How To Not Make IT Audits a Nightmare, with Matt Huffman

alien. Some people are saying it's remains from 2000 years ago, I saw someone post that it's actually just a cake underneath everything. So will there be aliens on Earth? It remains to be seen. Wonder what technology the aliens are using these days. That's that's what's new with me. How about you, Keith?

successful result. So Matt, welcome to the podcast.

leeway for that. And the auditors were, were very good, they had a lot of stuff in place, you know, I did have a consultant that I was using as well. So that first year, I got it done, you know, the audit took about 8 to 10 hours. And, you know, they, they taught me a lot, I learned a lot, and they kind of just said, like, you know, kudos to me for picking it

up and everything like that. The customer was no longer interested, they ended up using us anyways, they didn't really, you know, they were forward thinking, but it didn't matter to them, they just brought it up as maybe a discussion point. But the organization thought, hey, we're dealing with a lot of financials, let's keep this

going. So with that, knowing that I was going to have to do this again, I started looking at a lot of the stuff that I had to do, you know, and the, the type of audit that we were going to through was just a point in time audit. So they come in, and it's the type two, where they just come in, no SOC 2, type one, where they come in, and it's like on this day, everything was XY and Z. Whereas the type two is they give you a period of time, and all your examples, and all your samples all have to be

within that period and work. So knowing that I had to keep everything going, I started putting things out there as far as you know, reminders, upgrading documentation, always looking at policies and procedures. And the auditors were, were very good about allowing me to stay in touch with them and ask them questions. You know, when the new things were changing, they were letting me know, so I kind of get ahead of some of that.

And then over the years, really, it's it's set it and forget it, you start doing this stuff, and it becomes just sort of part of your job, you're building the documents. You know, some of my first policies were very crude and rudimentary, they might have been two or three bullet points. But over the years, you start learning to build and you find another document and Hey, I could use this for this and you start to you know, intermingle some of the wording and you poach from different things that

you see online. It's a lot easier nowadays with ChatGBT. I've just started using that for other smaller things, using it as a tool, less of an out of the box solution, which I think it has its place for things like that. But yeah, I ended up doing those audits for almost a decade and passing them and getting them down to only a couple hours, you know, the auditors were very happy when they saw our company come up to do because they knew it was going to be an easy fast job, and that

I'd have everything. Eventually, I parlayed that into a job as an auditor. And I saw how difficult and how bad a lot of clients were. And especially with it was hard for me to go to an organization and see that they had an IT team of 10 to 12 and they could not give me everything I needed where I knew like hey, I've done this, I could do this. But eventually, you know the love of IT and problem solving and turning an organization around brought me back to the field and to Reinders.

auditor?

day to day stuff. So that really threw me off. And it surprised me because I would see guys doing things like, you know, they could just do this or this and get away with it with this or that and, you know, find the ins and outs and that surprised me the most, you know, seeing that they weren't really full on IT people, where the organization would reserve those kind of people for their pentesting or for you know, their their MSP services. So that really threw me off from

that. The amount of searching and documentation and just the leeway that they give people. That was to me, like you said, I'm very efficient. So I'm just like, what are we doing here? Let's go.

associate that with audits. But wouldn't you agree, that's kind of part of being a good in an organization that documents and has great process and control like, that's part of what makes the audit easier is if you're organized, and you document and you retain documents correctly, that makes audits easier, but I think people view audits as like, I get prepared and do all this stuff. You shouldn't have to if you're organized.

evidence. You could copy that folder and make, you know, reminders on every piece of evidence that you've provided, you know, whether it's, Hey, this is a screenshot of an application, I just got to make sure this application runs weekly, I get this report daily, I create a work order or a change management, you know, I get this approved through this person, I get that approved through that person. And it's really just once you get it

going, it runs itself. But you have to recognize that and want to keep doing that. Like you said, I mean, it's it's not difficult, no audit is difficult, the auditor doesn't want to fail you, you know, they're there to work with you, when you talk to these auditors and you go over your controls.

That's one of the things that I learned, you know, through, you know, a few years in is, the control is really and you can, you can mold those and manipulate those to fit your, you know, maybe you don't want to go so tight on the screws for security. As long as you're able to mitigate and you know, have those risk appetites and things, you can you can loosen up a little bit and still meet the

control. But a lot of people when they see that might get frightened and think, Oh, I've got to have xy and z like, Well, no, you can have x and z and you just, you know, you mitigate y with this. And you just have to document it and show that.

beast. But like, with all the requirements now for continuous monitoring, logging, active remediation and review, do you think that some portions of audits are really not as valid anymore as they used to be because we have so much real time monitoring? Or do you still

think that like some of that, like, log review controls and continued like, you know, signing off on things, do you still think that that's valid in 2023?

be used against you. So the more visibility into environment is not going to be, I don't ever find that being something that's going to be a negative. The one thing that I would say is that there are a lot of IT people out there who will stay in an environment where they're not getting, you know, the nourishment they need, and

they're okay with that. And to me, that's a I don't understand that, you know, I put value on what I do and what I bring, and, you know, it may not be here and it may not be there, but it's going to be somewhere and, you know, I'm always investing in myself and you know, we talked about those efficiencies. You know, I was at a spot where I feel like I could have coasted, I had it like I said running autopilot. And you know that could have been the end for me,

but it wasn't, it wasn't. I wasn't ready for that, you know, and here I am taking on a new challenge where I've got a place that is in the spot that needs a lot of help. And my goal is to get us audit ready. So if we ever did have any kind of audit, we're ready to go.

with this thing. And sometimes it's like, oh, that was nothing. You know, it's, it's literally, you know, it's like, oh, we've got to get this giant security policy, well, not really. Start it small, your auditor is going to be able to, you know, you're going to have some time to send that to them and say, Here, here's this, and they're gonna give you some feedback and let you know what it's missing. And, you know, it's like anything, you take that feedback, and you

make the adjustments. And I think it's just, it's about tackling it. There's, you know, like I said, some of these IT, people, I mean, I've been on audits where they've, I've asked them about, you know, two factor. Well, we don't have that turned on. Well, why not? Well, they haven't sent me up for training for that. You don't need to train for that, you know, I mean, it's, it's pretty simple to set that up and turn

it on. And it's really it comes down to, I think there's still a lot of old school mentality out there with IT as well, a lot of keeping things to ourselves, you know, things are siloed. So there's, there's a big change coming, and you know, people are going to fall by the wayside, and other people are going to either grow and learn, and some

are just going to take off. So I think the fear is the biggest thing for the audits, the fear and the, the fear of the unknown, and like I said, it's really not unknown, it's starting small and it grows, you just keep going.

what. You're, you're creating, and documenting, you know, tracking work orders is huge, you know, having those, you know, security incident categories, change management categories, having, you know, if you are a solo IT person, don't make all the decisions, you know, send that off to, you know, the CEO or the CIO to make that final decision, because then it shows, you know, there's, there's a process, you know, and, and it can just be

documented, you know. When XYZ happens, it goes through me, and then it goes to this person for approval. And it's as small as that sometimes you don't need a board and you don't need, you know, meetings every month and people to go through certain things it can, again, this has that flexibility and the controls where you can make some of that happen yourself. Yeah,

purpose. And so what's interesting is like what you're basically talking about, it's just good IT and honestly, business practices of document, prepare, plan, remediate, work on fixing things, like that's just the whole point of an audit is just check in at a point in time and say, Where are we, right? So I love what you're saying. I've seen more recently and I'm curious, your thoughts

on this trend. We're seeing a lot of, especially in the cybersecurity auditing space, which, you know, for those of you who have not gone through it, the listeners out there, a lot of this is being driven from insurance at this point, cyber insurance questionnaires, maybe

audits. We're seeing, at least in in in some subsets of customers, using cybersecurity audits as a as a jump off point basically to ask for better processes, more investment in certain things and I think what we see is a lot that you mentioned, I forget if it was pre-recording or after we turned on recording, but you're working with a kind of turning around IT

and, and making it better. In that situation, one of the easiest ways to do that is show a bad audit, show a bad result and say, Hey, here's what we need to do to do that. And I'm curious, like what you think of that, that using an audit as that jumping off point? And then where do you go from there, when you do go to try to turn around and make things better?

well. You know, they're throwing a bunch of things on paper and when it comes down to it, and you have to call that in, that is when they're going to actually do their due diligence and look for something that you might be out of the loop on that you didn't know, that's not on that paper and really, really going back to them asking them the questions. You know, it's that's not a to me, those are

also controls. When we got that cyber insurance paperwork, I sent that back, I had questions I had, you know, what are you doing for this? What are you covering for that? What are you asking by with this question. But using, using that if you if you aren't part of an organization that is doing an audit, use that cyber insurance document as your audit, use that. Come back to the organization and be like, Look, they're saying this, which doesn't cover that, you know.

You might have an organization that decides, hey, you know, we're, we're selling widget ABC here, we want to throw in this little other tool that has nothing to do with the organization, but we think

companies will like it. But that company and that division is run by, you know, a family member and it's not following any of the rules and you want to make sure you have that locked in, you know, if you're going to say like, look, that's none of that is covered under our audit, and that is wide open, they're running their own devices, they're doing their own stuff.

Like, you have to be able to recognize that and you know, like you said, utilize that cyber insurance, to say like, look, we want to get this in place, we want to put these in place, we want to start building policies, procedures, software security. I think that is a good

jump off. And even, you know, one of the things that I would do too, is my my CIO at the time, I was, well not CIO, I have a CIO here, but the CEO and the COO, I would send them notifications every week, Hey look who got breached, look who got breached. And it didn't have to be big breaches, it was little breaches, because a lot of times you'll get that mentality from the C-levels and the execs like, well, we're only a $30 million company, why would

they come after us? Well, they're not coming after a $30 million company, they went to an IP range or a scope of IPs and they found what they could get, what was vulnerable. And a lot of times, you could be a pivot point. And I had to explain to them like we are, maybe they don't come to us, but we are a pivot point to all our clients who are larger than us. You know, so they, they need to see some things like that sometimes.

easy. One of our favorite topics on this podcast with just all of our guests is the theme around AI. You mentioned it earlier,

like writing policies with with ChatGBT or Bard. How should people consider using AI for you know, policies? What are some other ideas people can use AI for in helping them with audits?

gonna be great. And it was good. So I was very proud of it, you know, I put a lot of work in. But then yeah, I got to a position like this again and I'm just like, you know, where were these emails? You know, you want to, you wish you'd go back and find your old stuff because you're like, I've spent so much time on it and I worded at it and so you make a rough draft and then it wasn't cutting it and I'm just like, Alright, let me give it a go. So I started throwing things into ChatGPT.

And, you know, whether it be an email telling everybody Hey, this is how we're going to start doing our phishing training or, you know, a small mobile device policy, you don't want to start, you know, you can finagle, you know, you can, it's, it's awesome what you can do. You can say, hey, less words, more words, put in three bullet points, take out five, you know, and it's, it really is a good tool, but what I do, you know, I haven't gone where it comes

right out of the box. I will create what I want, throw it in there, have it zhuzh it up, then I'll clean it up. And then, you know, I still I have the final oversight on it. So I think people need to use it like that, I think that's going to be the best way. I do see people using it for coding, I have not done any of that yet. For auditing, it's definitely good to, like I said the policies and procedures, I guess I really would have to look more to see what else I could do with it.

You know, I don't know if it does reminders for you, if you want to have ChatGPT, create some kind of scheduling, you could have it do something like that, you know, maybe put in your team, their skill set and see if they can do any kind of assigning. That would be a good, a good way to test it out as well.

for school. I was in school for firefighting, and I've had that thing in a sleeve inside another sleeve in a backpack. Like it was my first computer, I, you know, didn't know what to do with it, I treated it with, you know, like gold. And you know, a year later, I'm pulling it apart and doing everything I can. So I still remember how it felt. And I remember, you know, looking at a computer not knowing what to

do. So I tried to break things down for my users, and I try not to get too far above their heads. And I want them to feel comfortable with technology. So that's one thing I've always done. And one thing that ChatGPT does, it doesn't know how to do that. So I do know how to myself tone it down and kind of put it in, you know, take out some of the, you know, the the buzzwords it likes to use and things like that or any like I said when it gets too far down any lane.

that. I mean, at a minimum, put something into ChatGPT, write a policy, even if it's not the best, like you've got a lot of experience, put something in place so that you have it and you can at least go back and say like, I have this like my framework. Yeah. Yeah, like I mean, it's crazy. You can ask you, like you said, you can ask it to say, map to blank control and write a policy and just reference it and yeah check it but like, it's going to do it for you.

going to lock it down. And you could just say what you want to say to it and it will put it where you want to go. It'll take you to that policy, it'll create it and then you know, obviously you'll read it over and you could even just write after you see it, less words, more bullet points, you know, friendlier, sterner, you know, you could do things like that and it's going to keep spitting it out till you

get what you want. You're like, I don't like that line, I don't like that line, but everything else is gold.

efficient systems. What has made you, how has an IT auditor, that experience and dealing with audits made you a better IT manager one? And then two, for

those students that are in college, because IT audit has always been something where there's a lot of jobs typically coming out of college. Like, would you still recommend students go to that? Is that a good career path to get where you're at? Just kind of share your thoughts on what makes you better at your job from your experience?

know. And then like I said, you see some of those issues and you're like, man, you could just do this, or you need to do that. Or you just tell them, you know, you guys got to do this, you know, and you're seeing all these holes, and no one's doing anything about it. And you realize there's a lot of bad IT out there. And, you know, this isn't what I want to see, I don't want to be in this negativity. So it definitely

reaffirmed my love. It made me realize that like, Hey, I like making changes, I like getting problems, I like to be hands on. I don't want to see a problem and just give someone an answer and that's it, I'm out the door. I want to be a part of that I want to see it to, you know, to the finish. As far as new people coming out of school, it really depends. You know, I mean, if you're in IT, I would not want to be in that because you're not going to get the full IT

experience. You know, as you're moving your way up in your career, and you need a stopping point, probably mid level, it'd be nice. But then I don't know, I think it takes a real special person to want to sit, you know, the, the best part of it was only about 5-10%, where you're really involved. I mean, there's so much documentation and so much, you know, the interviewings when you're interviewing other IT people is good to talk to them, to meet people, you know, I can do all

that all day. But there is a solid chunk where you are alone with a document, looking through controls, and you're looking through this, and you're looking at that. Does this meet this? And then finding the evidence and then waiting for it or requesting it. There's a lot of follow up there and a lot of stuff, if that's your if that's your forte, jump in, you know, feet first head first, whatever

you want to do. But if you're new, and you want to be in this and you have that inquisitive mindset and you're you know that IT tech detective, and you want to fix things, and you're a people pleaser. Like I have never been the IT guy was like, ugh users, like no, these are my people like I'm here to make them better. My goal is for everyone who ever leaves here to go, that was the best IT department I've ever worked with, you know. So that's always

my goal. So if if that's you, then, you know, probably not jump in there. But don't be afraid of it too.

this with everybody else. So I I look at it as any level if you're, if you're into it, like I'm going to be into it too. Like I run a local IT group. You know, I'm always looking to mentor people and help people and I think that was big for me early in my career. And I want to keep helping that because you know, it's, you know, read it, write it, do it, teach it that whole thing just keeps re-solidifying. And I always learn from them, they learn from me and I don't want to stop yet.

Like I said I'm not ready to cruise.

want. And me, I look for a particular personality trait, a particular, you know, I want someone who wants it, who's going to get it, who's going to put in the time, I'm looking for someone like me, and that's hard when you, you know, I inherited a group of people who were not. People who were the coasters who were, you know, the social loafing was the norm, you know, we get put on a group project

well the group will do it. And you know, if you have four people in the group, and all four think someone else in the group is going to do it, it's not going to get done. You know, I want people that are like, I'll just do it myself. Like, no, we'll put you in a team and you'll all get it done, but I think it's, there is a mentality out there with this younger generation that you know, they, they've earned it before they

work for it. They'll work hard after you pay them or, you know, they're not here to work hard, because they want that balance. And they don't know what the balance is yet, but they think it's earned and already given to them. Now, that's just my two cents.

the younger audience. And we certainly lean on those types of initiatives to encourage them to grow and develop, at least at least from our side of the organization, Opkalla.

specifically AI? I mean, I know it's hard to find one anymore, but like, what are you most excited about that you feel like it's gonna make a big change for you.

a lot of bad too, you know. You can't have all the tightening and all the the figuring of things out and the good products without bad things happening. So I think we're gonna see a lot of stuff. We're gonna see a lot of people, you know, like this MGM thing, all the different sides of it coming out. I like that there's information, you know, that, you know, you're going to hear people, you know, I have older relatives, like, Oh, my God, these people hack that

company. It's like, well, that's not really what happened, you know, they were in the middle of negotiating with them. And the company kind of did it themselves a little bit. So it's, you're gonna see a lot of bad practices blamed on, you know, other people and other things. But being that we're in kind of an information age, who knows. I mean, kind of back to your early stuff, like, maybe we get some stuff released. And we figured out how to make that

paper thin saucer, right. Some of that technology, some of that no fossil fuel energy, and we all get jet bikes and stuff like that, that'd be nice. Motorcycle in the sky.

we like to do is ask if you could disseminate a message to the wider tech industry, could be about some personal advice that you have, it could be about a philosophy of going about work, could be about a lot of things. What would you tell an eager audience looking for advice, when it comes to how to be a more effective IT leader?

put that time in for you. So I definitely, always feel like, you know, continuing education, you know, keep tinkering with toys, and different, you know, little doodads and events, you know, not events, devices, and, you know, go to events, learn those things. To me, it's that. It's just putting back, you're gonna get back what you put in, you know what I mean. If you're a plant, keep watering yourself, keep keep out in the sun. Keep

doing that. Don't expect, oh, I got hired here, they're going to send me to an event, they're going to train me, they're going to do this. They're not going to do that. They don't care. I mean, unless you've got it worked in or you have a manager like me, who wants to send you somewhere. You can't always assume that. So do it yourself, get it done. Find those things that motivate you and keep you going.

down. But please leave a good review for us and we hope you have a great rest of the day and week.