About

Hi, welcome to my blog!

Blog Focus

This blog focuses on technology, information security, and IT audit, but certainly not in that order. Miscellaneous tangents will appear occasionally.

My goals for this blog:

  • Tackle audit and security issues, often from a slightly different angle.
  • Provide how-to articles on various topics.
  • Provide perspective on other articles, trends, and some projects in which I’ve been involved.
  • Help you understand and do technology, infosec, and audit better.
  • Make you laugh out loud.

Me

I’m known as Mack. I’ve worked in IT for years, from the help desk to break/fix to system and network administrator. I’ve built a data center, led disaster recovery teams, and pulled IT SOX onto some ugly feet.

I’ve managed the security team of an international company and led the response of several major security incidents.

Probably the most interesting position I’ve had is a moderator of a online security forum where hats of all colors hung out. You can learn a lot from 12 year-olds as well the grey hairs, some of the best in the business.

It was also interesting when that security forum was hacked (if anyone tells you they’re invincible, laugh quietly to yourself, and wait until you see them in the news).

Lately, I’ve been doing IT audit and data analytics, which has given me a different view of risk and security. My next destination is secret, and I’m enjoying the breeze. I’m having fun and enjoying all that I  still have to learn.

Favorite Topics of Mine

ACL

ACL is Audit Command Language, the data analytics software from www.acl.com. Auditors and others use it to join and analyze data. Explore all ACL posts here.

A buddy of mine, skyyler, helps with the ACL heavy lifting on this blog.

Case Files

These posts describe events that happened under my watch in one of the many positions I’ve held. The names and some details have been changed to scare the guilty.

Security Scope

Security Scope articles describe basic security principles; I like to refer to it as the “ah-ha” series. These posts also serve as reminders to those of us who know better, but need occasional nudges.

Many of these posts answer questions I am often asked by co-workers, relatives, and friends that don’t understand information security and why it’s important. This series is my personal security awareness campaign.

Security Scout

This series describes security adventures I have as I’m rambling around the landscape.

Quote of the Weak

Occasionally I can’t resist poking some fun at people who say strange things, or say things without realizing how terribly wrong or misinformed they are, or how what they say is so true in a totally different context.

Most Popular Posts

These posts are the more popular ones, month-to-month:

FREE CISA Study Guide

Teach Yourself ACL

CISA vs. CIA Certification

How to Pass Certification Exams

Also check out my interviewing IT auditors series.

Comments Policy

I love reader comments. Let me know what you like, what you hate, and what you’d like to read more about.

For my Comment Policy, see Copyright.

P.S.

If you find a typo, broken link, or a brain leak, please let me know. And leave me a comment once in a while, and let me know what you’re thinking…

Also, some of the details, conversations, and circumstances revealed in this blog are sometimes veiled or enhanced to protect me and the guilty, but scare the innocent…

DISclaimer

All information and humor provided on the ITauditSecurity blog and Onedrive (formerly Skydrive) website is presented as is, without any warranty or guarantee. Anybody using any advice, scripts, jokes, or whatnot on these pages is encouraged to validate the effectiveness and reliability on their own, away from their business network. Also, make sure you seek legal advice, obtain tax advice, and check with your doctor and your mother.

Finally, do not run backwards with scissors.


41 responses to “About

  1. ITaudit

    This topic has been viewed hundreds of times, and no one has a comment on it?

    You like the blog focus? Want more ACL articles? You don’t believe my Security Scout stories?

    I’ve only made one person (timethief) laugh?

    Remember the reader’s motto:
    I came
    I saw
    I commented.

    Like

  2. coffeeking

    Hello Mate,
    I have just found this blog and absolutely love it. Your way of putting your experiences together is very simple and thus makes it easy to relate. I have already commented on some of your posts and plan to be a regular poster. Keep them coming!

    Like

    • ITauditSecurity

      coffeeking,
      Thanks for all your input so far; it has been great. Nothing encourages a blogger more than comments, even critical ones. So if you have any of those now or in the future, here’s your golden invitation. Iron sharpens iron. Few things are worse than an environment where everyone agrees with you or when you appear to be the only SME.

      Just curious, now did you find the blog? Please tell others you know who might also be interested.

      Like

  3. coffeeking

    I frequently comment on your blog posts and notice that you respond to pretty much all of them but I never receive and automated response mail to know when you have responded. Is there is way to fix this, this can lead to some timely discussions!

    Like

    • coffeeking

      OK…I just noticed you have a link down there to notify me of follow-up comments…tells you how much I pay attention to these things.

      Like

      • ITauditSecurity

        coffeeking,
        I try to always reply to every comment with individual attention. I appreciate all comments, positive and otherwise (except for spammers, of course.). I’ve always found you learn more from negative comments, experiences, and people; in addition, you’re head never swells due to a reprimand or complaint :)

        As for the notification of reply comments, glad you found the checkbox below the comment box. Bringing it up only highlights it for others, so no problem.

        Like

  4. I’ve been fixing a lot of brain leaks and dead links on this blog that no one has told me about. If you can’t say anything nice in a COMMENT, at least you can tell me when I’ve been a knucklehead. I found 2 dead links on this page alone.

    So you’re telling me that all the auditors and security pros (critical people by nature) that read this blog don’t have any complaints? Don’t find dead links, typos, and nerve damage? Are you really that dead after a long day’s work (or during lunch)?

    Like

  5. just seen this, followed, followed on twitter. Thanks for the good work of sharing. Follow me @bsemakula

    Like

  6. Mainz

    Nice blog here! Also your website loads up fast!

    Like

  7. Santosh Kaimal

    Reached your website looking for some notes on CISA. Liked it.

    Like

  8. madzutopia

    Found your blog when I looked up for IT auditor interviews. Just started looking for a job in IT auditing field and reading your blogs helped me understand what am I going to be up for!
    Thoroughly enjoyed the humor btw!!
    Keep blogging :)

    Like

  9. Rob

    I found your blog recently. I am wondering if you could offer some advice. I have worked on and off in IT for the past 15 or so years (most in desktop support). I never specialized but became somewhat of a generalist. In 2011, I graduated with a BS in Accounting Information Systems but took a career detour instead of finding a job in audit. Of course, I did not do my research on entering the IT Audit field and am now finding that entry-level jobs are a “game” for the young and a path that runs though a major accounting firm, like the Big Four. So, at 40-something, I am now trying to figure out a path within IT that will “re-converge” with IT Audit at a Senior level in a couple more years. I am currently studying for the Security+ certification, to provide a foundation to grow on in security. Your thoughts? Advice? Thanks!

    Like

  10. Hi Rob,
    In my opinion, Big 4 firms are just a saw mill. They work you to death and pay you little. One tried to recruit me, but I didn’t want to go that route. And I’ve never met an auditor who enjoyed the Big 4. So I’d stay away from them unless that’s your only resort. The good thing about the Big 4 is that after working there 2 years, you’ll be ready for anything. If you survive.

    I’d rather steer you to trying to join the audit team of a company instead, or maybe a compliance team. It sounds like you have some IT background, as well as accounting (typically, IT audit deals with technology, not accounting and finance, but having that kind of background is a plus). The best IT auditors I know understand audit, IT, and accounting, but they are rare. Personally, I don’t do accounting.

    Or perhaps take the route I did through IT. I went from help desk to server team to network team to security to audit (not all in the same company). The fact that you’re an IT generalist is good. Many IT auditors I’ve worked with and hired as contractors never worked in IT, and it shows.

    Whatever job you’re in or go to, tell them about your interest in security/compliance/audit, and ask to work on projects with those components as much as possible (many people hate those projects, so that will help you). That could lead to taking a job in one of those areas. Also, introduce yourself to the audit, compliance, and security teams where you’re at and tell them about your aspirations. They might have some leads for you and should be able to tell you what you need to do to get a job in their area.

    After you get your Security+, I’d strongly suggest that you get the CISA certification, as that is the IT audit certification, and studying for it will teach you a lot about audit (see my posts about CISA and certification). Ultimately, it’s more important to understand auditing than it is to understand IT technology. You CAN do IT audit with little technology background as long as you’re solid in audit (although I don’t recommend it) for this reason: the IT guys that you audit can teach you the technology & IT operations, but not how to audit (maintain objectivity and independence, identify the risks, decide what to test, pick a sample, write a workpaper, etc.).

    Said another way, if you don’t know audit, you will fail, regardless of how much technology or IT operations you understand (or don’t). I know this because I work with “half-auditors” all the time. They get the audit done and survive, but IT hates them because of all the time they require due to their lack of understanding. And I struggle with them because the next year when I perform the same audit, I find lots of stuff they missed.

    Hope this helps. Let’s keep talking. I wish you the best.

    Like

  11. Rob

    Thank you for your response. It was a great help. I was going to take the CISA in December but have deferred it to June to give me more time. I have also been networking with individuals at ISACA for guidance. I’ll keep in touch and let you know how things progress.

    Like

  12. Rob,
    You’re welcome. Check out my free CISA Study Guide. Yes, let us know how things go.

    Like

  13. Hey Mack,

    Great site, and thanks for linking to my ACL Bootcamp series! Do you have time for a quick chat on the phone? I’m always looking for good contacts that use and understand our products.

    Like

    • Shane,
      I’m flattered, but Skyyler is the man, and he’s always said that he’d rather stay very independent and praise and gripe from afar for various reasons.

      As for the bootcamp series, anyone that hasn’t checked them out is wasting too much time doing something else!

      Like

  14. Sunil Reddy

    Hi Mack,

    My friends, 2 in particular, have been forcing me to CISA cert. And along my research i came across your blog. Thanks a ton MACK, got loads of info and courage to go ahead with the cert. Ive been in IT as Mainframes tester for 4 years now and have been planning to shift for almost 2 years now but was in no hurry to make another mistake. So CISA cert and job role for now looks very positive. Please let me know off your suggestions or if you differ on my thought.

    Anticipating your reply

    Cheers
    Sunil

    Like

  15. Sunil,
    Go for it, especially since you were already thinking about it. If you find you don’t like it or want to go in that direction, you haven’t wasted your time as you learned some things and were able to make a good decision.

    If you like it, it will only help you. Good luck. Mack

    Like

  16. Leatherneck75

    Great Blog. A lot of useful information and insight. I am an IT professional (Previously Desktop Support, Networking, and SAN Engineer) and about to start a GRC IT Audit position. Thanks for all the effort and time you have put into this site. It is very helpful…

    Like

    • Leather,
      Glad you find it helpful! I appreciate you taking the time to say so. Makes my day.

      Your background is great for audit, and I’m sure you’ll do great. Just remember to stop doing your old job and looking at issues from that perspective only.

      And don’t be surprised at how little IT other IT auditors understand. Stop back after you’ve worked at audit a while and let me know whether the other IT auditors in your group (hopefully you’re not the only one) are very technical. I’d be interested.

      Thanks again, and have fun.

      Like

  17. Lindsay

    Hi!
    I am a recuriter and am currently looking to build my network in the IT Audit space – you are obviously the expert and I would love to set up a time to chat with you. Do you have a particular day this week that works best for you?
    Thanks!
    Lindsay

    Like

  18. Tom

    Mack,
    I ran across your blog searching for IT Auditor Requirements. I have my CISSP and am employed as an Information Security Office for the Department of Veteran Affairs; however no formal Auditing Education. What is your recommendation on what Certs/Steps to pursue to become an IT Auditor. Is the CISSP Cert good enough?

    Like

    • Tom,
      Few IT auditors have the CISSP, and that’s a great cert to have. But you need to study for the CISA to learn auditing. See my CISA link at the upper right corner under Quick Links.

      While understanding security really helps in auditing and will give you an advantage over most IT auditors, it’s more important to know how to audit….Once you learn that, you’ll be ahead of others.

      Like

  19. Stephen

    Great blog – it came up as i have been troubleshooting some RECOFFSET commands i’ve been trying to get working…i had been troubleshooting my scripts for quite some time now and i got the familiar eureka moment while making the dinner this evening…hence i decided to get stuck into ACL for another couple of hours. A scenario you are probably very familiar with.
    I have only started using ACL recently and would consider myself intermediate skills but blogs like this make things a lot easier. Especially when it comes to things like RECOFFSETS and print file imports!
    Keep up the good work and i’ll be checking in on a regular basis for your tips from now on!
    Cheers,
    Stephen

    Like

    • Stephen,
      Thanks for stopping by. Haven’t used RECOFFSET a ton, which is surprising. It is very useful. I haven’t written about it yet, sorry.

      In the past, I got some print file imports to work pretty well, and you can script those too, once you perfect the import. Haven’t done any later, thought. I think they have a good video on it in the ACL Boot Camp series, so check that out.

      Your comment on getting “stuck in ACL” made me chuckle (did you see my post, “You Might be an ACL Freak if…”).

      You don’t know how many times I’ve missed my ride home from work due to being stuck as you described. In fact, it almost happened again today.

      Also, did you see the ‘Teach Yourself ACL’ post? It has links to a couple websites for ACL user groups that you might be able to find some help at. The best one is Texas ACL User Group.

      Regards, Mack

      Thanks for your encouragement.

      Like

  20. Ganesh Sharma

    Hi Mack,

    Great blog, I enjoyed going through. I stumbled upon it while looking for material to self-study ACL. Good job!!!

    Just to share and if you will like to advise me. I have most of IT certifications CISA, CISSP, CISM, SAP and also CA (India), CIA and my quest is not yet over; I am going for ACDA also. Do you suggest something more to help in career given the recessionary trends globally, thank you in advance.

    Ganesh

    Like

    • Hi Ganesh,
      Glad you enjoy the blog. Thanks for taking the time to tell me. Those words never get old, and are greatly appreciated.

      From a certification standpoint, you seem to be all set in your career. Don’t stop learning or being curious.

      Regardless of economic trends, problem-solvers who can get along with others and explain complicated things in simple terms are always in demand.

      The people I’ve known in my life who either had many certs and/or a ton of experience and were highly regarded were also humble people who constantly used their abilities to not only do good work, but to graciously help others.

      [Helping others is one reason that I’ve kept the blog going as long as I have (it’s hard work!) and try to answer everyone who comments or asks a question. Besides it’s fun.]

      Based on your question, I sense your certs haven’t gone to your head and puffed it up. You seem like you’re already on the right track.

      I think success is more defined by who you ARE (character) more than what you KNOW, and by who you help as you pass by.

      Wish you the best. Mack

      Like

  21. Avinash

    Boss, I just browsed your site and it’s really worth it. Youhave taken lot of efforts. I am myself is a CISA trainer from India and in IT field from the era of unit record machine. Wonderful. Keep it up!

    Like

  22. Hello Mack;
    I didn’t see a private way to contact you so i decided to use the comment section, i have a degree in elect/elect and desired a career in the energy sector, got all my HSE’s and NEBOSH certs ready before graduating.
    However due to the ongoing energy crisis, there’s no employment in that sector anymore

    I recently got a job at a bank as an IT support staff without any bg in IT, now i am considering IT fulltime and I hope to write the CISA exam this year, thats how i found your blog. So i’ll be coming here everyday. Sorry for the epistle, i just need guidance

    Thanks

    Like

    • HM,
      Sorry, but I’m not clear on what guidance you are looking for. If you’ll submit a few questions, I’ll give you my thoughts on them.

      I have written quite a few articles on CISA and general IT, so check out the posts under the CISA and technology categories. Also see my certification category for tips on passing exams.

      Like

  23. Lost

    Dear Mack
    I’m a college student entering in to my last year. I just learned about IT audit and wanted some advice on finding training and work. I will have a degree in accounting and economics.

    Like

    • Lost,
      My suggestion is to read all my posts with CISA in the title. There’s a quick link at the right side of every page. I have provided lots of advice to those new to the field in the comments to those articles. Wish you the best. M

      Like

Leave a Comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s