Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

5/8/2013
05:12 PM
50%
50%

Panic Now

There is a big difference between panic and anxiety

"The auditors are coming! The auditors are coming!" If your organization is prepared for an audit with little notice, you have my congratulations and highest regard, because you are a person of rare foresight.

Most companies simply panic. Oh, it may not be a run-for-your-life panic, but it's probably an all-hands-on-deck, business-slamming scramble. Dusty policies and procedures are updated, log files are checked, and there might even be some quick training to brush up everyone's security and compliance habits.

Being unprepared is expensive because panic is costly. Not only in terms of the time and money, but also in terms of the resources and focus panic steals from business operations. Management by Panic continues to be an unnecessary financial drain because it usually prompts only a short-term response instead of meaningful reforms. After the auditors leave, the panic is over. Old habits return and policies get dusty again.

If this even remotely describes your organization, I have an urgent suggestion for you. Panic Now!

Put all the energy and work you'd invest in dealing with an audit and use it to build a better company today, a panic-proof company. Of course it's impossible to completely eliminate all of the anxiety that an audit brings, but avoiding unscheduled meltdowns is absolutely within your control.

Unscheduled panic provokes powerful reactions, most likely to be disorganized and disruptive. If you choose to panic on your own terms, on your own schedule, you have time to be thoughtful in your approach and less damaging to your business's daily activities.

If your organization's people and systems are not compliant or secure, go ahead and plan your panic now. Start immediately to thoughtfully create and reinforce great daily habits that will shine when the eventual audit arrives. If you start now, you can minimize the expense and manage the costs on your own schedule. Waiting only ensures that you'll spend more and have less control of the expenses.

Also, if your business has made the effort to protect itself against hackers but not against employee theft, you need to panic now. The levels of data security needed for any type of compliance standard are not only meant to protect against bad guys on the outside, but also designed to protect against all threats, even improbable ones like the friendly receptionist and hyper-active salesman.

Panic now if your data backups are not well tested, not only for the ability to restore but also tested for security. No matter the horror stories that continue to fill the news, one of the most common problems we see in business is loss of important data. Even when there are reasonable backup processes, data security is often an afterthought. In many organizations, the easiest way to steal data is not to hack the system, but rather to steal the data backups.

You have a choice, whether you and your organization ever recognize it. You can ignore back-of-the-mind anxiety that you "should be doing more" about compliance, then panic later when there is an audit, security breach, or system failure.

Or you can panic now and use that energy to improve your business and make it less vulnerable to the unexpected. And that eventual audit.

Glenn S. Phillips is typically only hired when there is a panic, good or bad. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16317
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerabi...
CVE-2019-16318
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
CVE-2019-16307
PUBLISHED: 2019-09-14
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKe...
CVE-2019-16294
PUBLISHED: 2019-09-14
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVE-2019-16309
PUBLISHED: 2019-09-14
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.