4 ms·

Yes, I've been in fortune 100 IT security for awhile now. When it comes to passing audits its a shit ton of misdirection. Also, here is some more information a

Yes, I've been in fortune 100 IT security for awhile now. When it comes to passing audits its a shit ton of misdirection. Also, here is some more information about this breach: https://x.com/intcyberdigest/status/1973422846396473765 https://x.com/intcyberdigest/status/1973422846396473765

everdrive 1y ago
Every time I've been involved in audits at a company, my boss will tell me "let me tell you how to talk to auditors," which ends up meaning lie by omission, imply that things are in good standing without making strictly false statements, and otherwise just make the auditors go away. It all seems silly, but maybe it should be thought of like the court system? An adversarial process whereby each side is vying for its own interests?
- Spooky23 1y ago
  That’s a good point of view. 90% of the time, they are checking boxes. But if they are fishing, you have to be careful because they generally are bad at understanding anything, but good at manipulating the audit rules to frame things in such a way so they can “catch a big fish”.
- behnamoh 1y ago
  if you find it unethical, can't you leave anonymous tips for the auditers?
  - delusional 1y ago
    Sure, if you don't want a job.
  - deleted 1y ago
    [deleted]
- ExoticPearTree 1y ago
  With auditors you talk like you would either talk on a deposition or on the witness stand: do not say more than what you were asked, do not make assumptions, do not try to be helpful in any way, do not offer more data than asked for. Is it really OK? Not necessarily, but on the other hand you don't want to spend the rest of your life answering even more questions from other people the auditors might bring in to help them understand your helpful explanations. I learned this the hard way, assuming auditors are logical and understand technology.
- dijit 1y ago
  The issue is, it’s very easy to understand what’s not being said for a reasonably intelligent person. A person who is used to interviewing people will be able to tell right away.
- unethical_ban 1y ago
  That may sound bad or immoral by the company, but know that auditors have the own ambition and mo ey to think about, and will try to mark any possible thing as a serious problem regardless of whether it is. Yes, it is highly adversarial and the best compromise I've seen is to have an internal audit team that is separate organizationally from IT, but has to withstand peer review if they claim anything is a real problem.
- baobun 1y ago
  s/should/could/ Your boss is bad apple and so are you if you adopt their ways.
jandrusk 1y ago
VPN profiles? Best start revoking/renewing certs and keys. Geez, why would you store VPN profiles there?

everdrive 1y ago

Every time I've been involved in audits at a company, my boss will tell me "let me tell you how to talk to auditors," which ends up meaning lie by omission, imply that things are in good standing without making strictly false statements, and otherwise just make the auditors go away. It all seems silly, but maybe it should be thought of like the court system? An adversarial process whereby each side is vying for its own interests?

Spooky23 1y ago
That’s a good point of view. 90% of the time, they are checking boxes. But if they are fishing, you have to be careful because they generally are bad at understanding anything, but good at manipulating the audit rules to frame things in such a way so they can “catch a big fish”.
behnamoh 1y ago
if you find it unethical, can't you leave anonymous tips for the auditers?
- delusional 1y ago
  Sure, if you don't want a job.
- deleted 1y ago
  [deleted]
ExoticPearTree 1y ago
With auditors you talk like you would either talk on a deposition or on the witness stand: do not say more than what you were asked, do not make assumptions, do not try to be helpful in any way, do not offer more data than asked for. Is it really OK? Not necessarily, but on the other hand you don't want to spend the rest of your life answering even more questions from other people the auditors might bring in to help them understand your helpful explanations. I learned this the hard way, assuming auditors are logical and understand technology.
dijit 1y ago
The issue is, it’s very easy to understand what’s not being said for a reasonably intelligent person. A person who is used to interviewing people will be able to tell right away.
unethical_ban 1y ago
That may sound bad or immoral by the company, but know that auditors have the own ambition and mo ey to think about, and will try to mark any possible thing as a serious problem regardless of whether it is. Yes, it is highly adversarial and the best compromise I've seen is to have an internal audit team that is separate organizationally from IT, but has to withstand peer review if they claim anything is a real problem.
baobun 1y ago
s/should/could/ Your boss is bad apple and so are you if you adopt their ways.

jandrusk 1y ago

VPN profiles? Best start revoking/renewing certs and keys. Geez, why would you store VPN profiles there?