I've recently begun blogging for Netwrix, and I'm sharing some of the experiences I had in taking a company from a private entity, to one that found itself faced with suddenly going public, and having SOX rear it's ugly head. Along the way, I'll talk about some of the things they look for, and some of the things we take for granted, but at the end of the day are something that can still come back and bite us.
One fo the single biggest things I leared was that we need to watch our attitudes. Too many outfits do poorly on audits simply because they approach them with the thought of it's a waste of my time. I began to realize that this was little more than a run at makig sure the basics were locked down. And while I've considered myself good in the Arenea of Network and Systems security, in the glaring light of the audit, I found myself sorely lacking.
Here's a link to my new blog, andas always, I'm interested in hearing what you have to say. In this first, I basicaly say what Pogo said, "we have meet the enemy, and he is us!"
http://blog.netwrix.com/2014/01/22/auditing-the-single-biggest-lesson-to-learn/