Security & Privacy: Preliminary Checklist

Before you take a privacy-centric view of your security infrastructure, use the following attack surfaces checklist.

At my organization, there is or are:

1. Vulnerable web components
3. Expired certificates
5. Unused ports
7. Unsecured APIs that have access to customer and/or business data
9. Servers or networks that an attacker can flood with traffic in an attempt to render it inoperable
11. Lack of content filtering
13. Lack of web server hardening, which could form the entry point for hackers
15. Few or no instances of automation to detect security risks and proactively mitigate them
17. Instances of testing with live, production data
19. Test accounts shared across distinct services with no shared objectives
21. Little to no consideration of business purpose when determining service residency
23. Little to no consideration for risk affinity when considering service residency
25. Easy or widely-available access to regulatory-sensitive services (e.g., PCI, SOX)
27. Ill-defined ownership for accounts and associated applications and/or systems
29. General purpose buckets housing multiple applications and managed by multiple teams

If you checked off any of the above boxes, you have some work to do.

These attack surfaces are all the places where your organization is vulnerable to cyber threats and attacks - and these problem areas are not discrete and disconnected gaps.

Next Steps

Assess your answers and make a plan. Where are the data protection gaps? How can you engage your team of cross-functional stakeholders to move the program forward?