Security Education and Mentoring

Security audits may seem to come around quickly in our fast-moving cyber world. A consistent consequence of your regular audit is that it is a nerve-wracking experience for someone on the team.

Ideally, you will have a consultation team that does not just write you a detailed report but, rather, remains accessible to you through the process - one that lets you know what flags are raised and what looks solid.

As cyber-insurance rates continue to skyrocket, companies work tirelessly to avoid serious security breaches. Reputations fall with security breaches and not just breaches of dating sites. When working in the financial and health care sectors, the regulatory landscape is vast and constantly evolving. As a result, clients choose teams with solid track records in their industry when such an important audit comes up.

A Security Audit for our Client

An investment bank approached SoHo with a request for a full security audit. The specification included:

• Understanding the security posture to identify areas of improvement
• Amending the security strategy and program in light of the assessment

The review entailed a full assessment of the security team’s capabilities, organizational structure, and job descriptions. It also required a full review and revision of governance documentation to ensure that all policies, procedures, standards, and guidelines aligned with the recommended security strategy.

As a result of the review cycle, SoHo created a comprehensive security strategy and implementation plan. This included recommended improvements needed to reduce risk and secure the enterprise.

The plan provided clear gap analyses identifying where the organization’s security aligned with best practice and made recommendations for improvements where they did not. Such improvements touched upon system build processes. Specifically, SoHo implemented a strategy to enable new systems to be spun up outside of the production network. This ensured that all intranet-accessible devices were fully patched and scanned before deployment.

Recommendations were also made concerning certain administrative processes. The report included a prioritized risk response executive summary action plan addressing such issues.