Odido. Chipsoft. Booking.com. ISO-certified, externally audited, and front page news being breached. Did YOU wake up to check the level of abstraction of such exercises?<\/p>\n\n\n\n
But the map is not the territory.<\/p>\n\n\n\n
Three organisations that made headlines in the past months for data breaches \u2013 all of them leveraging third parties to validate their security. Odido held a valid ISO 27001:2022 certificate \u2014 issued June 2024, valid until 2027. Chipsoft held ISO 27001 and NEN7510. Booking.com annually measures their security and privacy program maturity against the NIST frameworks, and engage a third party every other year to assess against these frameworks. The certificates are common practice. The auditors signed off. The dashboards were green.<\/strong><\/strong><\/p>\n\n\n\n
Reality check: Nothing is wrong with the frameworks or the certificates. They just do not check the reality of the underlying complexity \u2013 they focus on policies and procedures for a number of IT risk measures in a defined scope.<\/p>\n\n\n\n
Take the joiner-mover-leaver process which is a standard ISO 27001 control. The audit checks this process exists, documented and running. It does NOT check whether it covers every system in use in your company. Your active directory accounts get revoked within 24 hours. Check. The SaaS tools outside of AD, the shared mailboxes, the CRM account provisioned directly by a third-party vendor, and the API keys generated by the user over time – those are exceptions. Exceptions that your metric ignores, your dashboard does not show, and your auditor never checked. The certificate says nothing about them. And this is where the hacker gets in.<\/p>\n\n\n\n
This is how certifications and dashboards end up giving a false sense of security, lulling you to sleep. They abstract from a reality without checking how much of the reality is actually covered. They do not provide the detailed normative thresholds required to actually fully secure your organisation while there is a big difference between a measure like MFA and phishing-resistant MFA. The box gets checked the same for both. So the question is: what does my dashboard or audit NOT cover, and who is checking that part?<\/p>\n\n\n\n
While everyone else checked out we keep checking. Checking coverage. Checking exceptions. Do these add up to your entire organisation? Every system, every vendor, every attack path? This exercise will tell you more about your risk exposure than the green check boxes you have been looking at so far.<\/p>\n\n\n\n