Speaker 1: You know, think about logging into your online bank, or
Speaker 1: maybe swiping your badge at work, getting into a secure area,
Speaker 1: or even just hopping onto the office Wi fi. We
Speaker 1: do this stuff all the time, right, but have you
Speaker 1: ever stopped to think about what's really going on behind
Speaker 1: the scenes, all the systems, the safeguards keeping things secure. Okay,
Speaker 1: let's unpack this a bit. Today we're doing deep drive
Speaker 1: into information systems auditing insecurity. And forget that old image
Speaker 1: of like a dusty account. We're talking about the guardians
Speaker 1: of our digital world. Our physical space is too. These
Speaker 1: are the pros, often with certifications like the SISA that
Speaker 1: certified Information Systems auditor who make sure our tech works
Speaker 1: and crucially work safely. Our mission really is to get
Speaker 1: inside the heads of these IS auditors. How do they think,
Speaker 1: what risks are they looking for? And maybe uncover some
Speaker 1: surprising ways they protect everything from your bank account to
Speaker 1: the building you might be sitting in right now. We've
Speaker 1: got a great cease of steady guide here as our source,
Speaker 1: which gives us a fantastic shortcut into their world.
Speaker 2: Yeah, and what's really key, I think is that it's
Speaker 2: not just about hunting for mistakes already made. It's more
Speaker 2: about understanding the whole tech ecosystem of an organization from
Speaker 2: the ground up. The goal is building resilience, proactively thinking ahead,
Speaker 2: not just reacting right.
Speaker 1: So it's not just ticking boxes on a checklist. Auditors
Speaker 1: are thinking about risk fundamentally. Our source gives us some
Speaker 1: clear ways to define it. Often it's simplified down to
Speaker 1: probability times impact. Makes sense. But there's another formula they use,
Speaker 1: maybe a bit more vivid. Risk equals A times V
Speaker 1: times T, so that's asset times vulnerability times threat. Let's
Speaker 1: break that down real quick. Asset is anything valuable, could
Speaker 1: be data, hardware, reputation, even people. Vulnerability that's a weakness
Speaker 1: the organization can often control, like sloppy coding or forgetting
Speaker 1: to patch. And threat is what might exploit that weakness,
Speaker 1: often external stuff like hackers, malware, or even a flood. Now,
Speaker 1: this AVT formula, it sounds neat, but is it always
Speaker 1: that easy to put numbers on or is there some
Speaker 1: art to it in practice?
Speaker 2: Oh, that's great point. That formula gives a solid framework, definitely,
Speaker 2: but quantifying each part that's where the skill the art
Speaker 2: comes in. It really helps auditors pinpoint inherent risk, that's
Speaker 2: the baseline risk before you put any controls in place.
Speaker 2: Then they look at the controls and figure out the
Speaker 2: residual risk, what's actually left over after those defenses. And
Speaker 2: the big picture implication here is about focus, right, You
Speaker 2: can't protect everything perfectly, so this helps channel resources attention
Speaker 2: to where the risk is highest, which makes you think,
Speaker 2: how do you assess risk in your own projects or
Speaker 2: just daily life? Do you think about both how likely
Speaker 2: something is and how bad it could be and what's
Speaker 2: left after your precautions?
Speaker 1: That makes total sense prioritization. So once you figured out
Speaker 1: the risks, you need controls. Our Guide breaks these down
Speaker 1: into types, which is really helpful for understanding how defenses
Speaker 1: get layered. Let's start with preventive controls. These aim to
Speaker 1: stop bad things before they happen. I think multi factor authentication,
Speaker 1: good firewalls, or segregating duties so one person can't do everything.
Speaker 1: Sense Are these sort of the bedrock?
Speaker 2: Absolutely, they are the foundational layer. A strong preventive control
Speaker 2: is always your best bet. Stops the problem entirely ideally,
Speaker 2: but let's be real, nothing's ever one hundred percent fool proof,
Speaker 2: so you can't just stop there.
Speaker 1: You need backups, and that's where detective controls step in,
Speaker 1: the ones that spot issues after they've happened, things like
Speaker 1: security cameras, log monitoring, maybe even having solid business continuity plans.
Speaker 2: Ready exactly, they're your warning system. If something gets past
Speaker 2: the first wall, cag.
Speaker 1: It quick, and then if something is detected, then.
Speaker 2: You need corrective controls. These are about fixing it, restoring
Speaker 2: data from a backup, patching that vulnerability someone exploited, maybe
Speaker 2: revokeing access. It's the cleanup crew, basically getting things back
Speaker 2: to a known good state.
Speaker 1: We also have deterrent controls like a simple warning CCTV
Speaker 1: and operation sign just making someone think twice. And finally,
Speaker 1: compensating controls. These are clever workarounds when the main control
Speaker 1: isn't practical, like maybe in a small company you can't
Speaker 1: perfectly segregate duty, so you compensate with really thorough log reviews.
Speaker 1: It's fascinating how they layer up. What I find really
Speaker 1: interesting is how they work together. You might have a
Speaker 1: security guard that's a deterrent outside a locked door that's
Speaker 1: preventive if someone does get through the lock. Somehow, the
Speaker 1: CCTV detective helps figure out what happened, and that leads
Speaker 1: to actions to fix the vulnerability, corrective controls. It's like
Speaker 1: this mesh of defenses. So with all these layers, what's
Speaker 1: a common mistake or trap organizations fall into when setting
Speaker 1: up controls.
Speaker 2: Well, often it's focusing too much on the tech side
Speaker 2: and forgetting the people aspect, or maybe investing heavily in
Speaker 2: say firewalls, but leaving physical security week. Auditors are always
Speaker 2: looking for those kinds of imbalances or assumptions that just
Speaker 2: one control is enough when you really need that integrated
Speaker 2: strategy that makes sense.
Speaker 1: People are often the weakest link, aren't they. Okay, let's
Speaker 1: shift focus. Now we've seen how auditors think about risk
Speaker 1: and controls. Let's apply that to something familiar. Online banking
Speaker 1: super convenient, right, But our source highlights a heavy dependence
Speaker 1: on internet service providers and naturally big cyber risks like
Speaker 1: hacking system down time and ensuring transaction integrity.
Speaker 2: Right, that convenience factor brings in dependencies on external companies
Speaker 2: which the bank doesn't directly control. That just broadens the
Speaker 2: potential attack surface. So for an auditor, that means looking
Speaker 2: closely at governance, at confidentiality, integrity, availability arrangements, how well
Speaker 2: is security testing done? And like we all experience that
Speaker 2: two factor authentication prompt, that's a classic powerful preventive control.
Speaker 2: It really helps mitigate those risks run someone just stealing
Speaker 2: your password, adds that vital second check.
Speaker 1: Okay, let's wish from digital to physical for a moment. Yeah,
Speaker 1: physical security might seem obvious locks on doors, but the
Speaker 1: guide details some pretty sophisticated layers. Beyond standard dead bolts.
Speaker 1: You've got combination locks need changing, often electronic card locks
Speaker 1: which are easy to deactivate if for card is lost,
Speaker 1: and for really critical places, biometric locks, fingerprints, iris scans.
Speaker 1: But then there's this concept I FI fascinating dead man
Speaker 1: doors or man traps. It's basically two doors in sequence.
Speaker 1: The second door won't open until the first one closes
Speaker 1: and locks behind you, and usually only one person is
Speaker 1: allowed in that little space between the doors at a time.
Speaker 1: It's a clever way to stop tailgating or piggybacking, someone
Speaker 1: sneaking in right behind someone authorized. Like physical two.
Speaker 2: Factors exactly, it forces single entry, and you combine that
Speaker 2: with things like CCTV cameras strategically placed, making sure the
Speaker 2: footage is kept long enough, maybe three months, as the
Speaker 2: guide suggests, becomes a key detective control too.
Speaker 1: And don't forget environmental controls. In places like data winners,
Speaker 1: fire suppression is crucial, but the source points out a
Speaker 1: really important safety risk with older systems like carbon dioxide
Speaker 1: or a halon. They work by reducing oxygen, which is
Speaker 1: obviously dangerous in a room where people might be working. Yes,
Speaker 1: sufifacation risk, that's right.
Speaker 2: Which is why for manned areas you now see safer
Speaker 2: alternatives like FM two hundred or argonite gas. They suppress
Speaker 2: fire without displacing oxygen to dangerous levels. It's that balance
Speaker 2: once again, protecting assets and people.
Speaker 1: So think about your own workplace for a second. What
Speaker 1: physical controls, visible or maybe hidden, are protecting things data centers,
Speaker 1: server rooms, even just your own desk. Now back to
Speaker 1: the digital world for a bit. How do we prove
Speaker 1: who we are online? Our sources talk about the three
Speaker 1: classic factors of authentication. You probably use these constantly. First,
Speaker 1: there's something you know, like your password or a pin number. Second,
Speaker 1: something you have, maybe a physical token, a smart card
Speaker 1: or that one time codes into your phone. And third
Speaker 1: something you are biometrics fingerprint, face scan, IRIS scan, and
Speaker 1: two factor authentication, which we keep mentioning just means using
Speaker 1: a combination of two of those, like that digital dead
Speaker 1: Man door for your login.
Speaker 2: It significantly boosts security, no doubt. But then you have
Speaker 2: things like single sign on sso super convenient, right, one
Speaker 2: password for lots of apps. But what's the catch. Well,
Speaker 2: the big disadvantage is it creates a single point of failure.
Speaker 2: If that one SSO password gets compromised, uh oh, an
Speaker 2: attacker potentially access everything it protects. It really highlights that
Speaker 2: constant tension between making things easy for users and keeping
Speaker 2: things secure.
Speaker 1: Good point. And what about when data gets old, we
Speaker 1: need to get rid of it securely just hitting delete
Speaker 1: on your computer? Yeah, that doesn't really cut it. Our
Speaker 1: source mentions degaussing basically using strong magnets to scramble data
Speaker 1: on magnetic media like tapes or older hard drives if
Speaker 1: you want to reuse them. But for truly ensuring data
Speaker 1: is gone forever, especially sensitive stuff, physical destruction is listed
Speaker 1: as the most effective way shredding pulverizing.
Speaker 2: Absolutely for physical media you control, destruction is definitive, But
Speaker 2: think about the cloud now or virtual machines gets more complicated,
Speaker 2: doesn't it. Auditors now have to worry about secure logical erasure,
Speaker 2: something called crypto shredding where you destroy the encryption key,
Speaker 2: or verifying the cloud provider's disposal methods. It just shows
Speaker 2: how deep this thinking has to go. Protecting data isn't
Speaker 2: just about when it's live, but also making sure it's
Speaker 2: securely retired.
Speaker 1: Okay, let's move into the network. When you think network security,
Speaker 1: you probably think firewall. But it's not just one monolithic wall.
Speaker 1: It's a system with different types doing different jobs. You
Speaker 1: start with basic packet filtering, just looking at addresses, but
Speaker 1: then you get more advanced, all the way up to
Speaker 1: application level firewalls. These are pretty smart. They don't just
Speaker 1: check the address label. They actually look inside the package,
Speaker 1: at the data content itself. Much deeper inspection, and there
Speaker 1: are special ways to set these up special components, like
Speaker 1: a bastion host. Think of it as a heavily armored
Speaker 1: guard post. It's designed to be the only system that's
Speaker 1: directly exposed to the public Internet. Everything else hides behind it, right.
Speaker 2: It takes all the direct hits theoretically, and then you
Speaker 2: have proxy servers. They act as a go between your
Speaker 2: computer talks to the proxy, the proxy talks to the Internet.
Speaker 2: This helps hide to your internal network structure and addresses
Speaker 2: from the outside world.
Speaker 1: And you combine these things the source flags, the screen,
Speaker 1: subnet firewall often called a DMZ or demilitarized zone as
Speaker 1: the most secure configure. This typically uses two firewalls, maybe
Speaker 1: routers acting as firewalls, plus a bastion host in between,
Speaker 1: creates layers.
Speaker 2: Like an airlock exactly that. DMZ is a classic example
Speaker 2: of defense and depth. You create this buffer zone. Public
Speaker 2: services like a web server might live in the DMZ,
Speaker 2: isolated from your really sensitive internal network. An attacker would
Speaker 2: have to breach multiple layers to get inside. Auditors love
Speaker 2: seeing well configured DMZs. They're checking not just that there
Speaker 2: are firewalls, but how they're configured, how they work together.
Speaker 1: Makes sense. Now, what about VPNs. Lots of us use them,
Speaker 1: especially for remote work virtual private networks. They create that
Speaker 1: secure encrypted tunnel over the public Internet, using things like
Speaker 1: tunneling protocols and ip SEC for encryption. Sound secure, but
Speaker 1: what are the risks?
Speaker 2: Well, VPNs are great for confidentiality, but they post challenges.
Speaker 2: One is that firewalls often cannot adequately examine encrypted VPN traffic.
Speaker 2: So potentially maliciou stuff could tunnel right through your perimeter
Speaker 2: defenses hidden inside that encrypted stream. Okay, and a really
Speaker 2: significant risk is the endpoint device itself, the remote computer
Speaker 2: connecting in. If that laptop is already compromised with malware,
Speaker 2: it can just send that malicious code through the VPN
Speaker 2: tunnel right into the organization's private network bypassing a lot
Speaker 2: of defenses, Which leads to the question for you, the listener,
Speaker 2: how secure is the device you use to connect via
Speaker 2: VPN and is the VPN itself configured correctly? Because poor
Speaker 2: configuration is another major risk area. Strong crypto doesn't help
Speaker 2: if the setup is leaky.
Speaker 1: Right, the tunnel might be strong, but what's going through
Speaker 1: it or where it ends up matters hugely. Okay. Finally,
Speaker 1: let's touch on Wi Fi security. Wireless is everywhere. How
Speaker 1: do we lock that down? Our source mentions some practical
Speaker 1: steps auditors look for. One is m MA filtering. This means
Speaker 1: configuring the router to only allow devices with specific pre
Speaker 1: approved hardware addresses MASc dresses to connect, kind of like
Speaker 1: a guest list.
Speaker 2: Yeah, it adds a layer. Then absolutely crucial is encryption.
Speaker 2: The guide points to WPA two as the strong standard
Speaker 2: you should be using. WPA three is even better now,
Speaker 2: but WPA two is the minimum baseline. The scrambles the
Speaker 2: data flying through the air, so eavesdroppers can't easily read it.
Speaker 1: The guide also mentions disabling SSID broadcasting. That's hiding your
Speaker 1: network name so it doesn't pop up automatically in lists,
Speaker 1: so it knows. This isn't strictly necessary unless you're maybe
Speaker 1: trying to avoid advertising a public hotspot. Security by obscurity
Speaker 1: isn't super strong on its own.
Speaker 2: True. And finally, disabling DHCP. DHCP automatically assigns IP addresses
Speaker 2: to devices joining the network. Disabling it means you have
Speaker 2: to manually configure the IP address on each device. It
Speaker 2: makes it harder for an unauthorized person to just jump on.
Speaker 2: A bit more hassle, but more control.
Speaker 1: Yeah, these are all practical things, things auditors check and
Speaker 1: things you can even check on your own home network,
Speaker 1: understanding the why behind them. So we've covered a lot
Speaker 1: of ground today, a real whirlwind tour through how I
Speaker 1: auditors think, from breaking down risk into assets, vulnerabilities and
Speaker 1: threat to building layered defenses with all those different types
Speaker 1: of controls, we've seen how just one week spot a
Speaker 1: missing control, a shared password, maybe an unpatched system can
Speaker 1: cause big problems, and how layers from physical deadman doors
Speaker 1: to complex firewall rules and VPNs work together to try
Speaker 1: and keep things safe.
Speaker 2: Absolutely, and the key takeaway, I think is that this
Speaker 2: is never static. Technology changes constantly, threats evolve, but those
Speaker 2: core principles know your assets, understand your weaknesses, layer your controls, preventive, detective, corrective,
Speaker 2: and so on, those remain essential, Which maybe leaves the
Speaker 2: final question for you, the listener. In our super tech
Speaker 2: dependent lives, are we doing enough to think like these auditors,
Speaker 2: do we really understand the why behind the security measures
Speaker 2: we use or are we just sort of clicking accept
Speaker 2: and hoping for the best.
Speaker 1: A very important question indeed. Well thanks for diving deep
Speaker 1: with us today on information systems, auditing, and security. Keep learning,
Speaker 1: keep asking those white questions, and stay curious. Hopefully you
Speaker 1: now feel a bit more informed about this really complex
Speaker 1: but vital field