0

I am new to InfoSec role, and not really sure if it includes responsibility for monitoring: that's, when we write policies and procedures, who is checking whether they've been obeyed or not? Is it internal audit, is it InfoSec?

2

It can be either, depending on the purpose of the monitoring.

InfoSec needs to monitor in order to respond to issues quickly and efficiently so that risks are limited right now.

Governance, Compliance, and Audit will want to monitor in order to ensure that the controls, processes, and policies are working as intended and having the intended effect over time.

However, every organisation can have different resources and needs, and Infosec might also gather and review data for compliance and audit purposes. This is most common in small orgs with small teams where only the infosec people really understand the compliance issues and what the data means.

5
  • Thank you. This clarified a lot for me. The company I am working falls into small orgs category, even our InfoSec team is small, just three people. I'd like to ask one more question, a bit specific, so to clarify a little bit more for myself: Should InfoSec check whether IT admin passwords are stored in sealed envelope in a safe? We have a statement in our password policy stating domain admin passwords should be stored like this. But should we check that they are indeed stored as stated? I am really curious about this one. – jkwill Nov 19 '20 at 10:09
  • Anyone can check this. The one thing you need to keep in mind is "conflict of interest". You don't want to "grade your own homework". That's why auditors are a separate department. But are you asking who checks or who reviews the info collected? Audit people gather the data and present it to the owner of the policy/control/risk for them to review and act on. Audit people don't care what the answers are, just that the answers are accurate and complete. – schroeder Nov 19 '20 at 10:19
  • We've a Risk department above us, so basically we report to them. So I suppose they are the guys who reviews the info collected. I think it's more like as you said "grading our own homework." What I meant was like going to IT department, having them open the safe, checking whether there are sealed envelopes, maybe even opening them to see if there is a password note. – jkwill Nov 19 '20 at 10:29
  • Info gathering can be done by anyone if they can be trusted to provide accurate and complete data. Heck, I've roped in the janitor to check some infosec things. Who collects the data is only an issue if the person gathering the data could benefit by providing inaccurate data (conflict of interest). – schroeder Nov 19 '20 at 10:32
  • I see. In our case, I guess we're neutral, that's no conflict of interest. If IT didn't obey the policy, we would just report that. It's as if we don't have any "friendship" bonds with them. But again, it looks to me a bit more for such a small team. Last I heard we've been also required to write a procedure about what to do if incompliance is found. It feels like nobody has an understanding of infosec/audit/risk at my org. – jkwill Nov 19 '20 at 10:46
0

Agreed with the above answer. I'm new to a security role as well. In the company that I work for and part of the work that my team is involved in is creating the policies and procedures.

But, we also monitor and follow up on anything that has been logged or blocked as a result of the enforced policies.

3
  • True, in fact some part of it looks very normal to me. It's just the part that requires us to do "menial" work that doesn't look normal. Maybe it's normal, and it's just that I am newbie at InfoSec. But again, it's difficult for me to assume responsibility of visiting offices and checking nobody had sticky password notes on their desk and screen (clean desk policy). – jkwill Nov 19 '20 at 11:11
  • 1
    @jkwill Infosec can, indeed, include quite a lot of menial work. As a CISO in massive global enterprises, I also wander around looking for sticky notes every once in a while. – schroeder Nov 19 '20 at 11:41
  • @schroeder thank you so much! this bit of information is very valuable for me. – jkwill Nov 19 '20 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.