IT Security Risk Management

Viruses, worms, trojans, and hackers are no longer the only threats that face IT departments.

Today, companies rely on IT more than ever to get business done. As a result, they face tremendous risks to the confidentiality, availability, and integrity of their information assets. New regulations require executives to protect sensitive data and ensure proper management of IT investments.

Laws like Sarbanes-Oxley, Gramm-Leach-Bliley, and HIPAA impose strict IT requirements on companies. The penalties for noncompliance are high. In addition to financial and reputational loss, some of these add the threat of stiff penalties—including jail—to ensure compliance.

L&A’s IT risk management team helps clients interpret regulations and policies and understand how they affect their businesses. We help clients prove that they have met the requirements or assist them with becoming compliant.

The team identifies business compliance requirements, evaluates compliance levels, and provides a visual risk score. Afterwards, they implement protocols to keep clients compliant. We use a consultative approach to helping mitigate IT risk that includes:

• We conduct a thorough audit of a client’s policies, procedures, and technology to assess existing measures and potential threats. Risks may include hackers, insider attacks, poor governance, and regulatory noncompliance.
• Conducting external penetration testing and internal vulnerability assessments.
• Providing a clear and easily understandable risk prioritization matrix.
• Offering specific recommendations to help mitigate the risks discovered.  These can range from new security policies to improved access control systems and stronger IT control processes.

Our team of IT risk managers is expert in a range of complex, internationally accepted frameworks that are designed to build strong and secure IT departments. Some of the frameworks we use to reduce IT risk include:

• ISO 17799 (Code of Practice for Information Security Management)
• The Committee on Sponsoring Organizations of the Treadway Commission (COSO)
• Control Objectives for Information and Related Technology (CobiT)
• Payment Card Industry (PCI) Data Security Requirements