Conducting a Security Audit
Practical experience with the Google Cybersecurity Certificate
Introduction
As part of the Google Cybersecurity Professional Certificate, I completed a hands-on assignment focused on conducting a security audit for a fictional company called Botium Toys. This exercise applies real-world cybersecurity principles and frameworks to simulate what an internal audit might look like in a growing small-to-medium enterprise.
Scenario
Botium Toys is a small U.S.-based toy manufacturer and retailer experiencing rapid growth due to increased online sales and expanding global operations. With this growth comes new cybersecurity challenges, including the need to protect customer data, maintain business continuity, and comply with regulations such as GDPR, PCI DSS, and other relevant security standards.
To address these concerns, the company’s IT manager has requested a comprehensive internal security audit. The goal is to identify existing vulnerabilities, assess the effectiveness of current security controls, and provide actionable recommendations to strengthen the organization’s cybersecurity posture.
Audit Objectives
The audit was conducted using the NIST Cybersecurity Framework (NIST CSF) and focused on the following areas:
- Defining the scope of the audit and understanding the organization’s business context.
- Identifying and classifying IT-managed assets, including hardware, software, and data.
- Assessing potential security risks based on likelihood and impact.
- Evaluating existing security controls across the five NIST CSF categories: Identify, Protect, Detect, Respond, and Recover.
- Reviewing regulatory compliance, including GDPR, PCI DSS, and SOC 2 guidelines.
- Providing recommendations to address gaps and enhance overall security.
Controls Assessment Checklist
❌ Least Privilege
❌ Disaster Recovery Plans
❌ Password Policies
❌ Separation of Duties
✔️ Firewall
❌ Intrusion Detection System (IDS)
❌ Backups
✔️ Antivirus Software
❌ Manual Monitoring, Maintenance, and Intervention for Legacy Systems
❌ Encryption
❌ Password Management System
✔️ Locks (Offices, Storefront, Warehouse)
✔️ Closed-Circuit Television (CCTV) Surveillance
✔️ Fire Detection/Prevention (Fire Alarm, Sprinkler System, etc.)
Compliance Checklist: PCI DSS
❌ Only authorized users have access to customers’ credit card information
❌ Credit card information is stored, accepted, processed, and transmitted internally, in a secure environment
❌ Implement data encryption procedures to better secure credit card transaction touchpoints and data
❌ Adopt secure password management policies
Compliance Checklist: GDPR
❌ E.U. customers’ data is kept private/secured
✔️ There is a plan in place to notify E.U. customers within 72 hours if their data is compromised
❌ Ensure data is properly classified and inventoried
✔️ Enforce privacy policies, procedures, and processes to properly document and maintain data
Compliance Checklist: SOC 1 & SOC 2
❌ User access policies are established
❌ Sensitive data (PII/SPII) is confidential/private
✔️ Data integrity ensures the data is consistent, complete, accurate, and has been validated
❌ Data is available to individuals authorized to access it
Recommendations to Improve Botium Toys’ Security Posture
To improve Botium Toys’ security posture and ensure confidentiality, key controls should include: Least Privilege, Access Control Policies, Password Policies, **and a Intrusion Detection System (IDS).**
To maintain data integrity, the company should: Apply Encryption and enforce Separation of Duties to prevent unauthorized changes.
To ensure availability and business continuity: Implement a robust Disaster Recovery Plan (DRP) with regular Backups.
For regulatory compliance, Botium Toys should: Reaffirm Least Privilege and Separation of Duties, classify inventoried assets to identify necessary security controls, establish regular Manual Monitoring, maintenance, and Incident Response protocols, including legacy systems.
Conclusion
This practical exercise provided valuable hands-on experience in applying cybersecurity principles to a real-world scenario. I learned how to assess risks, identify vulnerabilities, and develop actionable recommendations to improve an organization’s security posture, which is crucial for both protecting sensitive data and supporting long-term operational resilience.
