Archive for February, 2008

IT Audit – What is it?

February 18, 2008

If you search on “IT Audit” you will return pages and pages of relevant hits. I have no idea how many pages you have to go out before you hit the end of relevance but it’s more than I care to read. And here I am adding one more.

How can I sort out what I need to do about IT Auditing between what the audit firms, vendors, government (regulation), upper management, and Board compliance committee are telling me to do?

I spent just enough time as an internal auditor and an external auditor in my misspent youth to have yet another opinion to express and I’m going to use a couple posts to do it.

When it comes to IT Auditing, the value that should – in theory – be derived is that an uninterested party (not you) can attest with reasonable certainty that what you SAY you are doing is actually what you are doing. Those policies you say are protecting your mission critical information? They’re actually being implemented and followed (two separate tests there) .

There’s a month’s worth of blog fodder there. But to close for today let’s drag out Rule #1 of IT Auditing. It is not possible to audit yourself. Unless you are the only person you need to satisfy with an audit.

By way of example, in Identity Management circles there is a tendency to call something an Identity Audit (IdA) tool if it creates a record of an activity executed by an Identity Management System (IdM). This would, according to Rule #1, be a valid audit if the IdA tool were completely independent of an IdM tool (not from the same vendor for example) and whose audit strategy (implementation and configuration) was controlled by an independent party from you. But most of these tools are not independent of the tool they audit and therefore are incapable of satisfying Rule #1 of Auditing. We could call them attestation tools (they attest to what was done) but they are not audit tools.


Human Error or Human Misbehavior

February 12, 2008

Many minds seem to be wondering something like this: “is an organization’s data more at risk from an insider (employee, contractor, etc) purposely doing damage or from a well intentioned employee?”

It seems to be a relative certainty that one of the two represents the largest risk to an organization’s data.  I read this article about a Deloitte survey.  To the point that 91% of those surveyed said they were worried about the risk of employee misconduct related to information technology.  I’d call 91% many minds.

When I was at Trend Micro we used to say that there would always be a virus threat as long as there were humans using computers.  It has become trite to suggest that virus writers relied on the thoughtless-but-innocent behavior of users.

But is that also true when it comes to damage done by insiders? I would hypothesize that in absolute dollar numbers the highest risk of loss due to insider behavior is probably also from the well-intentioned person trying to do their job.  I won’t elaborate here on that topic because Matt Flynn has recently done that very well in a recent discussion with IT Business Edge.

Does the distinction matter?  When talking about insider security solutions with IT professionals  many times the conversation gravitates to concerns about a few malicious people often concluding that the real need for insider security solutions is confined to a few people who are so malicious that they cannot be effectively stopped.

I suspect that if the real economic damage to organizational data from all sources could be accurately charted we would find the most compelling justification for securing against inadvertent harm from insiders.

Compliance, Identity and the SME

February 1, 2008

Matt Flynn brought this article to my attention. At the surface it covers an important topic. Typically software vendors get stars in their eyes over Fortune 1000 size clients while the vast majority of enterprises are not able to consume solutions designed for the “biggies”. So, interesting topic. But I found the premise a bit disingenuous. Particularly the line of logic expressed here by one vendor (condensed with names excised)….

“Most small to midsized enterprises have far fewer IT professionals on staff to manage the overall IT infrastructure, making the user access management issue more critical than their large counterparts,” says (XYZ), senior vice president of (Vendor).

Source: Processor Editorial Article – Automate Role Management & Identity Compliance

So far, so good. Can’t argue with that. Continue please…..

(Senor XYZ) recommends that companies seek out vendors that [also]……..have a strong consulting services capability with an implementation and management methodology that has been used successfully in the field at several different types of organizations.

Now, we’re off the reservation a bit. Having been an IT guy in a small organization (~700 users) in my very distant past I will say that if a vendor ever said, “you should buy my solution because I have good consulting services” all kinds of alarms would start going off.

My immediate response would have been, “if this solution requires vendor expertise to get it to work for me then it’s not designed for an SME like me.”

I actually think Europe is generally more forward thinking than the US enterprise in this regard. Generally, in EMEA, a key test of a product for a prospective buyer is if they can run their own Proof of Concept; No vendor Sales Engineers or consultants allowed. If the vendor insists that only one of their sale engineers or consultants can get the product working right – well, Failure Condition #1.

Admittedly most SME’s would love to get that kind of attention from any ISV. But most also know that the attention is fleeting. And when the next version of the product is released or when the use environment changes and the vendor’s solution needs to be reconfigured – good luck getting that level of attention again.

That’s not to say that an SME wouldn’t be well advised to pay a local integrator or reseller to deploy a solution for them. That’s a judicious use of resources. But any time you have to rely on the vendor to get it to work right…..that’s just an extended bout of heart-burn waiting to happen. Maybe Big Money Center Bank can invest that kind of cash resources and mindshare in a solution on an ongoing basis. But Regional Community Bank With Ten Branches probably can’t.  Or shouldn’t.