POSTED: 11/04/1998 | FILED UNDER: coursework, auditing, eye-openers
Auditing the Place I Study In
A reflection on doing an information security audit, and realizing that some university units are not protecting their information assets as well as I assumed.
Every topic before this one stayed mostly on paper. Threat categories, social engineering, risk matrices — all of it was about made-up companies or examples from the slides. The information security audit was different. For our finals project, our group audited an actual unit of the university: the Nursing Review Center. It was the first time I watched the concepts from class show up, or fail to show up, in a real office I walk past.
1. New Insights
Not every unit is protected the same way. I assumed that because the university has an IT department, a network, and official policies, every office automatically inherited good security. The audit showed me that protection is uneven. Central systems may be well managed, but individual units often run their own spreadsheets, shared folders, personal laptops, and paper files that never pass through central IT at all. Those are information assets too, and in some units they have few or no proper security measures around them.
The assets were not even listed. The first thing we asked for was an inventory of information assets — what data the unit keeps, where it lives, and who owns it. There was no formal one. Reviewee records, exam scores, payment information, and contact details were spread across a few office computers, a shared drive, personal email, messaging group chats, and filing cabinets. It is hard to protect something when nobody has a complete picture of where it is.
Everyday convenience quietly beats security. The gaps we noted were not dramatic hacks. They were ordinary habits: a shared login used by several staff members, passwords written near workstations, computers left unlocked when stepping away, sensitive files sent through personal messaging apps, and no clear schedule for backups or for removing the access of people who had already left. Nobody was being careless on purpose. These habits exist because they make a busy office run faster.
Physical security is information security. Some of the most sensitive records were on paper, in cabinets that were not always locked, in a room that was not always attended. A firewall does nothing for a folder that anyone walking by can open. This connected right back to the McCumber Cube: confidentiality of information in storage, protected by policy and awareness, not just technology.
An audit is not an accusation. I expected the staff to be defensive. Most were open and even relieved that someone was finally asking these questions, because they had never been given clear guidelines. That changed how I see auditing: the point is not to catch people doing something wrong, but to give the unit evidence and a roadmap it can use to ask for better tools, training, and policies.
⚠ THE ONE THAT STUCK WITH ME:
Security is only as strong as the least protected unit. A university can invest heavily in central systems, but if one office keeps personal data in an unprotected spreadsheet shared through a group chat, that office becomes the easiest way in — and under the Data Privacy Act of 2012, the institution is still accountable for that data.
2. Concepts I Want to Read More On
- Audit frameworks and standards. We based our checklist on class materials. I want to learn how ISO/IEC 27001 controls and frameworks like COBIT or the NIST Cybersecurity Framework are used to structure a formal audit.
- Data Privacy Act compliance. I want to understand what the National Privacy Commission actually expects from schools: Data Protection Officers, privacy impact assessments, and breach reporting.
- Asset classification. How should a unit decide which data is public, internal, confidential, or sensitive personal information, and what controls each label should trigger?
- Writing findings that get acted on. A report full of technical findings can be ignored. I want to learn how auditors write recommendations that management will actually fund and follow.
3. Confusions and Challenges
Scoping was harder than auditing. Deciding what was inside and outside our audit took longer than expected. Some systems the unit used were owned by central IT, some by the unit, and some by nobody in particular. Figuring out who was responsible for an asset was itself a finding.
Evidence versus what people tell you. In interviews, staff described how things should work. Observation sometimes showed something different. I struggled with how to report that gap fairly without making it sound like anyone was lying.
Recommending things a small unit can afford. It is easy to write "implement encryption, centralized identity management, and 24/7 monitoring." It is harder to recommend realistic first steps for an office with a small budget and no dedicated IT staff: individual accounts, locked cabinets, a simple backup routine, and a one-page data handling guideline.
Being an auditor in my own school. It was a little uncomfortable to find weaknesses in the institution I am part of. I had to remind myself that pointing them out, carefully and through the proper channels, is the respectful thing to do.
Where I landed: this audit turned information security from a subject into something real. The threats from earlier reflections were not hypothetical — the vulnerabilities they need are sitting in ordinary offices, in shared passwords and unlocked cabinets. The good news is that most of the fixes are not expensive. They start with someone asking, "What information do we have, and who is protecting it?"
Comments (3) | Trackback | E-mail this page to a friend