3 ms·
From experience many so called 'security auditor's tend not to have a clue what they're talking about technically, and operate from a playbook. They do however
by yunolisten 10y ago
From experience many so called 'security auditor's tend not to have a clue what they're talking about technically, and operate from a playbook. They do however speak the the same language as management. Buzzword bingo, spreading FUD, selling snake oil.
- cuca_de_chumbo 10y agoThis is so true. I worked for a small-time compliance software vendor where the domain expert was an incoherent mess (with all the buzzwords thrown in), the CEO couldn't discuss the software intelligibly, and the VP Engineering presented a demo video loop at a trade show booth showing theirself entering the company AWS credentials in clearly legible form. The place had so many dysfunctions I'd not know how to start. I work for a much more professional outfit now with true appreciation for security and competence. edit: there's a real gap in this non-glamorous compliance domain. if you address it and need to execute SCAP (OVAL, XCCDF) content, look to a very competent scanner vendor, jOVAL. The real challenges are in organizing and presenting consistent info across many compliance standards, OSs, cloud vendors, etc. ... and to scan entities that aren't OSs per se, and to analyze cross-domain conditions.
- pawadu 10y ago> From experience many so called 'security auditor's tend not to have a clue what they're talking about... Relevant: "How do I give our security auditor the information he wants? (2011)" https://news.ycombinator.com/item?id=12434215 https://news.ycombinator.com/item?id=12434215