ISO

Software solves many problems and improves many processes, but the code software depends on is never perfect. That fact of life leaves your software and the data within open to new vulnerabilities including hacking, exploitation, and theft.

Because of this, businesses must task their security team to create a vulnerability management solution that can identify, assess, remediate, and report code vulnerabilities. The goal: to prevent unwanted access to your software that can cause expensive, punitive, or even devastating damages to your business.

Why is vulnerability management required?

First, understand that your business will encounter a vulnerability; no system is immune. For some organizations, vulnerabilities have minimal impact. For most, the impact is anywhere from moderate to debilitating.

Left unaddressed, vulnerabilities expose your business to costly lawsuits, reputation-ending data breaches, or even closing your doors. Without the foresight to anticipate and manage vulnerabilities in a timely—and many instances preventable—manner, you leave the survival of your company up to chance.

Broadly speaking, vulnerability management has two components: investing in ISO certification, and setting up a vulnerability management system. 

Investing in ISO certification. While ISO certification isn’t required, being ISO 27001 certified demonstrates that your business has built a disciplined, systematic approach to managing sensitive data and avoiding data breaches. Certification instills trust among customers and staff as they provide sensitive PII data to your company. To get certified, you will need to create your own ISO certification checklist.

Establishing a vulnerability management system. This step is crucial for the unavoidable fact that a vulnerability will arise eventually. By establishing a risk management plan, you may be able to mitigate or even prevent serious legal and financial repercussions as a result of a vulnerability. 

What are the steps in the vulnerability management process?

Working with your security team, you can implement a comprehensive vulnerability management program that suits your organization, needs, and data infrastructure. This typically happens  in four phases:

1. Identify: The most important stage of vulnerability management is actually identifying the issue. You can identify vulnerabilities in two ways. 
   • Proactively: Many companies choose to invest in cybersecurity tools such as scanners or penetration testing tools. These vulnerability detection tools allow you to automate a cadenced, code-base audit and search for ways to break into your system to expose new vulnerabilities.  Vulnerability scanning is akin to a detective poking around for flaws in the background. When an issue is discovered, the tool will identify the vulnerability’s severity for developers to remediate accordingly. 
   • Reactively: In the absence of a cybersecurity tool, companies could identify and handle vulnerabilities on a case-by-case basis. In some cases that will require basic patching from a developer; n in other instances, much more. Most common vulnerabilities will show themselves eventually, by either a customer or employee identifying an issue. This approach is much less systematic and efficient and presents a high risk for your company—since the wrong hack or flaw can cause an incredible amount of damage as every minute passes.
2. Assess: Identified vulnerabilities range significantly in their severity, so it’s critical to have a system that assesses their impact. Start by creating a set of criteria in advance so that once a vulnerability is identified, you can assess its projected impact quickly and prioritize accordingly. 

Consider using risk ratings or a CVSS (common vulnerability scoring system) to provide more perspective. For example, a  vulnerability scanning tool or penetration testing tool may flag hundreds of results, but only a few may actually apply to your company. Risk ratings or CVSS can help you weigh the costs and benefits of each scenario: Is this vulnerability something minor that we can live with? Is it something we can patch to mitigate the impact? Or is it something that could cause us not to be ISO Compliant? And to what extent?

Start by identifying what your greatest threats are. This will involve asking yourself tough questions such as, “What’s more critical: getting our site back up, or protecting customer data? Shielding financial documentation, or exposing proprietary intelligence?” This process should help you determine which vulnerabilities are relevant to your business and actually worth fixing.

1. Remediate: Having the right vulnerability response plan (and personnel) in place for treating each vulnerability could spell the difference between intercepting a vulnerability before it’s a problem or having a substantial security breach. First, identify who the lead is on remediation. Second, identify the prioritization of that vulnerability. 

Below is a set of questions to ask as you remediate a vulnerability:

1. • Who is responsible for the part of the system that contains the vulnerability?
   • Must the issue be remediated right now, or can go into the queue? 
   • Upon remediation, does the patch need to be validated and reviewed, or can it be deployed immediately? 
   • Does anyone need to be notified, such as our customers or team? 
   • Has this vulnerability been exploited by anyone?
   • Do you need to disable the functionality of your product to remediate safely?

Regardless of the nature of your business, by creating this criteria now, you’ll have a clear plan of action for prioritizing, triaging and treating each vulnerability as it is identified and assessed. 

1. Report: You should also leverage a vulnerability risk assessment tool to run continuous checks, and to keep reports that detail which vulnerabilities were identified and how they were remediated. By flagging trends in flaws and vulnerabilities,  your team might be able to identify a greater issue in the code and build stronger code over time—protecting your software, your data, and your business from security risk. Moreover, when a vulnerability appears again sometime in the future, detailed reports provide a record of what remediation steps worked before, which ones didn’t, and how to handle the threat most effectively. 

What are the roles and responsibilities in the vulnerability management process?

The size of your security team will vary depending on the overall size of your company, but it’s critical that each step listed above has a corresponding owner (and in many cases, a team) to support it. Below are the roles and responsibilities required to carry out effective vulnerability management:

• IT Security Officer: You will need someone to own the entire information security process. This person will design your vulnerability management process, determine which tools your company invests in, champion your ISO Certification, own the reporting function, and have ultimate responsibility for the security of your IT department. 
• Vulnerability Engineer: This person is responsible for implementing, managing, and using the vulnerability scanning and penetration tools to run checks on your system. He or she is responsible for the identification of vulnerabilities, big or small.
• Vulnerability Assessment Officer: This person designs and oversees the criteria by which your company determines, ranks, and prioritizes the remediation of vulnerabilities. He or she works with the vulnerability engineer to review their scans.
• System Administrator or System Engineer: This role may often have a team of “asset owners” responsible for mitigating and remediating identified vulnerabilities according to the vulnerabilities’ severity and priority. 

Managing sensitive data comes with tremendous and inevitable risk. How your business chooses to prevent, assess, and manage that risk, however, is entirely up to you. To learn how ZenGRC can help you get ISO certified and implement a comprehensive vulnerability risk management plan, contact us today.

Because of additional regulations and standards pertaining to information security, including Payment Card Industry Data Security Standard (PCI-DSS), the General Data Protection Regulation (GDPR), Sarbanes-Oxley (SOX), the Health Insurance Portability and Accountability Act (HIPAA), California Consumer Privacy Act (CCPA) and ISO 27001, organizations are putting more emphasis on compliance as well as the auditing of their cybersecurity policies and cybersecurity controls.

Even if your company doesn’t have to comply with industry or government regulations and cybersecurity standards, it still makes sense to conduct comprehensive audits of your firewalls on a regular basis.

These audits ensure that your firewall configurations and rules adhere to the requirements of external regulations and your internal cybersecurity policy. However, these audits can also play a critical role in reducing risk and actually improve firewall performance by optimizing the firewall rule base.

Because of today’s multi-vendor network environments, which usually include tens or hundreds of firewalls running thousands of firewall rules, it’s practically impossible to conduct a manual cybersecurity audit.

That’s because when firewall administrators manually conduct audits, they must rely on their own experiences and expertise, which usually varies greatly among organizations, to determine if a particular firewall rule should or shouldn’t be included in the configuration file.

Additionally, because the documentation of the current rules and the evolution of their changes isn’t typically up to date, it takes time and resources to manually find, organize, and review all of the firewall rules to determine how compliant you are. And that takes a toll on your information security staff.

As networks become more complex, so does auditing. And manual processes just can’t keep up. As such, you should automate the process to audit your firewalls because it’s important to continually audit for compliance, not just at a particular point in time.

What is a Firewall?

Basically, a firewall is a cybersecurity tool that manages connections between different internal or external networks that can accept or reject connections, or filter them under specific parameters.

Since ISO 27001 doesn’t set the technical details, it requires the cybersecurity controls of ISO 27002 to minimize the risks pertaining to the loss of confidentiality, integrity, and availability. So you have to perform a risk assessment to find out what kind of protection you need and then set your own rules for mitigating those risks. It’s critical that you know how to implement the controls related to firewalls because they protect your company from threats related to connections and networks and help you reduce risks.

The ISO 27001 standard doesn’t have a control that explicitly indicates that you need to install a firewall. And the brand of firewall you choose isn’t relevant to ISO compliance. Rather, you must document the purpose of the control, how it will be deployed, and what benefits it will provide toward reducing risk. This is critical when you undergo an ISO audit. You’re not going to pass an ISO audit just because you picked any specific firewall.

Consequently, the following checklist of best practices for firewall audits offers basic information about the configuration of a firewall. And since ISO 27001 doesn’t specify how to configure the firewall, it’s important that you have the basic knowledge to configure firewalls and reduce the risks that you’ve identified to your network.

1. Collect Key Information Before Beginning the Audit

   Your firewall audit probably won’t succeed if you don’t have visibility into your network, which includes hardware, software, policies, as well as risks. The critical information you need to gather to plan the audit work includes:

   
   
   • Copies of pertinent security policies
   
   
   • Access to firewall logs to be analyzed against the firewall rule base so you can understand the rules that are really being used
   
   
   • An accurate diagram of your current network and firewall topologies
   
   
   • Expected system data flows and interconnections
   
   
   • Reports and documents from past audits, including objects, firewall rules, and policy revisions
   
   
   • Identification of all virtual private networks and Internet service providers
   
   
   • All the pertinent information about a firewall vendor, including the version of the operating system, the latest patches, and default configuration
   
   
   • An understanding of all the critical servers and data repositories in the network and the value and classification of each of them

   Once you’ve collected this data, your auditor has to document, store, and consolidate it to enable collaboration with your IT staff.

   
   

2. Review the Change Management Process

   You have to have a good change management process to ensure you execute the firewall changes properly and are able to trace the changes. When it comes to change control, two of the most common problems are not having good documentation of the changes, including why you need each change, who authorized the change, etc., and not properly validating the effect of each change on the network.

   When you review the procedures for rule-base change management, you should ask the following questions:

   
   
   • Are the changes that are requested going through the proper approvals?
   
   
   • Are authorized personnel implementing the changes?
   
   
   • Are you testing the changes?
   
   
   • Are you documenting the changes per the requirements of regulatory bodies and/or your internal policies? Each rule should have a comment, including the change ID of the request and the name/initials of the individual who implemented the change.
   
   
   • Is there an expiration date for the change?
   
   

   You also need to determine if you have a formal and controlled process in place to request, review, approve, and implement firewall changes. At the very least, this process should include:

   
   
   • The business reason for a change request.
   
   
   • The time period for a new or modified rule.
   
   
   • The assessment of the potential risk that’s associated with a new or modified rule.
   
   
   • The formal approval for a new or modified rule.
   
   
   • Assigning implementation to the proper administrator.
   
   
   • Verifying that the change has been tested and correctly implemented.
   
   

   In addition, you have to determine if real-time monitoring of the changes to a firewall are enabled and if authorized requestors, administrators, and stakeholders have access to notifications of the rule changes.

   
   

3. Audit the Physical and Operating System Security of the Firewall

   It’s also critical that you’re certain about the physical and software security of each firewall to protect against cyberattacks. As such:

   • Be sure that the firewall and management servers are physically secured with controlled access.
   • Ensure that you have a current list of the individuals who are authorized to access the firewall server rooms.
   • Verify that you’ve applied all the appropriate vendor patches and updates.
   • Make certain that the operating system passes common hardening checklists.
   • Review the policies and procedures for device administration.

4. Clean Up and Enhance the Rule Base

   You can significantly improve IT productivity as well as the performance of the firewall if you remove firewall clutter and enhance the rule base. In addition, enhancing the firewall rules can greatly cut down on a lot of the needless overhead in the audit process. Therefore, you should:

   • Remove the rules that aren’t really useful.
   • Identify the disabled and unused rules that should be removed.
   • Delete or disable the unused and expired rules and objects.
   • Assess the order of firewall rules for their performance and effectiveness.
   • Delete the unused connections, including source/destination/service routes, that you’re not using.
   • Identify the duplicate rules and consolidate them into one rule.
   • Pinpoint and remediate overly permissive rules by analyzing the actual policy usage against firewall logs.
   • Analyze VPN parameters to uncover unused users and groups, unattached users and groups, expired users and groups, as well as users about to expire.
   • Enforce object-naming conventions.
   • Keep a record of rules, objects, and policy revisions for future reference.

5. Conduct a Risk Assessment and Remediate Problems

   A thorough risk assessment will uncover rules that may be at risk and ensure that rules comply with relevant standards and regulations and internal policies.

   Be sure to identify all the rules that may be at risk based on industry standards and best practices, and prioritize them by how severe they are. Although the rules that may be at risk will differ for every company depending on its network and the level of acceptable risk, there are many frameworks and standards to provide you with a good reference point.

   Here are some things to look for and validate:

   
   
   • Do any firewall rules violate your security policy?
   
   
   • Do any firewall rules allow risky services from your demilitarized zone (DMZ) to your internal network?
   
   
   • Do any firewall rules allow risky services inbound from the Internet?
   
   
   • Do any firewall rules allow direct traffic from the Internet to your internal network (not the DMZ)?
   
   
   • Do any firewall rules allow traffic from the Internet to sensitive servers, networks, devices, or databases?

   You should analyze firewall rules and configurations against relevant regulatory and/or industry standards, such as PCI-DSS, SOX, ISO 27001, along with corporate policies that define baseline hardware and software configurations that devices must adhere to. Be sure to:

   • Document and assign an action plan for remediation of risks and compliance exceptions identified in the risk analysis.
   • Verify that you have correctly completed remediation efforts and any rule changes.
   • Track and document that you’ve completed the remediation efforts.

6. Ongoing Audits

   After you’ve successfully completed the firewall and security device auditing and verified that the configurations are secure, you must take the proper steps to ensure continuous compliance, including:

   • Establishing a process to continually audit the firewalls.
   • Replacing manual tasks that are prone to errors with automated analysis and reporting.
   • Properly documenting your audit procedures and providing a complete audit trail of all firewall management activities.
   • Ensuring that you have a robust firewall-change workflow in place to maintain compliance over time.
   • Ensuring that you have an alerting system in place for significant events or activities, e.g., changes in certain rules or if you identify a new, high-severity risk in your policy.

Conclusion

Firewalls are very important because they’re the digital doors to your organization, and as such you need to know basic information about their configurations. In addition, firewalls will help you implement security controls to reduce risk in ISO 27001.

During an internal International Organization for Standardization (ISO) audit, your company assesses its quality management system (QMS) to determine if it complies with ISO 9001.

Companies use the ISO 9001 standard to demonstrate that they can consistently provide products and services that meet customer needs and regulatory requirements. Organizations also use ISO 9001 to demonstrate that they are continually improving their products, services, and processes. 

An internal ISO audit often takes place during the implementation of your quality management system as well as after certification. 

An internal audit can uncover any flaws in your quality management system and identify anything you need to improve before your external ISO 9001 certification review. 

Here are some tips to help you prepare for an internal ISO 9001 audit:

Prepare Your Workers

You have to prepare your employees as well as management for this ISO audit. Be sure they’re knowledgeable about these features of your quality management system:

• • Quality policy: Review the quality policy with your employees and ensure they all understand your quality management system. 
  • Quality objectives: Ensure your employees understand your quality objectives and how they can help achieve them. 
  • Training: Properly train your employees to perform their roles according to ISO 9001 standards.
  • Documentation: Make certain that your employees and management know where they can get updated copies of documentation for work instructions, procedures, and forms pertaining to their roles and/or departments. 
  • General audit information: Let your employees know about the scope of the internal audit, when they’ll likely be audited, and what the auditor might be checking for in their business units.

• Interviews: Your employees should be able to answer the auditor’s questions honestly and confidently. However, if they’re unsure how to respond to any of the auditor’s questions, they should just say, “I don’t know.”

Review Documentation

Ensure your employees understand the documentation that pertains to their roles and departments and ensure the documentation is accurate. The following documents should be available:

• Quality policy
• Procedures
• Scope of the quality management system
• Process map or flowchart
• Quality objectives
• Work instructions
• Forms
• Records 

Before your internal ISO audit, go over your documentation to ensure:

• It’s up to date with your current quality management system
• Management has approved the documentation and your employees support it
• Leadership and employees are using the documents correctly
• You remove any obsolete or outdated documents

Ensure Everyone is Following the Procedures

Everyone in your company should follow all the procedures that your organization has implemented under ISO 9001 standards. 

Ensure your employees are aware of and follow any updated quality management system procedures pertaining to their roles and departments.

Take Corrective Actions

During an internal ISO audit, take action to fix any problems as soon as the auditor identifies them. If an auditor finds any issues during your ISO audit, he’ll allow you enough time to repair them. If you’re able to resolve the problems, you can still be certified. 

On the other hand, if the auditor discovers a problem in your quality management system that you’ve known about for some time but hasn’t resolved, you might not achieve certification. 

Consequently, it’s extremely important to address any issues uncovered in your internal ISO audits before your certification audit. Also, be sure that you verify the effectiveness of your corrective actions and that you have documentation to support that effectiveness.

Some of the most common major issues in quality management systems include:

• Not defining stakeholders
• Lack of monitoring and measurement processes
• Lack of evaluation of internal or external risks
• Lack of corrective action plans to mitigate risks
• Not recording and documenting corporate knowledge effectively
• Control of documents and data is weak

A typical corrective action plan to help address these issues includes focusing on developing clear processes to update and review your procedures.

Conduct Regular Internal Audits

If you’re performing regular internal audits, you’ll be able to uncover any issues pertaining to the requirements of ISO 9001 and fix them before your official certification audit. 

Additionally, regular internal audits help prepare everyone in your company for the ISO 9001 certification audit.

Before the Audit Ensure a Good Management Review

A good management review assesses your quality management system. Your senior management should review the following at least once a year:

• Quality policy
• Goals for the coming year
• Customer feedback
• Non-conformity issues and corrective actions
• Status of internal audits
• Changes to regulations and processes

You should document these management reviews according to the requirements of ISO 9001. It’s important to follow each review with an action plan to fix any issues identified in your quality management system during the review before the next internal audit.

Track Your Progress

The auditor will want to see documentation indicating that you tracked your progress while you were implementing your ISO 9001 quality management system. 

This includes evidence that you’ve been following your plan and meeting your business objectives. However, it’s acceptable to change your objectives if the business climate has changed since you set these goals. 

Be Professional

The ISO 9001 certification audit is critical to your company, your employees, and your customers. If you want your auditor to do his best work, it’s important that you provide him with a clean and organized workspace. 

So make an extra effort to ensure that all your organization’s work areas are clean and organized, including desks, offices, and floors. And organize all your paperwork or documentation and ensure the auditor can access it easily.

Before the official ISO audit, your managers should conduct an inspection to make certain that everything is neat and where it should be.

The External ISO 9001 Certification Audit

The last step before you receive your ISO 9001 certification is the external ISO 9001 certification audit. An external auditor will assess your quality management system and documentation to determine if you’ve complied with all the ISO 9001 requirements.

Based on these findings, the auditor will grant the certification or ask you to take certain corrective actions before he grants the ISO 9001 certification. 

Typically, the external audit takes place after you’ve successfully completed your internal ISO audit and have compiled at least two to three months’ worth of records and documentation from your ISO 9001 procedures.

The official external ISO 9001 audit is divided into three steps: the beginning meeting, the auditing process, and the ending meeting. 

Beginning Meeting

First, the leadership team and the external auditor meet to go over any notes from the management review meeting as well as your company’s quality objectives. 

During the meeting, the auditor talks about their role and the auditing schedule. The audit could take as long as a week, depending on the size of your company. 

Auditing Process

After the opening meeting, the external auditor goes over the processes of your quality management system guided by his audit schedule.

The auditor will then visit some or all of your departments to determine whether you’ve implemented the ISO 9001 requirements noted in your documentation. The auditor will conduct interviews with your employees to check whether they’re following these requirements. 

Depending on what the auditor finds, the auditor may decide to perform additional evaluation. During this step, you and your team will gain an understanding of what you’re doing well and what you need to improve. 

Ending Meeting

If your external auditor identifies any issues with ISO 9001 compliance, he will meet with your company’s management to voice his concerns. He will also let you correct these problems before you receive your ISO certification. 

Your auditor may even recommend some corrective actions based on his findings. He will include this information in an audit results report for senior leaders and employees to review.

However, if your auditor doesn’t find any major problems with your quality management system, he’ll issue the ISO 9001 certificate right after the audit.

Maintaining Your ISO 9001 Certification

An ISO 9001 certification lasts for three years, after which you must have another external audit to renew your certification. 

If you’ve maintained your quality management system successfully and you’re up to date with your internal audits, then the external audit should be pretty painless. In addition, if you’ve implemented an effective quality management system, then the improvements will be automatic, increasing your chances of maintaining certification. 

It’s worth the time, effort, and money to implement a quality management system in your company in accordance with ISO 9001 standards. 

And even though you may be intimidated by an external ISO 9001 audit process, an external ISO 9001 audit will help you learn more about your company’s strengths and weaknesses.