| Home | Free Articles for Your Site | Submit an Article | Advertise | Link to Us | Search | Contact Us |
This site is an archive of old articles


vertical line

8 Questions to Ask Your Security Auditor


Here at Redspin, Inc. we get asked all sorts of questions, most of which can be answered with, “Down the hall, take a left, second door on the right.” After that, here are the eight most important questions we think you should be asking your independent security auditor.

1. Are you an independent security auditor?

This is the most important question you can ask your security auditor. Are they a pure, independent auditor, or are they a company with something else to sell who also happens to do audits? You don’t want a company that sells solutions to do your security audit, because the odds that they find a problem that their solution fixes just went way up.

2. Do you do real analysis, and provide useful reports?

Beware the security auditor that gives you a 100-page report. Quantity in no way signifies quality in a security audit. What you want from a security auditor is a thorough report that focuses on issues that are relevant to you. Any security audit can find 100 trivial problems. You want an audit that tells you which 5 issues are important.

3. Do you have a quality team?

Consulting firm guys straight out of college are useful for some things, but understanding complicated computer networks and the vulnerabilities associated with them is best left to dedicated security engineers.

4. Hey, aren’t you the guys who sell us our IT?

Don’t hire the same guys who set up your system to audit your system. As much fun as it would be for them to grade their own work, you probably won’t get the most honest results from them. Be especially wary if they say that a “separate branch” of their company does the security audit, and yet another “separate branch” of their company offers solutions. This is what we like to call a “perfect storm of subjectivity.”

5. Do regulators like you?

Mostly this matters if the answer is “no.” Otherwise, it’s a nice thing if the company doing your security audit is recognized by regulators as one that does excellent work, because they’re much more likely to give you the quick okay.

6. How much do you cost, and why is that more/less than other firms?

You can pay a little, and have a guy run an automated tool that looks at everything indiscriminately and checks off some boxes. You can pay a huge amount, and get a few guys in suits from a consulting firm where this isn’t really their focus – again, they’re just there to complete a checklist. What you want is an independent security auditor who takes your business seriously, understands it completely, and can help you prioritize security risk and vulnerabilities in the context of your business.

7. Why do I need a security audit?

The easy answer is because a regulator is making you. The harder question to answer is “Why do I need a good security audit?” The answer to that depends on what industry you’re in. It’s obvious that industries like banking, casinos and e-commerce are especially attractive to mischief, and would want to make sure that their networks are completely secure. If you’re running an on-line palm reading business, maybe it’s not as big a concern.

8. Have you ever done a security audit before?

Experience counts. Make sure that your security auditor has done a number of audits, and check with some of the companies they’ve done audits for to make sure that they do good work.

Submitted by:

John Abraham

John Abraham
Redspin specializes in security audit and security assessment services, which help identify potential threats. http://www.redspin.com





ARTICLE CATEGORIES

Auto and Trucks
Business and Finance
Computers and Internet
Education
Family
Finances
Food and Drink
Gadgets and Gizmos
Health
Hobbies
Home Improvement
Humor
Kids and Teens
Legal
Marketing
Men
Music and Movies
Online Business
Parenting
Pets and Animals
Politics and Government
Recreation and Sports
Relationships
Religion and Faith
Self Improvement
Site Promotion
Travel and Leisure
Web Development
Women
Writing



http://www.articlesurfing.org/computers_and_internet/8_questions_to_ask_your_security_auditor.html
Copyright © 1995-2016 Photius Coutsoukis (All Rights Reserved).