Verify before you vacate: a CISO's pre-holiday security verification checklist

With the festive season approaching, we are about to temporarily step away from work, but our responsibilities remain firmly on our shoulders. Before you set off on your travels, are you sure your existing security controls will give you peace of mind during the holidays? Do you have an appropriate action plan in place?

You may refer to the following security validation checklist to help ensure your company is in a good security posture.

1. Check and validate that critical security defenses are working properly. You need to validate and confirm that these defenses are working as expected, such as: blocking the attacks they are supposed to block; sending alerts normally; the SOC receiving and displaying alerts normally; and the IR team being able to see and handle alerts in a timely manner. If remediation is needed, develop an action plan to address current issues and prevent future failures.

2. Check logs and security events for critical systems. Review recent audit logs of relevant systems in a timely manner to keep abreast of their activity. Check for changes or attempted changes, and any potential signs of compromise. If holiday duty personnel are scheduled, arrange for them to perform periodic reviews to reduce the likelihood of major incidents going unreported. You need to validate that these duty personnel are aware of and familiar with these actions in the process.

3. Check for any major changes to your products and their corresponding security controls. While now is not the time to make major changes to EDR, SIEM systems, or other corresponding solutions, make sure you understand any automated updates that may occur during the holidays. Wait until you return from vacation to understand the impact on the overall security posture first, and then make decisions on whether to make corresponding changes to relevant products. You need to validate whether there are any capability changes before and after they are updated.

4. Understand new business directions. You should understand whether business units have introduced any new services or products prior to the holiday that expand the potential attack surface? For example, are there new websites or mobile applications (Apps) going live, or has a new version of a software product been launched? Ensure your team stays up-to-date with the latest changes. You need to validate that these newly released applications are under the protection of your security defenses.

5. Check your password policy. Password policies should not depend on your vacation status. Please complete the validation of your security defenses' capability to identify and block brute-force attacks before the holiday; additionally, please take this opportunity to ensure that existing password policies can be enforced and effectively protect the security of your various systems and user accounts. Consider reviewing length, complexity, and special character requirements, as well as expiration and reuse policies.

6. Check for any new security vulnerabilities discovered during the holidays. Perform a round of scanning using scanning tools or inspection tools before the holiday, and confirm that its regular updates (rule databases (e.g., CVE details)) are functioning normally. Then, for attacks exploiting those high-risk vulnerabilities, validate whether existing defenses can detect and block them to ensure that peripheral defenses can effectively protect applications or systems when they are not patched.

7. Check with HR for any relevant changes. Are there new employees joining the company who consequently need access to specific systems? Are there employees leaving who need their credentials revoked? Are there any other events or red flags to be aware of? You need to review and validate that these changes have been completed and are in effect.

8. Check firewall configurations. Many security experts recommend reviewing firewall configurations every three to six months, and pre-holiday is the perfect time to perform an audit. Check network traffic threat filtering detection rules, configuration parameters, and authorized administrators (along with other configurations, such as whether there are exception policies that have not yet been removed or disabled) to ensure that a reasonable configuration is currently in use. After the manual review, you likewise need to validate to determine that it is being effectively executed.

You can leverage tools or platforms to help you complete this checklist. Of course, it is best to ensure that all issues are resolved, which inevitably requires proper allocation of resources to quickly prepare and complete this work before the holiday.

Security Mandarin can help you automate and standardize the validation process, ensuring that key defense failure points are not missed. By restoring real APT attack scenarios from an attacker's perspective, it helps you validate whether your security defense system is functioning correctly. Real-time observable dashboards help you get a clearer picture of your security operations. The Security Mandarin Security Metrics Validation Platform can also provide you with risk-based mitigation and remediation recommendations. After validating a round and taking effective measures before the holiday, you can travel with peace of mind. It will help you validate another round after the holiday ends, and please continue to optimize and rectify if there are new findings.