Deceptive IT practises put Audits at risk

Osirium (https://osirium.com) a leader in Privileged User & Infrastructure Management has today released findings from a new, independent, security focused research report.  The study was commissioned by Osirium to highlight IT practices with hidden and potentially serious consequences that would have a major impact on businesses.

The most significant and worrying finding, according to David Guyatt, CEO at Osirium,was that “over 70% of those surveyed admitted that system administrators often make uncontrolled IT changes immediately prior to audits in order to meet compliance, after which they then let these changes lapse.  If the auditors knew this was the case, they would surely fail the audit in the first place.”

These findings appear to suggest that organisations are willing to accept the risks associated with making such informal and uncontrolled changes rather than dealing directly with the costs of repeating failed audits which would also impact on resources and performance & analysis reports presented to senior management.

The report also highlights that IT staff typically spend as much as 30% of their time preparing for, and delivering, audits while less than 20% of the organisations polled fully automate the gathering of data for such audits. Fewer than 10% of those questioned said that they automate the remediation of audit gaps.

“On average IT security staff spend about 30% on their time on the mundane task of preparing for audits,” said Bob Tarzey, Analyst and Director at Quocirca. “This new research shows that in many organisations it is senior IT staff that end up manually collecting much of the required data. If the task could be undertaken automatically they would be free to focus on more productive activities.”

“All of these issues have an underlying cause which revolves around the inability of organisations to automate compliance related activities and tasks,” continues Guyatt, “The technology is already available to automate these tasks, perform internal compliance audits and remediate gaps to ensure organisations remain compliant between audits.  If they used Osirium they wouldn’t have to dedicate so much time preparing for audits and making all those informal and uncontrolled changes, which are deemed non-compliant practices anyway.”

About the Research

The research was completed by Quocirca in August 2011 and 100 interviews were collected.  At the time of answering the questions, those surveyed were not aware that the research was being conducted on behalf of Osirium.  Respondents were qualified in as follows:

• Must be involved in IT management with one of the following job functions: IT manager, IT security manager, IT infrastructure manager

Must answer yes to: “are you involved with, or knowledgeable in how your organisation views and manages issues relating to privileged users (that is how the granting of the extra privileges that IT administrators require to do their jobs is controlled), the automation of IT admin tasks and how these issues relate to your organisation’s ability to meet the regulatory requirements that govern it?”

‍