Keeping information systems secure is a complex calculus in today’s fast-changing landscape. Malicious attacks aren't just perpetrated by disgruntled employees or random hackers. State-sponsored or supported attacks are a constant threat to many countries, companies and individuals.
Cybercrime is difficult to contain, partly because cryptocurrencies — as opposed to normal currencies — are used to pay for ransomware and other attack tools. To protect against these modern-day threats, small and large organisations must always remain vigilant.
Vigilance requires a regular audit of information systems, the ecosystem in which they operate and a periodic review of potential threats and vulnerabilities that attackers could exploit.
Threats like these are not hypothetical or imagined; they are real. Cybercrime costs Africa $4 billion a year, according to conservative estimates. Losing $4 billion to cybercrime is a significant loss for a continent with an estimated GDP of $3 trillion.
There are more costs to cybercrime than just financial ones. An organisation's reputation can be damaged, stolen data may be too costly to recover, and so is compromised intellectual property. Additionally, when critical systems, such as national election systems, are infiltrated or manipulated, or when healthcare systems are laced with malware that causes havoc for health workers, it can pose a national crisis.
The surest way to know what lies under the hood of information systems is by carrying out regular cybersecurity audits. Cybersecurity audits test compliance with an organisation’s security policies, security safeguards and standards that an organisation has put in place.
The audit exercise is comprehensive, reviewing an organisation’s IT infrastructure. Audits ascertain that appropriate policies and procedures have been implemented and are working effectively. It helps the management to understand the security and confidentiality of the information within the system, and whether the data is accurate, reliable and timely.
This process informs the management of any weaknesses that could open the doors for malicious actors to gain access to sensitive information. It highlights poor internal practices that might result in employees accidentally or negligently breaching sensitive information; and can point out how an information system and allied processes are compromised to aid fraud.
Armed with audit findings, the management can embark on an exercise to seal any loopholes and build a moat around its critical IT systems.
It's good practice that, with increased reliance on information technology, organisations conduct cybersecurity audits annually. More frequent audits may be necessary depending on the organisation's size, the criticality of its functions and available resources.
Organisations should also conduct a cybersecurity audit whenever they make significant operational changes, such as migrating to a new system or when different systems are integrated after organisations merge.
Notably, every organisation needs a competent, relevant and effective information systems audit function to verify, report and offer guidance about the efficient functioning of the cybersecurity function.
