5 ms·
> TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. Code audits and pentesting are a thing you can buy. But yes, they're ev
by the8472 6y ago
> TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive.
Code audits and pentesting are a thing you can buy. But yes, they're even more expensive. Turns out security isn't considered valuable enough for most.
- jacquesm 6y agoThat's exactly it. They're seen as an unneccesary cost because there are no real penalties for being compromised. Though this is fortunately changing, which has caused companies to begin to take this stuff more serious than in the past.
- vsareto 6y agoPay boat loads for auditors vs. paying pittances for getting pwned a few times. It's no wonder, really.
- bardworx 6y agoRight, that's exactly why the audit company isn't signing off on code audit or pen testing. They can only sign off on a simple checklist, if a caveat is listed in the financial reporting. They have no proficiency or enough people who know what they're doing. The approach is to meet the lowest common denominator set by the SEC or is expected from investors.
- number6 6y agoI am an IT person, and I put this first, and Auditor for 27001. Wouldn't say that you can't bullshit me, cause who knows all. I go in and look at the absolute basics. Like is there a person responsible for Security? What are his responsibilities? In the last 12 Months is there anything documented that proofs that he did his job? If so did the management followed through on his findings? If not why? You can fake all of this. But at some point its easier to do the job than to fake it. Well at least this is what I hope...