BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Playing Russian Roulette With Your Auditor

Post by Peter McCalister May 20, 2011

Who could forget the image of Christopher Walken’s Academy Award winning performance in The Deer Hunter? Anyone who has seen that movie can not help but understand the ultimate penalty for losing at Russian Roulette. Even though the penalties aren’t quite as “life threatening” when the compliance auditor comes around, they can be “career threatening” to the IT executive who plays the same game with meeting regulatory requirements.

I’ve blogged before about the right side, wrong side and wild side of the dreaded audit, but I didn’t realize the extent of IT organizations that “pray for the best” when it comes to achieving a passing mark from their outside auditors. The misuse of privilege in any organization is absolutely in violation of most every regulation on the books today. Just run an entitlements report to see who has access to what information resources across your extended enterprise and you will immediately determine to extent of the potential problem. For those of you more interested in digging to the heart of the challenge, then I found this very cool mind-map on the “Frequently Avoided Questions About IT Auditing” in New Zealand of all places.

It also helps to understand the Information Technology Audit Process. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is recognized worldwide for providing guidance on critical aspects of organizational governance, business ethics, internal control, enterprise risk management, fraud and financial reporting and has an incredible amount of content on their site to assist with this as well.

Bottom line: don’t play Russian Roulette with your auditor as the consequences can get messy.

Leave a Reply

Additional articles

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
Tags:
, , , , ,
BI-5.1-user-asset-visibility-img

Understanding Who Has Access to What with BeyondInsight v5.1

Today, it’s my pleasure to introduce you to BeyondInsight version 5.1, the latest release of our IT Risk Management platform, which unifies several of our solutions for Privileged Account Management and Vulnerability Management. BeyondInsight v5.1 embodies BeyondTrust’s mission to give our customers the visibility they need to make smart decisions and reduce risk to their…

Post by Morey Haber April 15, 2014
Tags:
, , , , , , , , , , , ,