Security Pros Cheating During Audits?
from the oops dept
We were just discussing if a security auditor should be liable for giving a company a passing grade if there's later a security breach. Considering that it's pretty much impossible to be perfectly secure, and there were always some things that could go wrong, it seemed like a bad idea to hold auditors liable, except in situations where there was obvious fraud or gross negligence. And now, there's evidence that security professionals may try to trick auditors, raising even more questions about why auditors should be liable. Michael Scott points us to the news that a recent survey of security pros found that 20% admit to having cheated or knowing others who cheated in order to pass a security audit. Now, the phrasing can be misleading -- by saying that "they did or they know someone who did" it could (in theory) just be one guy who cheated... who happens to know a lot of other security professionals. So, it would certainly require a bit more research to determine how widespread the cheating is. It's also not clear how many times the cheating occurred. If it's every audit, that's one thing. If it just happened once and the issue was fixed, that's quite different. Still, it's more evidence that you can't just blame the auditors -- especially when the security pros at the company may not be completely truthful in providing info to the auditors.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: auditor, cheating, data breach, liability, security
Reader Comments
Subscribe: RSS
View by: Time | Thread
Regulators & Auditors
If so, are we surprised ?
[ link to this | view in thread ]
Rating the Raters
If auditors are not financially independent, then their audits aren't valid and should not be taken as authoritative and creditable, in which case they should not be liable. But if they make claims that suggest authority, then perhaps liability is appropriate!
[ link to this | view in thread ]
Well duh!
Many IT departments are corrupt. Those playing nice with the auditors are often shunned, assigned less desirable positions, or outright fired. Banks tend to be the worst, because they always have "legacy" apps running on ancient hardware that they just can't secure properly.
[ link to this | view in thread ]
In other news...
[ link to this | view in thread ]
[ link to this | view in thread ]