So, right up front, I need to admit that I’ve been an auditor. A security auditor. Professionally. It’s time to step up and be proud, not ashamed. I am, however, dialled into a two-day workshop on compliance today and tomorrow, so this is front and centre of my thinking right at the moment. Hence this post.
Now, I know that not everybody has an entirely … positive view of auditors. And particularly security auditors[1]. They are, for many people, a necessary evil[2]. The intention of this post is to try to convince you that auditing[3] is, or can and should be, a Force for Good[tm].
The first thing to address is that most people have auditors in because they’re told that they have to, and not because they want to. This is often – but not always – associated with regulatory requirements. If you’re in the telco space, the government space or the financial services space, for instance, there are typically very clear requirements for you to adhere to particular governance frameworks. In order to be compliant with the regulations, you’re going to need to show that you meet the frameworks, and in order to do that, you’re going to need to be audited. For pretty much any sensible auditing regime, that’s going to require an external auditor who’s not employed by or otherwise accountable to the organisation being audited.
The other reason that audit may happen is when a C-level person (e.g. the CISO) decides that they don’t have a good enough idea of exactly what the security posture of their organisation – or specific parts of it – is like, so they put in place an auditing regime. If you’re lucky, they choose an industry-standard regime, and/or one which is actually relevant to your organisation and what it does. If you’re unlucky, … well, let’s not go there.
I think that both of the reasons above – for compliance and to better understand a security posture – are fairly good ones. But they’re just the first order reasons, and the second order reasons – or the outcomes – are where it gets interesting.
Sadly, one of key outcomes of auditing seems to be blame. It’s always nice to have somebody else to blame when things go wrong, and if you can point to an audited system which has been compromised, or a system which has failed audit, then you can start pointing fingers. I’d like to move away from this.
Some positive suggestions
What I’d like to see would be a change in attitude towards auditing. I’d like more people and organisations to see security auditing as a net benefit to their organisations, their people, their systems and their processes[4]. This requires some changes to thinking – changes which many organisations have, of course, already made, but which more could make. These are the second order reasons that we should be considering.
- Stop tick-box[5] auditing. Too many audits – particularly security audits – seem to be solely about ticking boxes. “Does this product or system have this feature?” Yes or no. That may help you pass your audit, but it doesn’t give you a chance to go further, and think about really improving what’s going on. In order to do this, you’re going to need to find auditors who actually understand the systems they’re looking at, and are trained to some something beyond tick-box auditing. I was lucky enough to be encouraged to audit in this broader way, alongside a number of tick-boxes, and I know that the people I was auditing always preferred this approach, because they told me that they had to do the other type, too – and hated it.
- Employ internal auditors. You may not be able to get approval for actual audit sign-off if you use internal auditors, so internal auditors may have to operate alongside – or before – your external auditors, but if you find and train people who can do this job internally, then you get to have people with deep knowledge (or deeper knowledge, at least, than the external auditors) of your systems, people and processes looking at what they all do, and how they can be improved.
- Look to be proactive, not just reactive. Don’t just pick or develop products, applications and systems to meet audit, and don’t wait until the time of the audit to see whether they’re going to pass. Auditing should be about measuring and improving your security posture, so think about posture, and how you can improve it instead.
- Use auditing for risk-based management. Last, but not least – far from least – think about auditing as part of your risk-based management planning. An audit shouldn’t be something you do, pass[6] and then put away in a drawer. You should be pushing the results back into your governance and security policy model, monitoring, validation and enforcement mechanisms. Auditing should be about building, rather than destroying – however often it feels like it.
1 – you may hear phrases like “a special circle of Hell is reserved for…”.
2 – in fact, many other people might say that they’re an unnecessary evil.
3 – if not auditors.
4 – I’ve been on holiday for a few days: I’ve maybe got a little over-optimistic while I’ve been away.
5 – British usage alert: for US readers, you’ll probably call this a “check-box”.
6 – You always pass every security audit first time, right?
Alice, Eve and Bob - a security blog 
One thought on “Confessions of an auditor”