--- title: Who is guarding the gatekeepers? description: How do you verify your IT Security is doing what you think it is doing? A third party Vulnerability Assessment is a valuable tool. image: https://blog.theamegroup.com/hubfs/Imported_Blog_Media/Who-is-guarding-the-gatekeeper.jpg --- [![Logo The AME Group](https://blog.theamegroup.com/hs-fs/hubfs/AMEGroup_Basic_Logos-01-1.png?width=600&height=237&name=AMEGroup_Basic_Logos-01-1.png "Logo The AME Group")](https://www.theamegroup.com/) Open main menu Close main menu - [Contact Us](https://www.theamegroup.com/contact/) [cyber security](https://blog.theamegroup.com/tag/cyber-security) [business continuity](https://blog.theamegroup.com/tag/business-continuity) [compliance](https://blog.theamegroup.com/tag/compliance) # Who is guarding the gatekeepers? [The AME Group](https://blog.theamegroup.com/author/the-ame-group) [Share this blog post on Twitter](https://twitter.com/intent/tweet?text=I+found+this+interesting+blog+post&url=https://blog.theamegroup.com/who-is-guarding-the-gatekeepers) [Share this blog post on Facebook](http://www.facebook.com/share.php?u=https://blog.theamegroup.com/who-is-guarding-the-gatekeepers) [Share this blog post on LinkedIn](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.theamegroup.com/who-is-guarding-the-gatekeepers) This is a timeless concept from roman times, passed down in popular culture, and can be applied to your business security plan. Companies of even modest size and complexity rely on some form of IT to support their computer systems and data. Although, most companies trust their IT department or Managed Services Provider to include security as a baseline component of their work, how do you verify your IT security is dong what you THINK it is doing? A **Vulnerability Assessment** is a valuable tool. ## Trust but verify. “Fidete, sed verificate” is a famous Latin phrase: **Trust but verify**. You trust your IT department is doing their best when it comes to the security of your key computer systems and valuable data. However, when you think about their mission coupled with the rapidly increasing number of threats, it is better to exercise the “trust but verify” axiom. Have you asked your IT department how they verify the security controls they manage? Are your IT security controls configured correctly and doing the job? It is a frightening thought to consider that most network breaches are discovered 146 days after the breach occurred1. **Most companies that suffer a network breach discover it months after the breach occurred.** ## What do Security Audits and Financial Audits have in common? It is common practice to have annual financial audits completed by a third party.  The ideal engagement for a **Security Audit** is when a **third party** partners with your existing IT person/department/MSP to validate what is being done and comprehensively reviews your security controls from start to finish. This is more likely to provide an unbiased and valuable assessment.  The process must avoid any “blame game” mentality and sincerely understand how difficult it is to consistently configure and manage security controls.  A **Security Consultation** and **Security Audit** makes financial sense – it gives you the data to make informed decisions on how to invest to best meet the security needs of your business and not waste money. ## The Vulnerability Assessment Typically, The **Vulnerability Assessment** is a key component of IT Security verification; however, there is much more to this than simply running a scanning tool once a month or answering a list of questions. The process must evaluate all the **[layers of security](https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_72/rzaj4/rzaj40a0internetsecurity.htm)**, including physical, technical, and administrative controls, identify gaps that exist, and provide real steps that can be taken to improve the overall security defenses that protect your computer systems and data. The Vulnerability Assessment is a comprehensive engagement of not only internal and external network scans but examining patching success, particularly third-party **patching** which many businesses struggle to keep current2; Comparing your **policies** with what you are doing and with best practices in crucial areas like **[password management,](https://www.theamegroup.com/guide-creating-unbreakable-password/)** the principle of least **privilege**, and validation of other security mechanisms implemented at your business; Addressing your **compliance** regulations (ex. HIPAA, PCI, SOC2, CMMC).   As a result of your Vulnerability Assessment, you should have a comprehensive technical report, asset report, threat identification, prioritized **gap analysis** and a **work plan** for remediation of any vulnerabilities, and an executive briefing to summarize your overall security posture. For most businesses, a full Vulnerability Assessment should take place yearly.  Additional Internal and/or External Vulnerability Scan may be needed to validate the integrity of your network when changes occur in your environment.  Those under compliance or increased security needs, ongoing monitoring with Managed Security Services are often required. ## The Layers of Data Security ![Diagram of layers of security protection and detection, and recoverability.](https://blog.theamegroup.com/hs-fs/hubfs/Imported_Blog_Media/Prevention-Detection-Recovery-LayersV2-1024x529.png?width=1024&height=529&name=Prevention-Detection-Recovery-LayersV2-1024x529.png) --- **The AME Group [Security Services](https://www.theamegroup.com/security-compliance/) Team** believes Vulnerability Assessments should do much more than provide an automated scan of your network. The AME Group believes a comprehensive approach to performing a network vulnerability assessment provides actionable information to the IT department and the business management team. Our process identifies gaps that exist in current controls and will detail recommendations on prioritization and actions to close those gaps. **Let our years of expertise add another level of safety to your business processes.** The AME Group is also a Managed IT Services Provider but we keep our Security Services division at arm’s length to provide a level of independence between the staff that configures and maintains a network from the staff that assesses and audits the security of that same network. Whether it is a consulting engagement or as a more long-term services provider, The AME Group Security Services Team is well-prepared to assist you. > Security Consultation Services #### Risk Assessment - Asset Identification - Threat Identification - Vulnerability Scans: Internal and External - Controls Assessment: Physical, Technical, Administrative - Gap Assessment, Prioritization for Remediation #### Business Continuity and Disaster Recovery Planning - Business Impact Assessment - Recovery Point Objective: Backup Strategy - Recovery Time Objective #### Compliance - CMMC Pre-Certification Assessment - HIPAA Security Conmpliance - SOC 2 Security Preparation - Security Risk Assessment - Policies and Procedures - Business Associate Agreement Templates #### Employee Security Awareness Training - Speaker Program - PHI-Protect Breach Prevention Portal - PII-Protect Breach Prevention Portal - Phishing Campaigns - Dark Web Breach Assessment #### Incident Response and Breach Investigation - Response and Remediation plans - Communications and Management - Lessons Learned #### Virtual Chief Information Security Officer - Establish your Security Vision - Determine and Prioritize Security Initiatives - Reduce Risk with Ongoing Security Improvements 1\* https://www.infocyte.com/blog/2016/7/26/how-many-days-does-it-take-to-discover-a-breach-the-answer-may-shock-you 2\* https://www.scmagazine.com/unrelenting-rise-in-vulnerabilities-risk-based-security-reports/article/664700/ ![The AME Group](https://blog.theamegroup.com/hubfs/AME%20Branding/AME%20Issuu.png) #### The AME Group From the collective intelligence of The AME Group #### The AME Group - [About AME](https://www.theamegroup.com/company/about-ame/) - [Management](https://www.theamegroup.com/company/senior-management-team/) - [Values](https://www.theamegroup.com/company/values/) - [Partners](https://www.theamegroup.com/company/partners/) - [Blog](https://www.theamegroup.com/blog/) #### Services - [Managed Security Services](https://www.theamegroup.com/managed-security/) - [Managed IT Services](https://www.theamegroup.com/managed-services/) - [Cloud Services](https://www.theamegroup.com/cloud-services/) - [ERP Services](https://www.theamegroup.com/erp-services/) - [Software Development Services](https://www.theamegroup.com/software-development/) - [Private Cloud Hosting](https://www.theamegroup.com/private-cloud-hosting/) ### Subscribe to Monthly Technology and Security Newsletter [Follow us on Facebook](https://www.facebook.com/theamegroup) [Follow us on LinkedIn](https://www.linkedin.com/company/107749) [Follow us on Facebook](https://www.instagram.com/yourtechnologysuccesspartner/) [Follow us on Facebook](https://www.youtube.com/theamegroup)