Page 355 - ITGC_Audit Guides

 Externally facing systems often pose the highest risks to organizations and should
receive priority; however, remediation activities are best not limited to only externally
facing environments. First and second line resources can work across the
organization to define and agree on SLAs, and internal audit can help by assessing
whether management is complying with the defined SLAs.
 Third-party risk assessments and monitoring: Programs can assist in assessing
third-party vendors’ risks and the level of security risk posed to the organization
based on the services provided. For example, if the vendor hosts sensitive
organizational data, management should consider having defined oversight
programs such as:
o Active monitoring of SLAs.
o Information security configuration changes.
o Results from independent cybersecurity examination engagements.
o Service organization controls (SOC) reports.
o Vulnerability assessments and penetration tests.
o Escalation procedures with vendor management.
o Baseline assessments performed to inspect key security controls.
o Ongoing evaluations that analyze the technical architecture and
controls in place to protect the organization’s data.
o Monitoring third-party resources that access the organization’s network
and systems to ensure these resources are not conducting
inappropriate activity or exposing the organization to unnecessary risk
with this access.
 Penetration testing: Second line roles may conduct penetration testing for known
vulnerabilities to assess preventive technical controls, as well as management’s
ability to detect and respond to attacks. Penetration tests should include
unannounced components to provide a more reliable and objective assessment of
the organization’s capabilities and readiness to respond to real-world cyberattack
situations. However, the tests should be reasonable in scope, approved by relevant
leadership in advance, and nondisruptive to operations. For example, conducting a
test of a denial-of-service attack scenario, which is an interruption of the network
with malicious intent, should be coordinated with leadership so as not to disrupt
normal operations.
 Malware: Because vulnerabilities may be discovered after a device or software
product was shipped to a customer, a process should be considered to regularly
scan devices and products, identify vulnerabilities, and patch systems in order of
priority (e.g., critical assets with critical patches first). Some systems and patches
may fall below an established risk threshold, and therefore would be monitored and
reported but not acted upon.
 Incident monitoring and response: This combination of processes allows an
organization to detect, respond to, remediate, recover, and report to management in

www.theiia.org Assessing Cybersecurity Risk 20