Question

1. You work for a cyber security consulting company. Your company has been called in to assist a Gas Company take an audit of their security posture and make suggestions on how to improve their cyber security standing.

A) What are some of the initial questions you would want to ask? What are some of the details and information you'd want to initially get from the company to start your assessment? What is important to know from the start?

B) Once you have gotten a broad picture of the company it would be time to start looking deeper into the company and the companies assets. Tell me an approach to this? What are the basic steps involved? Who would you want to talk to in the company? What documentation or resources can you use?

Answer 1

My basic questions to begin with would be:

1. Do you have any published IT policy document in place.
2. How is the access to sensitive data is managed.
3. What is the back up plan for system/server crash.
4. How the security of the data is handled.
5. Are the staff aware of the existing IT policy.
6. Are all softwares up-to-date
7. Do you have the business continuity plan in place.
8. What is the disposal process of IT assets.

The basic approach would be to risk based approach. I would first clearly define the scope of audit and prioritize the audit process. The IT manager would I approach for my question and derive the threat assessment of the current situation. I would also seek information on the employees engagement on the awareness of the potential cyber threats, whether there is any program for educating about dos and don'ts. Getting the governing document and verifying whether it is being followed or not would be my next step. Checking on the history of the organization on any kind of cyber attack, any incident of malware infection and data breach will help me to assess the current preparedness to deal with such situations. An update on the latest industry trend in the cyber security can help to do the benchmarking for the organization for which the audit is proposed and done. Taking a note of the periodic update on the existing softwares and back up data plan will be my preference to dig deeper and find the real scenarios.