Risk //

Compliance

5/8/2013
05:12 PM
50%
50%

Panic Now

There is a big difference between panic and anxiety

"The auditors are coming! The auditors are coming!" If your organization is prepared for an audit with little notice, you have my congratulations and highest regard, because you are a person of rare foresight.

Most companies simply panic. Oh, it may not be a run-for-your-life panic, but it's probably an all-hands-on-deck, business-slamming scramble. Dusty policies and procedures are updated, log files are checked, and there might even be some quick training to brush up everyone's security and compliance habits.

Being unprepared is expensive because panic is costly. Not only in terms of the time and money, but also in terms of the resources and focus panic steals from business operations. Management by Panic continues to be an unnecessary financial drain because it usually prompts only a short-term response instead of meaningful reforms. After the auditors leave, the panic is over. Old habits return and policies get dusty again.

If this even remotely describes your organization, I have an urgent suggestion for you. Panic Now!

Put all the energy and work you'd invest in dealing with an audit and use it to build a better company today, a panic-proof company. Of course it's impossible to completely eliminate all of the anxiety that an audit brings, but avoiding unscheduled meltdowns is absolutely within your control.

Unscheduled panic provokes powerful reactions, most likely to be disorganized and disruptive. If you choose to panic on your own terms, on your own schedule, you have time to be thoughtful in your approach and less damaging to your business's daily activities.

If your organization's people and systems are not compliant or secure, go ahead and plan your panic now. Start immediately to thoughtfully create and reinforce great daily habits that will shine when the eventual audit arrives. If you start now, you can minimize the expense and manage the costs on your own schedule. Waiting only ensures that you'll spend more and have less control of the expenses.

Also, if your business has made the effort to protect itself against hackers but not against employee theft, you need to panic now. The levels of data security needed for any type of compliance standard are not only meant to protect against bad guys on the outside, but also designed to protect against all threats, even improbable ones like the friendly receptionist and hyper-active salesman.

Panic now if your data backups are not well tested, not only for the ability to restore but also tested for security. No matter the horror stories that continue to fill the news, one of the most common problems we see in business is loss of important data. Even when there are reasonable backup processes, data security is often an afterthought. In many organizations, the easiest way to steal data is not to hack the system, but rather to steal the data backups.

You have a choice, whether you and your organization ever recognize it. You can ignore back-of-the-mind anxiety that you "should be doing more" about compliance, then panic later when there is an audit, security breach, or system failure.

Or you can panic now and use that energy to improve your business and make it less vulnerable to the unexpected. And that eventual audit.

Glenn S. Phillips is typically only hired when there is a panic, good or bad. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.