SlideShare ist ein Scribd-Unternehmen logo
1 von 1
Downloaden Sie, um offline zu lesen
Oughta Audit Good
Roger G. Johnston, Ph.D., CPP
Right Brain Sekurity
https://rbsekurity.com
In my experience, auditing employees for mindless compliance with security rules, policies,
regulations, guidelines, and standards is often more wasteful Security Theater than it is an
effective security tool. But it is worse than that. When auditors strive to nitpick, “catch”, and
slam employees who are accused of not fully enacting security requirements mandated by high-
level bureaucrats with no understanding of the local conditions or culture, and when there is no
local sanity check on these requirements, security becomes the enemy of productivity and of
employees. Auditors and the bureaucratic secret police then come to be viewed as the enemy;
focus is taken away from worrying about the true adversaries.
What should good security auditing look like? In my view, employees should be asked to
demonstrate to auditors that they have good security. If employees wish to invoke the security
rules as part of that, so be it. But if employees have different/alternative/
additional ideas and practices that permit good local security, they should be encouraged to
point those out. Auditors should ask employees how they think their security could be
attacked, and how it can be made better, but also ways to make it less intrusive, cheaper, and
less of a hassle.
Auditing should not be about bashing heads, but be more about
praising employees when there is good security, and having cooperative
discussions about local security. This, however, requires auditors,
security managers, and organizational leaders who aren’t uninformed
authoritarian knuckleheads. And it requires recognizing that security is
always about the details and the local conditions, not about threating
employees or one-size-fits-all thinking.
For more information, see https://rbsekurity.com/papers-and-talks.html

Weitere ähnliche Inhalte

Ähnlich wie Security Audits.pdf

IntroductionThis presentation guide will.docx
IntroductionThis presentation guide will.docxIntroductionThis presentation guide will.docx
IntroductionThis presentation guide will.docx
normanibarber20063
 
1. The meaning for criteria is defined as a standard of judgement.docx
1. The meaning for criteria is defined as a standard of judgement.docx1. The meaning for criteria is defined as a standard of judgement.docx
1. The meaning for criteria is defined as a standard of judgement.docx
MargaritoWhitt221
 
AssignmentRespond to two or more of your classmates in one or m.docx
AssignmentRespond to two or more of your classmates in one or m.docxAssignmentRespond to two or more of your classmates in one or m.docx
AssignmentRespond to two or more of your classmates in one or m.docx
normanibarber20063
 

Ähnlich wie Security Audits.pdf (20)

Cracking The Employee Background Check Code.pptx
Cracking The Employee Background Check Code.pptxCracking The Employee Background Check Code.pptx
Cracking The Employee Background Check Code.pptx
 
7 Elements of a Strong Work Ethic
7 Elements of a Strong Work Ethic7 Elements of a Strong Work Ethic
7 Elements of a Strong Work Ethic
 
Rothke Patchlink
Rothke    PatchlinkRothke    Patchlink
Rothke Patchlink
 
Best Employee Screening Practices for Australian Companies
Best Employee Screening Practices for Australian CompaniesBest Employee Screening Practices for Australian Companies
Best Employee Screening Practices for Australian Companies
 
Practical Programs Of Legal Background Check - Insights
Practical Programs Of Legal Background Check - InsightsPractical Programs Of Legal Background Check - Insights
Practical Programs Of Legal Background Check - Insights
 
How candidate background checks can help you ensure authentic hires
How candidate background checks can help you ensure authentic hiresHow candidate background checks can help you ensure authentic hires
How candidate background checks can help you ensure authentic hires
 
Malicious Insiders
Malicious InsidersMalicious Insiders
Malicious Insiders
 
How to prep for and handle an osha inspection
How to prep for and handle an osha inspectionHow to prep for and handle an osha inspection
How to prep for and handle an osha inspection
 
IntroductionThis presentation guide will.docx
IntroductionThis presentation guide will.docxIntroductionThis presentation guide will.docx
IntroductionThis presentation guide will.docx
 
Pros and Cons of Employee Monitoring Balancing Oversight and Privacy.pdf
Pros and Cons of Employee Monitoring Balancing Oversight and Privacy.pdfPros and Cons of Employee Monitoring Balancing Oversight and Privacy.pdf
Pros and Cons of Employee Monitoring Balancing Oversight and Privacy.pdf
 
Speedy Programs Of Legal Background Check - A Back Ground
Speedy Programs Of Legal Background Check - A Back GroundSpeedy Programs Of Legal Background Check - A Back Ground
Speedy Programs Of Legal Background Check - A Back Ground
 
1. The meaning for criteria is defined as a standard of judgement.docx
1. The meaning for criteria is defined as a standard of judgement.docx1. The meaning for criteria is defined as a standard of judgement.docx
1. The meaning for criteria is defined as a standard of judgement.docx
 
AssignmentRespond to two or more of your classmates in one or m.docx
AssignmentRespond to two or more of your classmates in one or m.docxAssignmentRespond to two or more of your classmates in one or m.docx
AssignmentRespond to two or more of your classmates in one or m.docx
 
Behaviour in org
Behaviour in org Behaviour in org
Behaviour in org
 
Clarifying Quick Secrets Of Legal Background Check
Clarifying Quick Secrets Of Legal Background CheckClarifying Quick Secrets Of Legal Background Check
Clarifying Quick Secrets Of Legal Background Check
 
Hiring Contract Security - Common Sense and Basic Guidelines for Hiring a Sec...
Hiring Contract Security - Common Sense and Basic Guidelines for Hiring a Sec...Hiring Contract Security - Common Sense and Basic Guidelines for Hiring a Sec...
Hiring Contract Security - Common Sense and Basic Guidelines for Hiring a Sec...
 
Background screening
Background screeningBackground screening
Background screening
 
Whistleblowing for sustainable value
Whistleblowing for sustainable value Whistleblowing for sustainable value
Whistleblowing for sustainable value
 
Just wondering about professionalism in the Security Industry
Just wondering about professionalism in the Security IndustryJust wondering about professionalism in the Security Industry
Just wondering about professionalism in the Security Industry
 
Essential Criteria Of Legal Background Check Examined
Essential Criteria Of Legal Background Check ExaminedEssential Criteria Of Legal Background Check Examined
Essential Criteria Of Legal Background Check Examined
 

Mehr von Roger Johnston

Mehr von Roger Johnston (20)

In Risu Veritas: Humor & Security
In Risu Veritas: Humor & SecurityIn Risu Veritas: Humor & Security
In Risu Veritas: Humor & Security
 
Journal of Physical Security 15(1)
Journal of Physical Security 15(1)Journal of Physical Security 15(1)
Journal of Physical Security 15(1)
 
Camera Obscura and Security/Privacy
Camera Obscura and Security/PrivacyCamera Obscura and Security/Privacy
Camera Obscura and Security/Privacy
 
Vulnerability Assessment: The Missing Manual for the Missing Link
Vulnerability Assessment:  The Missing Manual for the Missing Link  Vulnerability Assessment:  The Missing Manual for the Missing Link
Vulnerability Assessment: The Missing Manual for the Missing Link
 
Journal of Physical Security 14(1)
Journal of Physical Security 14(1)Journal of Physical Security 14(1)
Journal of Physical Security 14(1)
 
Want seals with that?
Want seals with that?Want seals with that?
Want seals with that?
 
Journal of Physical Security 13(1)
Journal of Physical Security 13(1)Journal of Physical Security 13(1)
Journal of Physical Security 13(1)
 
Election Security 2020
Election Security 2020Election Security 2020
Election Security 2020
 
Security Assurance
Security AssuranceSecurity Assurance
Security Assurance
 
A New Approach to Vulnerability Assessment
A New Approach to Vulnerability AssessmentA New Approach to Vulnerability Assessment
A New Approach to Vulnerability Assessment
 
Understanding Vulnerability Assessments
Understanding Vulnerability AssessmentsUnderstanding Vulnerability Assessments
Understanding Vulnerability Assessments
 
Devil's Dictionary of Security Terms
Devil's Dictionary of Security Terms Devil's Dictionary of Security Terms
Devil's Dictionary of Security Terms
 
Vulnerability Assessments
Vulnerability Assessments  Vulnerability Assessments
Vulnerability Assessments
 
Design Reviews Versus Vulnerability Assessments for Physical Security
Design Reviews Versus Vulnerability Assessments for Physical SecurityDesign Reviews Versus Vulnerability Assessments for Physical Security
Design Reviews Versus Vulnerability Assessments for Physical Security
 
Journal of Physical Security 12(3)
Journal of Physical Security 12(3)Journal of Physical Security 12(3)
Journal of Physical Security 12(3)
 
Journal of Physical Security 12(2)
Journal of Physical Security 12(2)Journal of Physical Security 12(2)
Journal of Physical Security 12(2)
 
Unconventional Security Devices
Unconventional Security DevicesUnconventional Security Devices
Unconventional Security Devices
 
Making the Business Case for Security Investment
Making the Business Case for Security InvestmentMaking the Business Case for Security Investment
Making the Business Case for Security Investment
 
Journal of Physical Security 11(1)
Journal of Physical Security 11(1)Journal of Physical Security 11(1)
Journal of Physical Security 11(1)
 
Journal of Physical Security 10(1)
Journal of Physical Security 10(1)Journal of Physical Security 10(1)
Journal of Physical Security 10(1)
 

Kürzlich hochgeladen

Call Girls In datia Escorts ☎️7427069034 🔝 💃 Enjoy 24/7 Escort Service Enjoy...
Call Girls In datia Escorts ☎️7427069034  🔝 💃 Enjoy 24/7 Escort Service Enjoy...Call Girls In datia Escorts ☎️7427069034  🔝 💃 Enjoy 24/7 Escort Service Enjoy...
Call Girls In datia Escorts ☎️7427069034 🔝 💃 Enjoy 24/7 Escort Service Enjoy...
nehasharma67844
 
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
Chandigarh Call girls 9053900678 Call girls in Chandigarh
 
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 

Kürzlich hochgeladen (20)

The NAP process & South-South peer learning
The NAP process & South-South peer learningThe NAP process & South-South peer learning
The NAP process & South-South peer learning
 
Call Girls In datia Escorts ☎️7427069034 🔝 💃 Enjoy 24/7 Escort Service Enjoy...
Call Girls In datia Escorts ☎️7427069034  🔝 💃 Enjoy 24/7 Escort Service Enjoy...Call Girls In datia Escorts ☎️7427069034  🔝 💃 Enjoy 24/7 Escort Service Enjoy...
Call Girls In datia Escorts ☎️7427069034 🔝 💃 Enjoy 24/7 Escort Service Enjoy...
 
World Press Freedom Day 2024; May 3rd - Poster
World Press Freedom Day 2024; May 3rd - PosterWorld Press Freedom Day 2024; May 3rd - Poster
World Press Freedom Day 2024; May 3rd - Poster
 
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7
 
Chakan ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Chakan ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For S...Chakan ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For S...
Chakan ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
 
A Press for the Planet: Journalism in the face of the Environmental Crisis
A Press for the Planet: Journalism in the face of the Environmental CrisisA Press for the Planet: Journalism in the face of the Environmental Crisis
A Press for the Planet: Journalism in the face of the Environmental Crisis
 
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...
 
Finance strategies for adaptation. Presentation for CANCC
Finance strategies for adaptation. Presentation for CANCCFinance strategies for adaptation. Presentation for CANCC
Finance strategies for adaptation. Presentation for CANCC
 
Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...
Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...
Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...
 
VIP Model Call Girls Narhe ( Pune ) Call ON 8005736733 Starting From 5K to 25...
VIP Model Call Girls Narhe ( Pune ) Call ON 8005736733 Starting From 5K to 25...VIP Model Call Girls Narhe ( Pune ) Call ON 8005736733 Starting From 5K to 25...
VIP Model Call Girls Narhe ( Pune ) Call ON 8005736733 Starting From 5K to 25...
 
The Economic and Organised Crime Office (EOCO) has been advised by the Office...
The Economic and Organised Crime Office (EOCO) has been advised by the Office...The Economic and Organised Crime Office (EOCO) has been advised by the Office...
The Economic and Organised Crime Office (EOCO) has been advised by the Office...
 
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking
 
2024: The FAR, Federal Acquisition Regulations, Part 30
2024: The FAR, Federal Acquisition Regulations, Part 302024: The FAR, Federal Acquisition Regulations, Part 30
2024: The FAR, Federal Acquisition Regulations, Part 30
 
2024: The FAR, Federal Acquisition Regulations, Part 31
2024: The FAR, Federal Acquisition Regulations, Part 312024: The FAR, Federal Acquisition Regulations, Part 31
2024: The FAR, Federal Acquisition Regulations, Part 31
 
Scaling up coastal adaptation in Maldives through the NAP process
Scaling up coastal adaptation in Maldives through the NAP processScaling up coastal adaptation in Maldives through the NAP process
Scaling up coastal adaptation in Maldives through the NAP process
 
1935 CONSTITUTION REPORT IN RIPH FINALLS
1935 CONSTITUTION REPORT IN RIPH FINALLS1935 CONSTITUTION REPORT IN RIPH FINALLS
1935 CONSTITUTION REPORT IN RIPH FINALLS
 
VIP Model Call Girls Kiwale ( Pune ) Call ON 8005736733 Starting From 5K to 2...
VIP Model Call Girls Kiwale ( Pune ) Call ON 8005736733 Starting From 5K to 2...VIP Model Call Girls Kiwale ( Pune ) Call ON 8005736733 Starting From 5K to 2...
VIP Model Call Girls Kiwale ( Pune ) Call ON 8005736733 Starting From 5K to 2...
 
Call Girls Nanded City Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Nanded City Call Me 7737669865 Budget Friendly No Advance BookingCall Girls Nanded City Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Nanded City Call Me 7737669865 Budget Friendly No Advance Booking
 
Call Girls Sangamwadi Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Sangamwadi Call Me 7737669865 Budget Friendly No Advance BookingCall Girls Sangamwadi Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Sangamwadi Call Me 7737669865 Budget Friendly No Advance Booking
 
celebrity 💋 Agra Escorts Just Dail 8250092165 service available anytime 24 hour
celebrity 💋 Agra Escorts Just Dail 8250092165 service available anytime 24 hourcelebrity 💋 Agra Escorts Just Dail 8250092165 service available anytime 24 hour
celebrity 💋 Agra Escorts Just Dail 8250092165 service available anytime 24 hour
 

Security Audits.pdf

  • 1. Oughta Audit Good Roger G. Johnston, Ph.D., CPP Right Brain Sekurity https://rbsekurity.com In my experience, auditing employees for mindless compliance with security rules, policies, regulations, guidelines, and standards is often more wasteful Security Theater than it is an effective security tool. But it is worse than that. When auditors strive to nitpick, “catch”, and slam employees who are accused of not fully enacting security requirements mandated by high- level bureaucrats with no understanding of the local conditions or culture, and when there is no local sanity check on these requirements, security becomes the enemy of productivity and of employees. Auditors and the bureaucratic secret police then come to be viewed as the enemy; focus is taken away from worrying about the true adversaries. What should good security auditing look like? In my view, employees should be asked to demonstrate to auditors that they have good security. If employees wish to invoke the security rules as part of that, so be it. But if employees have different/alternative/ additional ideas and practices that permit good local security, they should be encouraged to point those out. Auditors should ask employees how they think their security could be attacked, and how it can be made better, but also ways to make it less intrusive, cheaper, and less of a hassle. Auditing should not be about bashing heads, but be more about praising employees when there is good security, and having cooperative discussions about local security. This, however, requires auditors, security managers, and organizational leaders who aren’t uninformed authoritarian knuckleheads. And it requires recognizing that security is always about the details and the local conditions, not about threating employees or one-size-fits-all thinking. For more information, see https://rbsekurity.com/papers-and-talks.html