Assessing the Systems Environment to Identify Business Risks

Have you ever considered what might happen if, one day, your Information Systems group discovered that your company's network had been breached from outside the company?

In other words, your company had been "hacked"!

This month's e-update is a case study of a recent client project where management wanted to avoid this nightmarish experience. This case study describes our independent assessment of its network security and illustrates the benefits of being "proactive" instead of "reactive."

Another company that we know did not conduct a proactive assessment, and were hacked from outside the company – that Information Systems group determined that all major servers had been compromised, and thus had to:

• Rebuild the operating systems for all the servers.
• Reinstall all applications on these servers.
• Restore all data from the most recent backups.
• Install a new firewall device.
• Reconfigure the new and existing firewall devices to work together to provide better security and a true demilitarized zone (DMZ).
• Configure servers in the DMZ and behind the firewall to securely communicate with each other.
• Involve the law enforcement officials to investigate the security breach.

As a result, this company incurred an enormous of time and expense that would likely have been avoided by performing an assessment such as the one described in this case study.

As you'll see, one significant benefit for our client was to give them peace of mind. Now, a question for you: Would you would sleep better at night knowing that your network's security had been assessed, reviewed, and tested by experienced and credentialed professionals of an objective firm well-known for "finding a better way"?

The way we look at it, you deserve peace of mind, too.

Give us a call today...336-297-4200.

Sincerely yours,

Todd L. Herman

A Case Study:

Assessing the Systems Environment to Identify Business Risks

Situation...

A closely-held company provides various financial, accounting, investment management, and tax services to its clients. Information systems play a critical role in delivering these services.

Problem...

This company outsources much of its information systems function. Executives and management believed that this arrangement was working well, and that the network and certain applications were being adequately maintained and protected under the guidance of their network service provider. Top executives, however, wanted to validate this belief, both for their own peace of mind, as well as to be able to answer questions from clients, auditors, and bankers, should they arise.

Solution...

Our client retained us to assess the various network, infrastructure, and security technologies and techniques in use at the company. Our approach was to:

• Perform an Initial Risk Assessment, to assess the level of risk (High, Medium, or Low),
  

  in the areas of...	...in terms of...
  Infrastructure Software People Procedures, and Data	Availability Security Integrity, and Maintainability.

• Assess internal threats from procedural gaps or weaknesses, lack of training, or maintenance shortcomings.
• Work jointly with a business partner specializing in our client’s industry to conduct an External Threat Assessment.
• Perform substantive tests for areas identified as "High"; risk to assess whether identified risks are adequately addressed or have appropriate alternative controls.
• Summarize the results of tests and our recommendations in an Engagement Report.

An excerpt from the Initial Risk Assessment matrix – jointly discussed and assessed by management and us – provided the basis for the overall scope of the project.

One section from the External Threat Assessment report details risks associated with external IP addresses.

One part of our Engagement Report presents key findings and recommendations.

Results and Benefits...

Several areas that management had not truly assessed were shown to have better security than believed. The internal and external threat assessments identified specific steps required to mitigate several remaining risks. Upon completion of these steps, management responsible for the Information Systems function will be better able to assess potential risks, through knowledge and techniques learned during this engagement.

Conclusion...

Our client decided to proactively assess and address risks in their systems environment, communicating to employees that systems security is important, and providing their clients and other relevant parties improved confidence in the controls protecting sensitive personal financial information.

For Further Information...

To discuss how we could help your business, please call us at 336.297.4200 to schedule a no-obligation consultation.