Continuous Compliance: Continuous Iteration
March 21, 2019

Jonathan Eropkin
2nd Watch

Share this

For most students, exam days are one of the most stressful experiences of their educational careers. Exams are a semi-public declaration of your ability to learn, absorb and regurgitate the curriculum, and while the rewards for passing are rather mundane, the ramifications of failure are tremendous.

My educational experience indicates that exam success is primarily due to preparation, with a fair bit of luck. If you were like me in school, exam preparation consisted mostly of cramming, with a heavy reliance on hope that the hours spent jamming material into my brain would cover at least 70% of the exam contents.

After I left my education career behind me and started down a path in business technology, I was rather dismayed to find that the anxiety of testing and exams continued, but in the form of IT audits. Oddly enough, the recipe for audit success was remarkably similar: a heavy dose of preparation combined with luck.

It seems that many businesses adhere to my cram-for-the-exam IT audit approach. Despite full knowledge and disclosure of the due dates and subject material, IT audit preparation in most companies I've encountered largely consists of ignoring it until the last minute, followed by a flurry of activity, stress, anxiety and panic.

Not surprisingly, there's a better way to do this. Both simple and complex problems can often be attacked and solved through iteration, including achieving a defined compliance level in complex IT systems. Achieving audit compliance within your IT ecosystem can be an iterative process, and it doesn't have to be compressed into the five days before the audit is due. Following is a four-step process I use to guide clients through the process of preparing for and successfully completing IT audits.

1. Define

The first step is to clearly define what we are trying to achieve. Start big-picture and then drill down into something much smaller and achievable. This will accomplish two things:

■ Build some confidence that we can do this.

■ Using what we will do here, we can "drill up" and tackle a similar problem using the same pattern.

Here is a basic example of starting big-picture and drilling down to an achievable goal: we need to monitor all logs in our organization (too large); we need to monitor authentication logs in our organization (still too large); we need to monitor network user authentication logs in our organization (getting closer); we need to monitor failed network user authentication logs in our organization (bingo!).

2. Identify and Recognize

Given that we are going to monitor failed user logons, we need a way to do this. There are manual ways to achieve it but given that we will be doing this over and over, it's obvious that this needs to be automated. Here is where tooling comes into play. Spend some time identifying tools that can help with log aggregation and management, then find a way to automate the monitoring of failed network user authentication logs.

3. Notify and Remediate

Now that we have an automated way to aggregate and manage failed network user authentication logs, we need to look at our (small and manageable) defined goal and perform the necessary notifications and remediations to meet the requirement. Again, this will need to be repeated over and over, so spend some time identifying automated tools that can help with this process.

4. Analyze and Report

Now that we are meeting the notification and remediation requirements in a repeatable and automated fashion, we need to analyze and report on the effectiveness of our remedy and, based on the analysis, make necessary improvements to the process.

The iteration (repetitive process) is simple. The scope and execution of the iteration is where things tend to break down. The key to successful iterations starts with defining and setting realistic goals. When in doubt, keep the goals small. The idea here is being able to achieve the goal repeatedly and quickly, with the ability to refine the process to improve the results. No more cramming for this particular compliance requirement, we are now handling it continuously.

Jonathan Eropkin is a Managing Consultant at 2nd Watch
Share this

The Latest

August 21, 2019

For the first time, a majority of companies are putting mission critical apps in the cloud, according to the latest report by Cloud Foundry Foundation ...

August 20, 2019

The cloud continues to transform IT in every industry. But in order to migrate to the cloud, embrace these new technologies and truly evolve their business, organizations need an underlying network that can support digital transformation ...

August 19, 2019

One common infrastructure challenge arises with virtual private networks (VPNs). VPNs have long been relied upon to deliver the network connectivity and security enterprises required at a price they could afford. Organizations still routinely turn to them to provide internal and trusted third-parties with "secure" remote access to isolated networks. However, with the rise in mobile, IoT, multi- and hybrid-cloud, as well as edge computing, traditional enterprise perimeters are extending and becoming blurred ...

August 15, 2019

The configuration management database (CMDB), along with its more federated companion, the configuration management system (CMS), has been bathed in a deluge of negative opinions from all fronts — industry experts, vendors, and IT professionals. But from what recent EMA research on analytics, ITSM performance and other areas is indicating, those negative views seem to be missing out on a real undercurrent of truth — that CMDB/CMS alignments, whatever their defects, strongly skew to success in terms of overall IT progressiveness and effectiveness ...

August 14, 2019

The on-demand economy has transformed the way we move around, eat, learn, travel and connect at a massive scale. However, with disruption and big aspirations comes big, complex challenges. To take these challenges head-on, on-demand economy companies are finding new ways to deliver their services and products to an audience with ever-increasing expectations, and that's what we'll look at in this blog ...