Security Audit

Scope and goals of the audit

Scope: The scope of this audit is defined as the entire security program at Botium Toys. This includes their assets like employee equipment and devices, their internal network, and their systems. You will need to review the assets Botium Toys has and the controls and compliance practices they have in place.

Goals: Assess existing assets and complete the controls and compliance checklist to determine which controls and compliance best practices that need to be implemented to  improve Botium Toys’ security posture.

Current assets

Assets managed by the IT Department include: 

• On-premises equipment for in-office business needs  
• Employee equipment: end-user devices (desktops/laptops, smartphones), remote workstations, headsets, cables, keyboards, mice, docking stations, surveillance cameras, etc.
• Storefront products available for retail sale on site and online; stored in the company’s adjoining warehouse
• Management of systems, software, and services: accounting, telecommunication, database, security, ecommerce, and inventory management
• Internet access
• Internal network
• Data retention and storage
• Legacy system maintenance: end-of-life systems that require human monitoring 

Risk assessment

Risk description

Currently, there is inadequate management of assets. Additionally, Botium Toys does not have all of the proper controls in place and may not be fully compliant with U.S. and international regulations and standards. 

Control best practices

The first of the five functions of the NIST CSF is Identify. Botium Toys will need to dedicate resources to identify assets so they can appropriately manage them. Additionally, they will need to classify existing assets and determine the impact of the loss of existing assets, including systems, on business continuity.

Risk score

On a scale of 1 to 10, the risk score is 8, which is fairly high. This is due to a lack of controls and adherence to compliance best practices.

Additional comments

The potential impact from the loss of an asset is rated as medium, because the IT department does not know which assets would be at risk. The risk to assets or fines from governing bodies is high because Botium Toys does not have all of the necessary controls in place and is not fully adhering to best practices related to compliance regulations that keep critical data private/secure. Review the following bullet points for specific details:

The store’s physical location, which includes Botium Toys’ main offices, store front, and warehouse of products, has sufficient locks, up-to-date closed-circuit television (CCTV) surveillance, as well as functioning fire detection and prevention systems.

Currently, all Botium Toys employees have access to internally stored data and may be able to access cardholder data and customers’ PII/SPII.

Encryption is not currently used to ensure confidentiality of customers’ credit card information that is accepted, processed, transmitted, and stored locally in the company’s internal database. 

Access controls pertaining to least privilege and separation of duties have not been implemented.

The IT department has ensured availability and integrated controls to ensure data integrity.

The IT department has a firewall that blocks traffic based on an appropriately defined set of security rules.

Antivirus software is installed and monitored regularly by the IT department. 

The IT department has not installed an intrusion detection system (IDS).

There are no disaster recovery plans currently in place, and the company does not have backups of critical data. 

The IT department has established a plan to notify E.U. customers within 72 hours if there is a security breach. Additionally, privacy policies, procedures, and processes have been developed and are enforced among IT department members/other employees, to properly document and maintain data.

Although a password policy exists, its requirements are nominal and not in line with current minimum password complexity requirements (e.g., at least eight characters, a combination of letters and at least one number; special characters). 

There is no centralized password management system that enforces the password policy’s minimum requirements, which sometimes affects productivity when employees/vendors submit a ticket to the IT department to recover or reset a password.

While legacy systems are monitored and maintained, there is no regular schedule in place for these tasks and intervention methods are unclear.

Does Botium Toys currently have this control in place? 

Controls assessment checklist

Yes	No	Control	Explanation
		Least Privilege	It should be applied as all employees have access to customer data. Least privilege should be applied in order to reduce possible risks.
		Disaster recovery plans	They should be implemented in order to align with the CIA, as availability is an important aspect to consider.
		Password policies	The requirements are minimal, this could lead to an improved security risk as a threat actor could exploit this easily.
		Separation of duties
		Firewall	The firewall is correctly implemented and should help to mitigate possible risks based on their security rules.
		Intrusion detection system (IDS)	An IDS would help to reduce intrusions by detecting them and knowing when to act.
		Backups	Backups should be implemented to ensure business continuity.
		Antivirus software	It’s successfully implemented and monitored actively by the IT team.
		Manual monitoring, maintenance, and intervention for legacy systems
		Encryption	This must be included to ensure more confidentiality on sensitive information.
		Password management system	Having no control over this could lead to issues when a problem arises. So implementing it would be ideal.
		Locks (offices, storefront, warehouse)
		Closed-circuit television (CCTV) surveillance
		Fire detection/prevention (fire alarm, sprinkler system, etc.)

Does Botium Toys currently adhere to this compliance best practice?

Compliance checklist

Payment Card Industry Data Security Standard (PCI DSS)

Yes	No	Best practice	Explanation
		Only authorized users have access to customers’ credit card information.	Everyone has access to internal data, this should be avoided.
		Credit card information is stored, accepted, processed, and transmitted internally, in a secure environment.	There’s no secure environment, as any employee can access the information and encryption isn’t applied, sensitive information is at a high risk.
		Implement data encryption procedures to better secure credit card transaction touchpoints and data.	There’s no encryption. This should be required as it’s important to keep sensitive data protected as much as possible.
		Adopt secure password management policies.	There’s no password management and new and safer policies should be implemented.

General Data Protection Regulation (GDPR)

Yes	No	Best practice	Explanation
		E.U. customers’ data is kept private/secured.	Encryption should be applied to help protect customers’ data.
		There is a plan in place to notify E.U. customers within 72 hours if their data is compromised/there is a breach.
		Ensure data is properly classified and inventoried.	Assets are inventoried but not classified.
		Enforce privacy policies, procedures, and processes to properly document and maintain data.

System and Organizations Controls (SOC type 1, SOC type 2) 

Yes	No	Best practice	Explanation
		User access policies are established.	All employees have access to internally stored data.
		Sensitive data (PII/SPII) is confidential/private.	There’s no encryption in place.
		Data integrity ensures the data is consistent, complete, accurate, and has been validated.
		Data is available to individuals authorized to access it.	It’s available to everyone, and it should only be accessible by the corresponding people.

---

Recommendations:

A lot of controls must be implemented in order to improve Botium Toys’ security posture and keep sensitive information in a better position. Encryption is incredibly important, and it should be implemented as fast as possible. Information, especially the sensitive one, must be protected.

Password policies should be reinforced and management applied. This not only can help improve security but also make possible issues easier to fix.

PCI DSS should be prioritized, there isn’t a single compliance and this cannot lead only to sensitive information issues but also financial problems.