In this lesson,
we will learn about security reviews.
Security reviews involve dedicated evaluations
of an organization's security policies, controls,
and practices to ensure they are effective
and aligned with regulatory requirements and best practices.
These reviews can be internal or external.
Internal reviews are conducted locally
and focus on internal processes and practices.
They help identify weaknesses and areas for improvement.
External reviews are conducted by independent third parties
and provide an objective evaluation of compliance
and security effectiveness.
Security review types include audits, assessments,
and certifications.
Audits are formal evaluations, typically conducted
by external agencies,
but they may also be conducted by internal security teams.
Assessments are internal
or external reviews, which identify vulnerabilities, risks,
and gaps in security controls.
Finally, certifications serve as formal validation
that an organization meets specific security standards
or regulations
and are often the result
of successful assessments or audits.
So while audits verify compliance
and identify areas for improvement, assessments
help organizations understand their security posture
and enhance their controls while certifications offer
official recognition of their adherence
to established standards.
Let's walk through a few examples of audits, assessments,
and certifications
to understand distinguishing features of each.
First, we have internal audits.
Internal audits are conducted
by the organization's own cybersecurity or compliance teams.
Their primary goal is
to check whether the company is adhering
to its internal security policies and procedures.
For example, a company might perform an internal audit
to ensure that employee access
to sensitive data is properly restricted,
and that all patches
for known vulnerabilities are applied expeditiously.
The focus of an internal audit is on improving internal
processes, identifying risks,
and preventing security breaches before they occur.
Companies can share internal audit results,
but this is not normally required.
Second, we have external audits.
External audits are carried out
by independent third party auditors.
These auditors assess an organization's compliance
with external regulations, standards,
or contractual obligations.
For instance, a financial services company might undergo an
external audit to prove that it complies
with the Payment Card Industry.
Data Security Standard or PCI DSS.
Compliance with PCI DSS is required for handling
credit card data.
External audits are more formal than internal audits,
and the results are often shared with regulators,
clients, or stakeholders.
Third, we have internal assessments.
Internal assessments, like internal audits,
are also initiated by the organization,
but they're generally broader
and more exploratory than internal audits.
Instead of focusing strictly on compliance,
an internal assessment may aim
to evaluate the overall security posture
of the organization.
A good example is conducting an internal assessment
before launching a new system or migrating systems
and data to the cloud.
In this case, an internal assessment would help identify
potential risks, such as insecure application programming
interfaces, or APIs,
or even weak encryption, allowing the company
to take corrective action
before vulnerabilities can be exploited.
Fourth, we have external assessments.
External assessments are usually done
by cybersecurity consultants
or third party experts
who evaluate the organization's security
from an outside perspective.
These assessments are often performed when a company wants
an impartial review of its systems
or is preparing for an external audit.
For instance, a healthcare company might hire an external
firm to conduct a penetration test to ensure compliance
with the Health Insurance Portability
and Accountability Act or HIPAA.
External assessments can identify unseen weaknesses
and provide strategies for improvement,
ensuring the organization aligns with HIPAA's security
and privacy requirements.
Fifth and last, we have certifications.
Certifications provide formal recognition
that an organization meets a specific set
of cybersecurity standards.
They are typically granted after a rigorous audit
or assessment conducted by an accredited certifying body.
For example, all major cloud service providers,
including Amazon Web Services, or AWS, Microsoft Azure,
and Google Cloud hold ISO 27001 certifications.
Customers can access these certifications
to validate that the cloud infrastructure they are using
meets stringent security and compliance requirements.
AWS's ISO 27001 certification can be
accessed via AWS Artifact, a self-service portal
that provides access to AWS's compliance documentation,
including certifications and audit reports.
This is particularly important
for organizations in regulated industries like healthcare
or finance, where demonstrating compliance
with standards such as HIPAA or the Payment Card Industry.
Data Security Standard, PCI DSS, is critical.
Access to certifications allows businesses to ensure
that their cloud environments meet industry-specific
security and privacy requirements.
So remember,
security reviews involve evaluating an organization's
security policies and practices to ensure they're effective
and compliant with regulations.
These reviews can be internal,
focusing on internal processes
or external, conducted by third parties,
to ensure objectivity.
Internal audits aim to identify weaknesses
in the company's own security procedures
while external audits assess compliance
with regulations such as PCI DSS.
Internal assessments are broader
and focus on understanding an organization's overall
security posture,
while external assessments offer an impartial review
of an organization from outside experts.
Finally, certifications provide formal recognition
of compliance with industry standards,
such as ISO 27001,
and certifications are important for demonstrating adherence
to regulations in industries like healthcare,
and finance.