How to Benefit from Internal Audit
summary
Internal audit describes a threat-led approach: map likely loss event scenarios, pick controls from CIS Controls that directly stop those sequences, and test them with misuse-case testing (download, email, upload, WhatsApp, personal cloud). Typical audits run six to eight weeks; measure reliability (phishing click rates, DLP alerts, SOC response) and report residual risk on a 5x5 grid. Cloud security benchmarks (Azure) and tuned DLP plus targeted MFA, data classification and time‑bound exceptions prove whether money spent actually reduced risk.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:41What does Internal Audit look for?
- 16:48Example
- 24:34Improved control set
- 30:56Reasonableness
- 32:20Security by design with cloud services
- 34:12How Internal Audit helps the CISO
related talks
30mTruth about running Cloud Security Assessments in 2021
40mCybersecurity Controls: It Isn't Just Technical Controls That Need Testing
50mOptimizing audits with automation
25mSecurity, Identity - Back to the Drawing Board?
31mHow to Prepare for an Audit AKA Make Audits Suck Less
31mCloud Threat Landscape - 2021
44mCybersecurity - Protecting the Organisation's Technological Assets
47m3 steps to help mitigate cloud risks