The Dopamine of Passing the Audit
Point-in-time hardening feels like an ending, but continuous monitoring is what holds the baseline.
By Ar-Raheem Ellis, Senior Program Manager of Strategic Accounts, SteelCloud. 25.5 years in Navy cybersecurity and IT, ending as an Operations Branch Chief of the Fleet Cyber Command Office of Compliance and Assessments.
If I had to sum up the operational risk created by point-in-time hardening in one word, the word would be complacency.
Yes, it feels great to be compliant with policies, standards, and procedures when you are being audited or inspected. I have felt it. Teams work hard for that outcome and they have earned the moment. But that feeling is a dopamine driven feeling, and it should be recognized as one. The point-in-time assessment of your security posture is exactly that. A point in time.
Your Adversary Keeps a Different Calendar
Unfortunately, our adversaries operate around the clock. What does this mean in practice? It means that two days, two weeks, or two months later, if your organization does not continue to monitor the network or maintain the standard, the likelihood of exploitation increases. Maybe exponentially.
Nothing about passing an assessment changes the threat environment. It changes how your organization feels about the threat environment. Those are very different things, and the distance between them is where most breaches live.
A Pattern I Have Watched Repeat
Let us say you have a team or an organization that has dedicated the time, effort, and finances to preparing for CORA, and succeeds in passing the assessment. Everyone is happy. Leadership is satisfied with the outcome.
Does the organization go back to normal daily operations? Yes, in most cases, because the hurdle is no more. Conversations are had that sound something like this: “We’ve passed the audit, so let’s have a command potluck to celebrate.”
I want to be fair about this, because it is easy to be smug about it and that helps nobody. Many organizations do this for many different reasons. Often it has to do with competing interests. There is always a next big thing and focus and effort shift toward it. That is not negligence. That is how organizations with finite attention actually work.
But while it is easy to relate to, it does not address the problem of complacency, of confiding in the comfort of having passed an audit. Zero-day exploits still exist. Advanced persistent threats still exist. Hacktivism still exists. None of them were informed of your assessment date.
What Actually Closes the Gap
Developing and adhering to continuous monitoring is the solution. Not as a program you stand up once, but as a cadence you keep. Constant and consistent compliance is the benchmark for success.
The practical test I would offer any organization is this. Pick a random Tuesday, six weeks after your last assessment, with no inspector in the building and no audit on the calendar. Would your configuration baseline still hold? Would your scans still be current? Would the standard still be enforced on every system, or only on the ones somebody remembered?
If the honest answer is that you are not sure, that is not a documentation problem. That is a sustainment problem, and it is the subject of the rest of this series.
The certification was real. The work was real. The risk is that the organization treats an achievement as a resting point when the adversary treats it as nothing at all.
READ THE ENTIRE SERIES
Enjoyed this blog? Click on the links below to read other blogs in this series written by Ar-Raheem Ellis.
Featured Resources