5 ms·

Infosec people are, by and large, auditors. Someone once told me you can understand auditors better if you assume they hate you for no reason. This advise has

Infosec people are, by and large, auditors. Someone once told me you can understand auditors better if you assume they hate you for no reason. This advise has served me well.

raesene9 5y ago
That's a pretty large generalization. There's a wide range of careers under the umbrella of what gets called Infosec. Some that really don't fit the definition of "auditor" - Vulnerability research - Pentesting - Incident Reponse - Threat Hunting Even the type of Infosec work which can end up being closer to audit should have a different focus, if done well.
- pnutjam 5y ago
  Yes, they "should", but they rarely do. My comment was largely directed at the type of infosec person any other IT person is most likely to interact with.
  - raesene9 5y ago
    I'm not sure I'd agree with "rarely". There is some cross-over with auditing, but the infosec people (in my experience) are generally more risk focused than auditors who are more "rules" focused. Also I've worked with quite a few security people who have strong technology backgrounds and have worked in IT before moving to security, so definitely understand the frustrations of operational teams.
rfoo 5y ago
In a way this is a very nice explanation of something we called "offensive mind" :)
wjnc 5y ago
Auditors don’t hate you for no reason. They have the tricky job for being (formally) responsible for signing off on practices they know too little about, get shitty documentation for while not getting enough time to understand. To make matters worse they get paid a lot, but get paid by the people they audit whom fire them for withholding signatures. Looking at firms they they think “why do they always send me the wrong documents, at the wrong time while withholding the documents I need and only bringing them up when I’ve escalated the matter to the board”. It’s a crazy relationship from both sides. Honestly, as a free market person with 15 years working with auditors I sometimes think that external audits need less market and more intervention. Then I remember most government oversight is even less effective. Every government agency (EU / NL) I know of is both awed by a big-4 rubber stamp and an avid consumer of big-4 hours. My humble conclusion is that oversight is a hard human problem.
- andrewflnr 5y ago
  > responsible for signing off on practices they know too little about... Ok, well, there's the problem. Or at least most of it. No one should be even considered to audit a system unless they understand how it works.
  - raesene9 5y ago
    Aand there's a problem :) So if you consider the size of most audit teams relative to the size of the IT departments they audit, how do the auditors become subject matter experts in all the different types of technology in use in the organization? It's a tricky problem. One option is to audit against "known standards" but that's often a horrible hack as the standards themselves need maintained and with more cutting edge technologies (think the rise of cloud native) the standards may not even have been written yet (or are hard to maintain as the underlying tech evolves so quickly) Another option is to rely on external companies (e.g. the Big-4) but they don't have any more ways of getting large pools of SMEs in all the different technologies either (despite what their sales people might tell you).

Infosec people are, by and large, auditors. Someone once told me you can understand auditors better if you assume they hate you for no reason. This advise has served me well.

raesene9 5y ago

That's a pretty large generalization. There's a wide range of careers under the umbrella of what gets called Infosec. Some that really don't fit the definition of "auditor" - Vulnerability research - Pentesting - Incident Reponse - Threat Hunting Even the type of Infosec work which can end up being closer to audit should have a different focus, if done well.

pnutjam 5y ago
Yes, they "should", but they rarely do. My comment was largely directed at the type of infosec person any other IT person is most likely to interact with.
- raesene9 5y ago
  I'm not sure I'd agree with "rarely". There is some cross-over with auditing, but the infosec people (in my experience) are generally more risk focused than auditors who are more "rules" focused. Also I've worked with quite a few security people who have strong technology backgrounds and have worked in IT before moving to security, so definitely understand the frustrations of operational teams.

rfoo 5y ago

In a way this is a very nice explanation of something we called "offensive mind" :)

wjnc 5y ago

Auditors don’t hate you for no reason. They have the tricky job for being (formally) responsible for signing off on practices they know too little about, get shitty documentation for while not getting enough time to understand. To make matters worse they get paid a lot, but get paid by the people they audit whom fire them for withholding signatures. Looking at firms they they think “why do they always send me the wrong documents, at the wrong time while withholding the documents I need and only bringing them up when I’ve escalated the matter to the board”. It’s a crazy relationship from both sides. Honestly, as a free market person with 15 years working with auditors I sometimes think that external audits need less market and more intervention. Then I remember most government oversight is even less effective. Every government agency (EU / NL) I know of is both awed by a big-4 rubber stamp and an avid consumer of big-4 hours. My humble conclusion is that oversight is a hard human problem.

andrewflnr 5y ago
> responsible for signing off on practices they know too little about... Ok, well, there's the problem. Or at least most of it. No one should be even considered to audit a system unless they understand how it works.
- raesene9 5y ago
  Aand there's a problem :) So if you consider the size of most audit teams relative to the size of the IT departments they audit, how do the auditors become subject matter experts in all the different types of technology in use in the organization? It's a tricky problem. One option is to audit against "known standards" but that's often a horrible hack as the standards themselves need maintained and with more cutting edge technologies (think the rise of cloud native) the standards may not even have been written yet (or are hard to maintain as the underlying tech evolves so quickly) Another option is to rely on external companies (e.g. the Big-4) but they don't have any more ways of getting large pools of SMEs in all the different technologies either (despite what their sales people might tell you).