Information Technology Risk & Control Services

Information Technology Risk & Control Services

IT Check – Information Technology Risk & Control Assessment

We assess companies' information technology infrastructure, data security controls and digital working environments from an independent risk and control perspective.

The purpose of the engagement is not to replace existing systems or to promote the purchase of any specific technology product. The existing environment is analysed, identified risks are classified, and management is provided with an IT Check Report containing practical recommendations for improvement.

1 Device and IT Asset Inventory Review

The visibility of desktop computers, laptops and server systems used within the company is assessed.

The review may include:

• inventory of devices and hardware in use,
• operating system and software distribution,
• unauthorised or unmanaged software,
• applications that may create security risks,
• outdated or unmanaged systems,
• differences between the recorded IT inventory and actual usage.

2 Data Loss Prevention Risk Review – DLP Check

Risks relating to company data being transferred outside the organisation through employees, applications or external devices are assessed.

The review may specifically cover:

• use of USB and external storage devices,
• ability to copy files outside the organisation,
• uploading sensitive data through web applications,
• data transfers through e-mail,
• clipboard and copy/paste activities,
• uncontrolled transfer of company data outside the organisation.

3 KVKK and Sensitive Data Review

Risks arising from sensitive or personal data stored in an uncontrolled manner across company computers and data environments are assessed.

Examples may include:

• Turkish Republic identification numbers,
• IBAN information,
• credit card information,
• passport information,
• customer and employee personal data,
• contracts,
• files containing usernames and passwords,
• API keys and similar access credentials.

4 Data Leakage and File Security Review

The level of protection applied to files and folders considered critical to the company is assessed.

• the possibility of unauthorised changes to critical files,
• deletion or modification of files,
• users being able to access data beyond their authorised scope,
• critical files being transferred outside the organisation,
• whether file integrity is monitored.

Critical data areas such as accounting, finance, human resources, customer data and management documents may be prioritised.

5 Microsoft 365 and Google Workspace Security Review

Security configurations within companies' cloud-based working environments are also assessed.

Within Microsoft 365 and Google Workspace environments, the review may cover:

• accounts without multi-factor authentication (MFA),
• privileged and administrator accounts,
• external or publicly accessible sharing links,
• incorrect file and folder sharing permissions,
• third-party application and OAuth permissions,
• unused or unmanaged user accounts,
• over-privileged users.

6 Cloud and SaaS Security Review

The security configurations of cloud services and SaaS applications used by the company are assessed.

Depending on the infrastructure in use, the review may include:

• Microsoft Azure,
• Amazon Web Services (AWS),
• Microsoft 365,
• Google Workspace.

Basic security and access configurations within these and similar environments may be reviewed.

In particular, publicly accessible data repositories, over-privileged accounts and misconfigured access permissions are considered important risk indicators within the scope of IT Check.

7 User Access and Authorisation Review

One of the key information security risks is users having broader access rights than required for their roles.

Within the scope of IT Check, the following may be reviewed:

• administrator privileges,
• user access levels,
• shared accounts,
• accounts belonging to former employees,
• use of MFA,
• privileged users,
• third-party access.

8 IT Risk and Management Reporting

IT Check is not limited to technical findings.

Findings identified during the engagement may be classified from a management perspective as follows:

For each finding, the report may identify:

• current condition,
• identified risk,
• potential impact,
• recommended control,
• priority level.

The purpose of Erta IT Check is not to sell any software or technology product.

The purpose of the engagement is to assess the company's existing information technology environment, identify control weaknesses and potential risks, and develop recommendations for addressing those risks.

The fundamental question is:

“If the company's devices, data, users and cloud systems were reviewed today from an independent control perspective, what risks would emerge?”