Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

5/8/2013
05:12 PM
50%
50%

Panic Now

There is a big difference between panic and anxiety

"The auditors are coming! The auditors are coming!" If your organization is prepared for an audit with little notice, you have my congratulations and highest regard, because you are a person of rare foresight.

Most companies simply panic. Oh, it may not be a run-for-your-life panic, but it's probably an all-hands-on-deck, business-slamming scramble. Dusty policies and procedures are updated, log files are checked, and there might even be some quick training to brush up everyone's security and compliance habits.

Being unprepared is expensive because panic is costly. Not only in terms of the time and money, but also in terms of the resources and focus panic steals from business operations. Management by Panic continues to be an unnecessary financial drain because it usually prompts only a short-term response instead of meaningful reforms. After the auditors leave, the panic is over. Old habits return and policies get dusty again.

If this even remotely describes your organization, I have an urgent suggestion for you. Panic Now!

Put all the energy and work you'd invest in dealing with an audit and use it to build a better company today, a panic-proof company. Of course it's impossible to completely eliminate all of the anxiety that an audit brings, but avoiding unscheduled meltdowns is absolutely within your control.

Unscheduled panic provokes powerful reactions, most likely to be disorganized and disruptive. If you choose to panic on your own terms, on your own schedule, you have time to be thoughtful in your approach and less damaging to your business's daily activities.

If your organization's people and systems are not compliant or secure, go ahead and plan your panic now. Start immediately to thoughtfully create and reinforce great daily habits that will shine when the eventual audit arrives. If you start now, you can minimize the expense and manage the costs on your own schedule. Waiting only ensures that you'll spend more and have less control of the expenses.

Also, if your business has made the effort to protect itself against hackers but not against employee theft, you need to panic now. The levels of data security needed for any type of compliance standard are not only meant to protect against bad guys on the outside, but also designed to protect against all threats, even improbable ones like the friendly receptionist and hyper-active salesman.

Panic now if your data backups are not well tested, not only for the ability to restore but also tested for security. No matter the horror stories that continue to fill the news, one of the most common problems we see in business is loss of important data. Even when there are reasonable backup processes, data security is often an afterthought. In many organizations, the easiest way to steal data is not to hack the system, but rather to steal the data backups.

You have a choice, whether you and your organization ever recognize it. You can ignore back-of-the-mind anxiety that you "should be doing more" about compliance, then panic later when there is an audit, security breach, or system failure.

Or you can panic now and use that energy to improve your business and make it less vulnerable to the unexpected. And that eventual audit.

Glenn S. Phillips is typically only hired when there is a panic, good or bad. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4108
PUBLISHED: 2019-11-14
Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors.
CVE-2018-12207
PUBLISHED: 2019-11-14
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
CVE-2019-0117
PUBLISHED: 2019-11-14
Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a ...
CVE-2019-0123
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting SGX, may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2019-0124
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting TXT, may allow a privileged user to potentially enable escalation of privilege via local access.