Conduct a security audit

Introduction

    I conducted an internal security audit assessment for Botium Toys, a fictional toy company, as part of my cybersecurity portfolio and in completion of the Play It Safe: Manage Security Risks Course in Google's Cybersecurity Professional Certificate on Coursera.

The primary objective was to evaluate and assess Botium Toys' cybersecurity program. This audit aimed to ensure that the company's cybersecurity practices align with industry standards and best practices. The goal was to identify and address high-risk vulnerabilities and to devise a comprehensive strategy for enhancing the organization's overall security posture. Throughout this audit, my team and I diligently documented our findings, formulated remediation plans, and engaged in effective communication with relevant stakeholders.

Scenario

    Botium Toys is a small U.S. business that develops and sells toys. The business has a single physical location, which serves as their main office, a storefront, and a warehouse for their products. However, Botium Toy’s online presence has grown, attracting customers in the U.S. and abroad. As a result, their information technology (IT) department is under increasing pressure to support their online market worldwide.

 

The manager of the IT department has decided that an internal IT audit needs to be conducted. She expresses concerns about not having a solidified plan of action to ensure business continuity and compliance, as the business grows. She believes an internal audit can help better secure the company’s infrastructure and help them identify and mitigate potential risks, threats, or vulnerabilities to critical assets. The manager is also interested in ensuring that they comply with regulations related to internally processing and accepting online payments and conducting business in the European Union (E.U.).  

 

The IT manager starts by implementing the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), establishing an audit scope and goals, listing assets currently managed by the IT department, and completing a risk assessment. The goal of the audit is to provide an overview of the risks and/or fines that the company might experience due to the current state of their security posture.

 

Workflow

During this procedure, we will fulfill the following steps:

a. Evaluation of Controls

b. Identification of controls and determine their Implementation.

c. Prioritization of each selected control based on business impact.

d. Completion of Compliance Checklist

e. Ensure proper explanation is prepared for the application of each control.'

f. Review the results and outcomes of each analyzed control

g. summarizes your recommendations.

h. Provide findings and recommendations to stakeholders in the requested format


Assets managed by the IT Department include:

·         On-premises equipment for in-office business needs

·         Employee equipment: end-user devices (desktops/laptops, smartphones), remote workstations, headsets, cables, keyboards, mice, docking stations, surveillance cameras, etc.

·         Management of systems, software, and services: accounting, telecommunication, database, security, e-commerce, and inventory management

·         Internet access

·         Internal network

·         Vendor access management

·         Data center hosting services

·         Data retention and storage

·         Badge readers

·         Legacy system maintenance: end-of-life systems that require human monitoring.

 

 

Administrative Controls

Control Name	Control type and explanation	Control Required	Priority
Least Privilege	Preventative: reduces risk by making sure vendors and non-authorized staff only have access to the assets/data they need to do their jobs	X	High
Disaster recovery plans	Corrective: business continuity to ensure systems can run in the event of an incident/there is limited to no loss of productivity downtime/impact to system components, including computer room environment (air conditioning, power supply, etc.); hardware (servers, employee equipment); connectivity (internal network, wireless); applications (email, electronic data); data and restoration	X	High
Password policies	Preventative: Establish password strength rules to improve security/reduce the likelihood of account compromise through brute force or dictionary attack techniques	X	High
Access control policies	Preventative; Increase confidentiality and integrity of data	X	High
Account management policies	Preventative; Reduce attack surface and limit overall impact from disgruntled/former employees	X	High
Separation of duties	Preventative: Ensure no one has so much access that they can abuse the system for personal gain	X	High

 

 

 

Technical Controls

Control Name	Control type and explanation	Control Required	Priority
Firewall	Preventative: Firewalls are already in place to filter unwanted/malicious traffic from entering the internal network	N	NA
Intrusion Detection System (IDS)	Detective: allows IT team to identify possible intrusions (e.g., anomalous traffic) quickly	X	High
Encryption	Deterrent; makes confidential information/data more secure (e.g., website payment transactions)	X	High
Backups	Corrective; supports ongoing productivity in the case of an event; aligns to the disaster recovery plan	X	High
Password management system	Corrective: password recovery, reset, lockout notifications	X	High
Antivirus (AV) software	Corrective; Detect and quarantine known threats	X	High
Manual monitoring, maintenance, and intervention	Preventative/corrective; required for legacy systems to identify and mitigate potential threats, risks, and vulnerabilities	X	High

Physical Controls

Control Name	Control type and explanation	Control Required	Priority
Closed-circuit television (CCTV) surveillance	Preventative/detective; can reduce risk of certain events; can be used after the event for investigation	X	High/Medium
Locking cabinets (for network gear)	Preventative: Increase integrity by preventing unauthorized personnel/individuals from physically accessing/modifying network infrastructure gear	X	High/Medium
Alarm service provider	Deterrent: makes the likelihood of a successful attack seem low	X	Low
Badge Readers	Preventative: Physical and digital assets are more secure	X	High
Fire detection and prevention (fire alarm, sprinkler system, etc.)	Detective/Preventative; Detect fire in the toy store’s physical location to prevent damage to inventory, servers, etc.	X	Medium

 

Compliance Checklist

 

·         General Data Protection Regulation (GDPR):

GDPR is a European Union (E.U.) data regulation designed to safeguard E.U. citizens' data processing and protect their privacy, regardless of location. It also mandates that in the event of a data breach involving an E.U. citizen's data, notification must be made within 72 hours.

Given Botium Toys' expanding operations and involvement with international customers, GDPR compliance is essential for handling the financial and personal information of European Union customers.

 

·         Payment Card Industry Data Security Standard (PCI DSS):

PCI DSS is a global security standard established to ensure organizations that handle credit card information do so in a secure environment.

Botium Toys must comply with PCI DSS due to its online and in-person payment processing activities and the storage and processing of customer credit card data on an international scale. Non-compliance could result in severe consequences, including monthly monetary fines (ranging from 5,000-100,000 USD), costs associated with forensic audits in the event of a data breach, restrictions imposed by payment brands, damage to the brand's reputation, and potential lawsuit costs following data breaches.

 

·         System and Organizations Controls (SOC Type 1, SOC Type 2):

SOC1 and SOC2 reports focus on an organization's user access policies across various organizational levels, assessing financial compliance and risk levels. These reports also address confidentiality, privacy, integrity, availability, security, and overall data safety. Failures in these controls can lead to fraudulent activities.

Botium Toys must establish and maintain appropriate user access controls for both internal and external personnel, including third-party vendors, to mitigate risks and ensure data security.

These standards collectively evaluate the effectiveness of a company's internal controls, with SOC1 focusing on financial reporting controls and SOC2 concentrating on information security controls, particularly in safeguarding customer data.

Stakeholder Memorandum

                TO: IT Manager, Stakeholders

                FROM: Marcus Obie

                DATE: 09/11/2023

                SUBJECT:  Botium Toys Audit: Findings and Recommendations

 

Dear Team,

 

Please review the following information concerning the Botium Toys internal audit, encompassing the audit scope, objectives, key findings, and recommendations.

 

Audit Scope:

The audit encompasses the following systems: accounting, endpoint detection, firewalls, intrusion detection system, and the security information and event management (SIEM) tool. These systems will undergo evaluation with respect to the following criteria:

 

1.       Assessment of current user permissions.

2.       Examination of existing implemented controls.

3.       Review of current procedures and protocols.

 

Goals & Objectives:

·         Adherence to the NIST Cybersecurity Framework (CSF).

·         Establishment of a robust compliance process for systems.

·         Strengthening of system controls.

·         Implementation of the principle of least privilege in user credential management.

·         Development of policies and procedures, including playbooks.

·         Verification of alignment with GDPR, PCI DSS, and other compliance requirements regarding user permissions, controls, procedures, and technology assets.

·         Verification of hardware and system access accounting.

 

Missing Controls (Critical)

a.       Principle of Least Privilege

b.       Password Policies

c.       Separation of Duties.

d.       Disaster recovery plans.

e.       Intrusion Detection System (IDS).

f.        Encryption for secure website transactions and sensitive data storage.

g.       Backup options.

h.       Installation of antivirus (AV) software.

i.         Manual monitoring, maintenance, and intervention for legacy systems.

j.         Closed-circuit television (CCTV) surveillance.

k.       Locks and locking cabinets for network gear.

l.         Firewall

m.     Fire detection and prevention measures (fire alarms, sprinkler systems, etc.)

 

Control Recommendations

The following controls should be implemented as soon as possible to improve the current methods Botium meets compliance and regulatory requirements

a. Centralized password management system.

b.       Cloud or Offsite Solution.

c.       Automation

 

Summary:

 

    We recommend immediate attention to the critical findings related to PCI and GDPR compliance. Botium Toys' expansion into international markets, including the European Union, and its acceptance of online payments necessitate swift action to align with these regulations. Utilizing SOC1 and SOC2 guidance regarding user access policies will facilitate the implementation of the principle of least privilege and the development of necessary policies and procedures for compliance.

Additionally, we strongly recommend the implementation of a centralized password management system to assist with enforcing password policies throughout the organization. This will help mitigate risks that may generate productivity issues when employees or vendors request password recovery or reset through the IT department.

 

    The development of disaster recovery plans will also be required to help ensure in the event of a disaster Botium Toys can quickly recover. Furthermore, we recommend cloud or off-site backup strategies to ensure business continuity in the face of physical disasters or cyberattacks.

The integration of an Intrusion Detection System (IDS) and antivirus (AV) software into the existing systems will enhance the ability to detect and mitigate potential risks, especially considering the manual monitoring and intervention required for legacy systems. An additional layer of automation through script can be applied to ensure systems are updated enterprise-wide.

To secure physical assets at Botium Toys' locations, we suggest implementing physical security locks, CCTV surveillance, and additional physical security measures such as time-door-readers to add layers to entry, and alarm service that can offer determent capabilities. These implemented measures will significantly enhance the overall security posture of Botium Toys as a whole and ensure your organization is within compliance and regulatory requirements to run successfully.

 

Best Regards,

 

Marcus Obie