Professor Tries To Get Info On Newspaper... >>
<< And, Of Course, UK ID Card Database Abused
 tdicon 

Studies

by Mike Masnick

Mon, Jun 8th 2009 8:32pm




Filed Under:
auditor, cheating, data breach, liability, security


Security Pros Cheating During Audits?

from the oops dept

We were just discussing if a security auditor should be liable for giving a company a passing grade if there's later a security breach. Considering that it's pretty much impossible to be perfectly secure, and there were always some things that could go wrong, it seemed like a bad idea to hold auditors liable, except in situations where there was obvious fraud or gross negligence. And now, there's evidence that security professionals may try to trick auditors, raising even more questions about why auditors should be liable. Michael Scott points us to the news that a recent survey of security pros found that 20% admit to having cheated or knowing others who cheated in order to pass a security audit. Now, the phrasing can be misleading -- by saying that "they did or they know someone who did" it could (in theory) just be one guy who cheated... who happens to know a lot of other security professionals. So, it would certainly require a bit more research to determine how widespread the cheating is. It's also not clear how many times the cheating occurred. If it's every audit, that's one thing. If it just happened once and the issue was fixed, that's quite different. Still, it's more evidence that you can't just blame the auditors -- especially when the security pros at the company may not be completely truthful in providing info to the auditors.

5 Comments | Leave a Comment

If you liked this post, you may also be interested in...

Reader Comments (rss)

(Flattened / Threaded)

  1.  
    icon
    Griff (profile), Jun 9th, 2009 @ 1:18am

    Regulators & Auditors

    Would this be the same situation as when a financial auditor or regulator paid 1/2 what the auditee is paid fails to discover financial shenanigans ?

    If so, are we surprised ?

     

    [ reply to this | link to this | view in thread ]

  2.  
    identicon
    Henry M, Jun 9th, 2009 @ 3:26am

    Rating the Raters

    The companies that rate stocks, bonds, and financial institutions and whose inflated ratings, largely due to the fees paid for ratings by those entities, led to the current financial crisis, claim that their ratings are merely "reporting," and "expressions of opinions," even though they are taken as authoritative, and so are protected by the first amendmentment.

    If auditors are not financially independent, then their audits aren't valid and should not be taken as authoritative and creditable, in which case they should not be liable. But if they make claims that suggest authority, then perhaps liability is appropriate!

     

    [ reply to this | link to this | view in thread ]

  3.  
    identicon
    pegr, Jun 9th, 2009 @ 6:13am

    Well duh!

    As an IT auditor for 12 years, I can say with absolute certainty that I've been lied to, manipulated, and fed half-truths.

    Many IT departments are corrupt. Those playing nice with the auditors are often shunned, assigned less desirable positions, or outright fired. Banks tend to be the worst, because they always have "legacy" apps running on ancient hardware that they just can't secure properly.

     

    [ reply to this | link to this | view in thread ]

  4.  
    identicon
    Anonymous Coward, Jun 9th, 2009 @ 6:59am

    In other news...

    water is wet.

     

    [ reply to this | link to this | view in thread ]

  5.  
    identicon
    Peeper, Jun 10th, 2009 @ 4:50am

    sand is sick? :)

     

    [ reply to this | link to this | view in thread ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Professor Tries To Get Info On Newspaper... >>
<< And, Of Course, UK ID Card Database Abused
 tdicon 
Follow Techdirt
Flattr rss rss
A word from our Sponsors...
Sponsored Resource
Essential Reading
Techdirt Reading List
Techdirt Insider Chat

A word from our Sponsors...
Recent Stories

Wednesday

11:54pm: Cool New Platform For Supporting Artists: Patreon, From Jack Conte (5)
7:53pm: Modest Proposal: Going Piracy Neutral (24)
5:00pm: DailyDirt: Graduation Advice To Remember (3)
4:32pm: New Bill Would Stop Patent Trolls From Hiding Behind Shell Companies (16)
3:26pm: Eric Schmidt Still A Fan Of Figuring Out A Way To Erase The Past (18)
2:24pm: Chinese Hacks Of Google Database Of Surveillance Targets Highlight How Dumb Technology Backdoors Are (15)
1:20pm: Released Video From Silva Beating Shows His Last Moments; Video Of Actual Beating Still Missing (65)
12:17pm: AT&T Says You Can Use Any Video Streaming App You Want... Just As Soon As It Can Get The Meter Running (18)
11:14am: Reporters Find Exposed Personal Data Via Google, Threatened With CFAA Charges (51)
10:07am: New York Times Tells Startup It Can't Even Mention The NY Times (54)
More arrow
A word from our Sponsors...

Close

Email This