Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

5/8/2013
05:12 PM
50%
50%

Panic Now

There is a big difference between panic and anxiety

"The auditors are coming! The auditors are coming!" If your organization is prepared for an audit with little notice, you have my congratulations and highest regard, because you are a person of rare foresight.

Most companies simply panic. Oh, it may not be a run-for-your-life panic, but it's probably an all-hands-on-deck, business-slamming scramble. Dusty policies and procedures are updated, log files are checked, and there might even be some quick training to brush up everyone's security and compliance habits.

Being unprepared is expensive because panic is costly. Not only in terms of the time and money, but also in terms of the resources and focus panic steals from business operations. Management by Panic continues to be an unnecessary financial drain because it usually prompts only a short-term response instead of meaningful reforms. After the auditors leave, the panic is over. Old habits return and policies get dusty again.

If this even remotely describes your organization, I have an urgent suggestion for you. Panic Now!

Put all the energy and work you'd invest in dealing with an audit and use it to build a better company today, a panic-proof company. Of course it's impossible to completely eliminate all of the anxiety that an audit brings, but avoiding unscheduled meltdowns is absolutely within your control.

Unscheduled panic provokes powerful reactions, most likely to be disorganized and disruptive. If you choose to panic on your own terms, on your own schedule, you have time to be thoughtful in your approach and less damaging to your business's daily activities.

If your organization's people and systems are not compliant or secure, go ahead and plan your panic now. Start immediately to thoughtfully create and reinforce great daily habits that will shine when the eventual audit arrives. If you start now, you can minimize the expense and manage the costs on your own schedule. Waiting only ensures that you'll spend more and have less control of the expenses.

Also, if your business has made the effort to protect itself against hackers but not against employee theft, you need to panic now. The levels of data security needed for any type of compliance standard are not only meant to protect against bad guys on the outside, but also designed to protect against all threats, even improbable ones like the friendly receptionist and hyper-active salesman.

Panic now if your data backups are not well tested, not only for the ability to restore but also tested for security. No matter the horror stories that continue to fill the news, one of the most common problems we see in business is loss of important data. Even when there are reasonable backup processes, data security is often an afterthought. In many organizations, the easiest way to steal data is not to hack the system, but rather to steal the data backups.

You have a choice, whether you and your organization ever recognize it. You can ignore back-of-the-mind anxiety that you "should be doing more" about compliance, then panic later when there is an audit, security breach, or system failure.

Or you can panic now and use that energy to improve your business and make it less vulnerable to the unexpected. And that eventual audit.

Glenn S. Phillips is typically only hired when there is a panic, good or bad. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Kr00k Wi-Fi Vulnerability Affected a Billion Devices
Robert Lemos, Contributing Writer,  2/26/2020
Exploitation, Phishing Top Worries for Mobile Users
Robert Lemos, Contributing Writer,  2/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3006
PUBLISHED: 2020-02-28
On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for so...
CVE-2015-5361
PUBLISHED: 2020-02-28
Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensi...
CVE-2020-6803
PUBLISHED: 2020-02-28
An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.
CVE-2020-6804
PUBLISHED: 2020-02-28
A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system.
CVE-2019-4301
PUBLISHED: 2020-02-28
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.