re: Job with Ernst and Young

quote:

---

The problem I run into is the audit checklist morons who say they are "infosec experts" that have no ability to comprehend or process compensating controls.

---

Preaching to the choir. People don't understand nearly all auditors (or ex-auditors that work in 3rd party risk management, etc.) have an accounting degree and learned all they need to know about Windows Server security at a three day training in Cincinnati. I watched one consider the on prem mainframe as "out of scope" for a PCI DSS audit, because it was a mainframe. The quickest way to fool them is to bring up subnets and watch them pretend that being in two different class C subnets alone provides some sort of protection.