CEO and Founder, AudITech
Table of Contents
What did I learn this week about cloud infrastructure and user monitoring?
Cloud computing infrastructure has become the standard in the high-tech industry and beyond. Instead of buying physical servers, you can get computing services with just a few clicks in the required amount and manner. However, the relative ease and almost unimaginable convenience compared to the on-premises world also come with many risks. It’s so easy to manage computing infrastructure and grant permissions to anyone anywhere in the world to manage it for you, making it complicated to know who is doing what, especially in large organizations. This problem is well-known, and there is a huge and developed cybersecurity industry-leading many diverse solutions to reduce risks in cloud work.
So why am I telling you this?
Because I always thought that user review processes in ITGC audits couldn’t address sophisticated cyber risks and that only advanced cloud monitoring products could provide a solution. I was wrong. The modest approach of user review in ITGC, which says, “These are your users, take responsibility for them,” is actually effective. If you take responsibility, there is no finding because who knows better than the organization itself?
And why was I wrong?
Because this week I discovered that the simple and unsophisticated user review, which aims to identify risks in the organization’s financial reporting, identified a problem that, on the surface, had no unique risk and therefore was not flagged by any monitoring. But what did happen? The person who conducted the review understood the real significance of the identified risk, took immediate responsibility for it, and neutralized a significant risk to the organization, ensuring reliable financial reporting. Sometimes, even when the cloud environment is monitored with the most advanced tools on the market, there is no substitute for the simplicity of taking responsibility for what is yours.
