Risk // Compliance
5/8/2013
05:12 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Panic Now

There is a big difference between panic and anxiety

"The auditors are coming! The auditors are coming!" If your organization is prepared for an audit with little notice, you have my congratulations and highest regard, because you are a person of rare foresight.

Most companies simply panic. Oh, it may not be a run-for-your-life panic, but it's probably an all-hands-on-deck, business-slamming scramble. Dusty policies and procedures are updated, log files are checked, and there might even be some quick training to brush up everyone's security and compliance habits.

Being unprepared is expensive because panic is costly. Not only in terms of the time and money, but also in terms of the resources and focus panic steals from business operations. Management by Panic continues to be an unnecessary financial drain because it usually prompts only a short-term response instead of meaningful reforms. After the auditors leave, the panic is over. Old habits return and policies get dusty again.

If this even remotely describes your organization, I have an urgent suggestion for you. Panic Now!

Put all the energy and work you'd invest in dealing with an audit and use it to build a better company today, a panic-proof company. Of course it's impossible to completely eliminate all of the anxiety that an audit brings, but avoiding unscheduled meltdowns is absolutely within your control.

Unscheduled panic provokes powerful reactions, most likely to be disorganized and disruptive. If you choose to panic on your own terms, on your own schedule, you have time to be thoughtful in your approach and less damaging to your business's daily activities.

If your organization's people and systems are not compliant or secure, go ahead and plan your panic now. Start immediately to thoughtfully create and reinforce great daily habits that will shine when the eventual audit arrives. If you start now, you can minimize the expense and manage the costs on your own schedule. Waiting only ensures that you'll spend more and have less control of the expenses.

Also, if your business has made the effort to protect itself against hackers but not against employee theft, you need to panic now. The levels of data security needed for any type of compliance standard are not only meant to protect against bad guys on the outside, but also designed to protect against all threats, even improbable ones like the friendly receptionist and hyper-active salesman.

Panic now if your data backups are not well tested, not only for the ability to restore but also tested for security. No matter the horror stories that continue to fill the news, one of the most common problems we see in business is loss of important data. Even when there are reasonable backup processes, data security is often an afterthought. In many organizations, the easiest way to steal data is not to hack the system, but rather to steal the data backups.

You have a choice, whether you and your organization ever recognize it. You can ignore back-of-the-mind anxiety that you "should be doing more" about compliance, then panic later when there is an audit, security breach, or system failure.

Or you can panic now and use that energy to improve your business and make it less vulnerable to the unexpected. And that eventual audit.

Glenn S. Phillips is typically only hired when there is a panic, good or bad. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web