You are only as strong as your weakest link!!
Can you say with a high level of confidence that you are aware of all your networks non-compliance and security risks across all network devices in the enterprise infrastructure? As an IT Risk professional, your biggest challenge is to not only keeping up with all of the ever-changing regulatory requirements, but also to know where your network may require corrective action to be compliant at any given moment in time.
Prior to incorporating 360 GRC as part the "enterprise solution", our customers' most common approach in achieving network compliance was performing periodic network audits via either the internal audit department, IT security team or a third party vendor . The problem with this compliance methodology is that:
- The IT Risk Professional performing the audit do not have the necessary regulatory knowledge and/or technical skills to ensure that the company is fully compliant and secure. The IT Risk Professional is expected to understand what requirements are mandatory, what is the expectation of each requirement, know the technical vendor commands; and how does this impact the configuration of your network devices. Face it - most IT Risk Professionals are not Cisco experts, however, it takes the know how of almost a Cisco expert (CCIE) to audit an enterprise infrastructure.
- The network audit is a very manual intensive process thereby making it virtually impossible to perform a complete and comprehensive review of the entire network environment. In order to be cost conscious, the IT Risk Professional would limit the network audit only to a sample of devices. The out of scope network environment, usually the majority of devices, remain unknown and unaddressed (i.e., non-compliant and/or insecure).
- The result of the network audit is a snapshot of a given point in time. Business demands constantly change and the network must also change in order to fulfill such demands. Hence, the results of the network review may be stale and no longer valid after the network changes. Such results cannot be tracked over time either.
click here to read more.
