Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am going through training in information security, as a part of the course they included compliance standards like:
So after searching over Google, I came to know that it is for "IT auditors" (correct me if I am wrong).
In layman terms, what is the job of an IT auditor?
An auditor examines an organization to determine if they appear to be compliant with a particular standard or regulation. They make their findings based on evidence, often directly supplied by the organization upon request of the auditor. And they are generally independent from the organizations they audit.
In the case of a security audit, the auditor may look for evidence that the organization has a security policy, that the policy is adequate to protect them according to the standard, and that the organization follows it. That policy will state practices to be followed, such as requiring code reviews. An auditor likely won't do a code review himself, but he might look for a documentation trail that demonstrates the organization does do code reviews. The standard may also require annual penetration tests, and he will examine documents produced by the penetration testers. He might also check with the pen testing company to be sure the organization wasn't lying about having pen tests. If he doesn't see such documentation trails, he finds that the organization is out of compliance.
An auditor can't verify that an organization is secure. He can only find that an organization appears to be trying to operate in a secure manner.
For external independent auditors, please ignore the information below due to requirement for professional independence
I work as an IT Auditor. The answers above illustrate that one primary duty of an IT Auditor is verification of compliance of IT processes as as put in place by company management. However, another duty of an IT Auditor (traditional but may differ between companies), is IT risk assessment.
In this sense, the IT Auditor serves as an advisor to management. Rather than telling management what the IT shortcomings are, he/she helps management answer what are the risks posed to the business as those risks relate to IT? He or she can also assist in explaining some of the safeguards (controls) that should be in place to mitigate those risks.
In moving away from a "compliance focused" approach to IT Auditing, compliance deficiencies are often due to a bigger problem, such as a lax tone at the top or inadequately designed IT processes. While in my job, I strongly prefer to see compliance with applicable laws, regulations, and company policies, my work often goes beyond simply "checking the box" whether something is in compliance. I try to think myself as more than just enforcing the rules set by management. IT auditors and other information security professionals are often not seen as a "value add" to management of companies, due to them being linked to only pointing out what is wrong. Adding value by brainstorming solutions can also be seen as a role of an IT Auditor.
The auditor works mostly interview based whereas a pentester has a more "hands on approach". An IT Auditor mostly requests the auditees to supply him with certain deliverables. These deliverables can be documents stating how an IT process is implemented, configuration files, maintenance reports for HVAC,... . The IT Auditor will then compare this IT process with a standard or a configuration file with a baseline.
He will then perform several interviews with involved personnel and see if the corresponding process is indeed respected.
As an example for Logical Access: The auditor will check Joiners/Movers/Leavers. These are people:
This is a list he will ask from the HR department. He will then check for a sample if:
The auditor mainly looks if processes are being used and if these are followed.
An auditor verifies whether a solution (e.g. application, infrastructure, etc.) is compliant to a specified standard/law or not.
