasing volumes of business being done online, it is more important than ever for businesses to protect themselves and their customers from cyber threats. Business leaders must protect their end-to-end systems, which includes everything from mobile phones to cloud systems, networks to hardware, software, and personal to corporate data. Knowledge is key – how do you know your information security is secure? How can you prove compliance? How do you evidence high levels of data security to the Board, or to your investors? That’s where cyber security audits come in and they could help you save time, money, and your company’s reputation while giving stakeholders the assurances they require.

Two types of information security auditing – your own business and your supply chain

 

Cyber security audits are used to determine and assess compliance. A cyber security audit will allow IT Security leaders to assess whether or not they have the proper security mechanisms in place while also ensuring they are in compliance with relevant regulations. Organisations that conduct cyber security audits can then establish data security policies in a proactive manner rather than reactive, resulting in more dynamic threat management.

Regular cyber security audits are essential to really understand the threat landscape of every place, process or organisation that manages your information including the third-party suppliers you work with. While there is a shift, this is still an area often overlooked by IT and Security Managers and yet proves to be one of the most common channels for cyber attacks. Worryingly, 38% of respondents in recent research by BlueVoyant said they had no way of knowing when or if an issue occurs with a third-party supplier’s cyber security. This highlights huge vulnerabilities, when we are seeing figures from US research showing supply chain attacks had risen by 42% in the first quarter of 2021, affecting around 7 million people.

Outsourcing processes, information, or data to a third-party company does not transfer accountability.. These risks can be mitigated or reduced by performing information security and compliance audits on the third-party company/data processor and ensuring that the information is managed in accordance with your own information security policies.

Auditing your supply chain provides assurances that the audited entity is taking expected steps to meet organisational and regulatory information security requirements whilst mitigating the impact of their information security breach on your data. But the process starts much earlier than that in the Procurement phase of the contract negotiations and including the “Right to Audit” clause. Third party audits can also identify whether the outsourcing relationship can withstand a lawsuit claiming that you lack the necessary audit and control functions and therefore reduces your risk through the application of industry best practices.

Best practices for cyber security audits

IT Managers use risk management, compliance and cyber security auditing to manage their information security risks which help to reduce, though not necessarily eliminate, threats while capitalising on opportunities. If the last 18 months has taught us anything, it’s how much the cyber threat landscape and attack surface can change, which means regular auditing and monitoring is essential to stay ahead of the risk.

Here at Aston Information Security, our highly skilled and experienced cyber security auditing consultants work with organisations to understand what assets are important to them, what level of risk exposure they have, both internally and through their supply chain, and how to reduce the threat.

Here are the top considerations for cyber security audits:

1. Find the right Information Security Consultant to conduct the audit

If you don’t have the right level of expertise in-house you need to find a consultant to help you. Security auditing must be done thoroughly and by cyber security auditing professionals who have the in-depth knowledge and experience needed to do it properly and effectively, plus the latest industry expertise in cyber threats and trends. i.e. not a firm that sends in their under-paid and inexperienced “consultant”.

2. Make sure the audit is thorough and covers the right things

Auditors should honestly and rigorously provide a realistic assessment of an organisation to understand how secure its vital information is. It should be a systematic, measurable technical assessment of your organisation’s security policies and must demonstrate how secure a site and its infrastructure really is. An audit should cover for example:

• Risk identification, assessment and evaluation
• Incident and Risk management
• Information and Cyber Security control design and implementation
• Information and Cyber Security control monitoring and maintenance
• Assessment for compliance

There are a number of recognised information and cyber security standards.  IT Security audits can be done for many reasons so being clear on the “why” is vital to ensuring the outcome is the one you are looking for.

Here at Aston, we conduct cyber security audits for areas such as:

• Information Assurance
• Information Governance
• ISO 27002, ISO 27701, ISO 27018 in preparation for ISO 27001
• NCSC Minimum Cyber Security Standard (MCSS)
• National Institute of Standards and Technology (NIST) Audits
• NCSC Cyber Assurance Framework (CAF) based on Network and Information Systems (NIS) Directive
• Facility Security Clearance (List X)
• International Traffic in Arms (ITAR)
• General Data Protection RegulationCompliance
• Data Protection Impact Assessments (DPIA)

 

3. Understand the threat landscape fully

Once you understand the specifications of a security audit, it’s crucial to know the current cyber threats that exist within those parameters, as well as the likelihood of each occurring. These should be rated and the highest priority threat identified as an area of focus. So, in 2022, based on current research and trends being seen worldwide, areas of focus might include:

• Phishing attacks
• Ransomware
• Supply chain attacks
• Human error
• Software vulnerabilities

 

4. Continuous cyber security monitoring

Security experts recommend that information security audits should be conducted at least once per year and perhaps more often than that, in today’s post-covid and rapidly changing cyber environment. “Software vulnerabilities are discovered daily,” independent IT security consultant Carole Fennelly writes in TechTarget. “A yearly security assessment by an objective third party is necessary to ensure that security guidelines are followed.”

An audit is not the end of the process – your post-audit cyber security strategy should be developed and presented to the Board, highlighting the areas of focus and actions needed to mitigate risk as much as possible. This is vital for stakeholder investment, customer loyalty and acquisition and reputation management.

At the “Innovation Insight for Security Rating Services“, in 2018. Gartner predicted, “By 2022, cybersecurity ratings will become as important as credit ratings when assessing the risk of business relationships.” It seems they were right, as we see evidence now that more and more enterprises and public sector organisations want information security credentials, such as ISO 27001 or Cyber Essentials, from their suppliers before they can work together.

Continuous monitoring, of your own organisation and your supply chain   should include regular security audits and will deliver benefits such as:

• Detecting real-time information security, privacy and compliance risks
• Providing consistent and comparable security ratings to easily understand risk exposure
• Assessing ongoing information system and common control levels
• Supporting high-level reporting for Board and Senior management on the risk exposure levels

 

How can we help?

If you need an information security audit, for your own business or your suppliers, book a consultation with us today and find out how we can help.