the audit survival guide
followed by the festival survival guide
so clue we'll let you start your audio
and
kick things off yep all right
let's share some things tell me when i'm
good to go
let's make sure we're good all right
we're looking good on the stream
so you're all set wonderful hello
everybody
um so
question is we're at an infosight
conference why the hell am i talking
about audits right
and um unless you're
involved in one right audits are this
like abstract concept
with some many preconceived notions
right so
all i'm gonna try to do today is kind of
demystify the topic a little bit like
take away some of the apprehension give
some basic advice
right because there are some scenarios
especially when we're like at the
beginning of our career when we're gonna
stumble into this without being prepared
like
let's say you're the only i.t guy at
this fancy biotech startup and now the
fda is coming paying you a visit
cool right or your line manager is on
vacation
and now you are basically the only guy
who knows about identity and access
management
right or you are tasked with managing
the infrastructure and services
during an audit right all of those are
reasons where you will end up
involved in this without any formal
training or prep
so who am i my name is christouro or
just clue
i started my career in rec engineering
and testing mostly for like regulated
industries
um was usually the only one talking
about security and privacy in those
projects
and i kind of stumbled into information
management from them
and as part of that then quality
governance the whole shebang
um and audit prep and audit management
was more of like a side effect
right i was
first i started designing and testing
systems that would be under audit
scrutiny
then managing the systems that had the
data that auditors wanted to see
right so um just a short disclaimer
anything i say today of course is my
personal view and not any employer i'm
not gonna name my employer but i'm not
so hard to also
so right and any anecdotes that might
happen today
will not be from my current employer
makes sense
um all right
expectation versus reality let's start
by dispelling the misconceptions
um the vast majority of audits are
routine
and cooperative what do i mean by that
they're required by
some sort of quality framework or
regulators depending on your industry
require them and the same goes for your
customers right depending on what
customers you have
they're going to ask you we want to come
audit you
right and in most cases they are
announced
weeks or even months ahead of time right
audited party has limited input on times
and dates
auditing parties sends a plan a schedule
what they want to look at and so on
right so this is not like you're not
getting ambushed by it
now with that said sometimes audits are
indeed unannounced
but unannounced does not mean that
they're unexpected
right um
some of them are just still routine
they're part of your same quality
framework that has the announced ones
however um unexpected or adversarial
audits
do happen right usually reserved for
cases where misbehavior is suspected
like dawn raids or the absence of an
uh right so if you're ever pulled into
an audit
and no one's giving you a different
explanation as to why you're here
right so i'm like hey joe um
we need you to talk about xyz then maybe
get
uh defensive but apart from that
chill right um
now the rest of the talk will only focus
on everything that i
said is routine because that is what
99.9 percent of the time is going to be
the stuff you will be
facing or involved as i t
also it's what i know most right
all right a lot of the planning and
preparing goes into audit readiness
which but that's a subject for another
talk but
a lot of effort goes into setting up and
maintaining a controlled environment
right that's part of the mystique if
you've been around it's like
oh don't go over there into that meeting
room right there's an audit in progress
um so just to understand with the
logistics usually you will have like an
audit room
which can also be called like a front
office inspection room
interview room whatever that's usually
where the auditors
uh your colleagues who are managing them
and any sort of scribes are sitting
right it's like an interview room um
then you have usually a second room
which is ready room so you have some
coordinators against scribes ops support
basically they're running more or less
incident response for this right
and sometimes they're going to run
around doing visits of facilities
server rooms and so on right and the
scribes will always be relaying
information between them
so again everything is about a
controlled environment
so let's say you're getting this dreaded
call
hi this is joe from quality the auditor
has a question on
topic x and um you're listed as someone
who can provide some answers
um the first thing is breathe
right this isn't like a building on fire
situation
you are not expected to rush the
interview room in the next five minutes
right usually your back office will tell
you
at what time they're expecting you but
it's not like
run down right before you do anything
else
clarify with them what the scope of the
audit is on what topics you will be
questioned right if you're expected to
provide any additional material
right and once you know that you can
start preparing for it
right prepare yourself anything you need
or have been asked to provide
get yourself a notepad or something like
that and then clear your schedule
um because nothing's worse than going in
and then
being asked to run out again because
basically
even if you are working in like
incidence response or something like
that
this interview is now your incident
right there's
very little that can be more important
than that
um and then just go
right maybe detour to the restroom if
you feel so
like that but you know just go down
calmly
nothing to be scared of um
once you're there first and foremost i
think that's something that
really needs to be hammered into
everyone's head this
isn't about you right this is not a
performance review
this is the company being audited not
you personally
right you are providing some insight
into some
specific area of work that you know
about
right but take it seriously right
basic stuff take your phone off if your
company stupid thing like
if your company has a badge policy then
don't leave your badge upstairs or have
it hidden
right it's the small stuff like that um
this whole thing is going to be about
the role
you happen to fill at that company right
so describe explain your role in the job
that you do be able to describe and
identify any
like procedures and other written stuff
that governs your work
describe the interfaces with your
customers your colleagues and so on
right basically you should be able to
tell them what what the cog
in the company machinery you are right
and of course provide documentation of
your actions etc
right demonstrate your work maybe
possibly
um now there's a flip side to this
this isn't about you right an
audit is not the place to flaunt your
skills
right so don't overstep
speak only for yourself clarify the
limit of your responsibilities if you're
being asked about stuff you're not
responsible for
don't step around the problem just tell
them nah
i don't know this is not really what i
do every day
and that's fine right
especially don't talk about someone
else's job
don't critique someone else's job again
right do not blame or complain about
anything or anyone
other than what you do right audit is a
snapshot anyway
and also i know it's going to sound
stupid but do not start
back talking or critiquing the auditors
because you don't want to alienate them
because even if you
manage your interview well you can't be
sure that every colleague after that is
going to handle it well so
you know don't be an [ __ ]
um or in general don't antagonize right
and most importantly and i think that's
the last part and it goes back to
this is not about flaunting your skills
um
don't be a smart ass right no one
no right so
in short this is basically a friendly
interview right don't turn it into a
performance of yourself or an
interrogation
sounds easy so let's go
uh most of the interview will basically
be a straightforward series of questions
right so
before you do anything else like be sure
you understand what the question is
before answering right
if you do not understand the question
ask for clarification
if the question is not in your area of
expertise right
take your time
what information needs to be part of
your answer
how do i structure my answer to get my
point across and
only then give your answer
right by the way any resemblance to the
input process
output idea is purely coincidental
um all right
understanding a few details that might
be interesting
um this is not a frequent problem in the
u.s but
if you and the auditor don't speak the
same language at least not fluently
that is not your problem right
translators are a thing
if the auditors are in a foreign country
that's they're supposed to bring
translators
if you work in a country where which is
not your native language
then that is on the back office to get a
translator in so that they can translate
right don't stifle your possibility or
ability to explain stuff just because
you're trying to do it in a language you
are not fluent with
right
focus on the question itself right don't
start like formulating your answer until
you've heard the question in full
because you're not going to pay
attention to what is being asked and
don't sign up your colleague like uh
like you're looking for approval it's
like you're
at that point you're the subject matter
expert in the room right
and if there's any like edge case where
you shouldn't be answering or something
that's on your senior colleagues who are
managing the audit
to stop you basically right
and again if you have any doubt ask for
clarifications
turn hypothetical questions if you're
being asked a hypothetical question
ask them to rephrase that as a concrete
one right don't go with like
uh don't answer a question like oh what
would you do if
no this is about what do you do when
right um
and a good way to do that by the way is
to rephrase a question
right so huh okay so if i understand you
correctly what you mean
is and so on right
um and most importantly know your limits
if this is
outside of your scope beyond your
understanding say so
um thinking so the second part of our
little process model
um this is gonna sound super obvious i
know but um
think about what you want to say and how
you want to say it
don't rush to start talking right this
isn't an exam there's no like time limit
right stay factual and on topic right
no assumptions like oh i think this is
that or i assume or i
guess no or my favorite one is like
well to be honest because at that moment
i'm gonna ask you well
are you not honest the rest of the time
right
um don't blame someone else we had it
already but
things like oh no that's not my problem
or now that's too expensive or
is this an edge case no
right and most importantly don't deflect
right something like ah we always used
to do it this way or
i don't care or stuff like that it's
like no
right and then to the answer itself
well just like the thought process
don't rush it right take your time
talk slowly talk clearly
take a breather effort sentences right
if you're asked for or need
documentation
or let's say they want the you they ask
you to bring like a 20-page sop and they
want to know specifically what's in
there or a specific question on it
point them to the exact page of it right
um and if you're asked to demonstrate
something
let's say you're a system owner or
something stick to like some common use
case not some weird edge case
where you can again demonstrate how cool
you are um
and then the most important part
stop when you're done again sounds
stupid
but it's not your job to keep the
conversation going right
silence is okay
especially when you have like people
around you all taking notes
and if you want to be really fancy you
can always end it with your
head did that answer your question do
you have any follow-up
right
and that's already about it again this
is all about
like demystifying this this concept
which is really not as scary as some
people make it sound
um i have some closing general thoughts
that i think should be some takeaways
first of all an audit is not about
perfection it is about
control right stable
and mature procedures are king right
some deviations or errors will
inevitably happen in any company
right it is how you handle them that is
important
um i said it before the auditor is not
your enemy
but it's still their job to find stuff
right they will not prevent you from
running off a cliff
that's why they use take conversation
techniques like staying silent for like
half a minute
or
baiting you into answering stuff that is
not in your scope
right again they're not being mean it's
their job
and um last thing is if if
if you're interested in anything in that
broad area there are a few things that
that transfer that are not specific to
this area of work
like conversation techniques such as
active listening
you can use that anywhere whether you're
a project manager whether you're
developing something and are talking to
your customers
all of this is relevant in most areas of
our work
right and if you ever want to get into
any sort of ops or incident response
um running the prep room or the back
office depending on how big the whole
thing is
is pretty much the same it's basically
incident response and operations
um and with that do we have any
questions on this part
i don't see any and slack so
unless
anyone type something right now we're
gonna move on to the
less formal part festivals
all right
well just like for most of us covet
kinda ruined my summer last year right
i'm not the only one
i'm getting a question
um okay kidding aside can you touch on
working with internal versus external
ones
um
[Music]
i would say you can there are two things
that i've seen often one is
you need to explain more to external
auditors because even basic things like
your id infrastructure or like logon
procedures or something like that
an internal auditor mostly knows that an
external might need to get it explained
right that's one part um
and the second part is of course uh an
internal will have usually even more
info on you beforehand at least that's
the experience i've had
uh but apart from that
that's more on the back of us basically
telling me hey this is an external audit
or this is one of our customers
and these are maybe some touchy subjects
right
that again is part of this like
operation
um and uh
an incidence response part can you show
example of people not following
recommendations
um yeah
uh i have to pick something that is some
time ago
uh oh yeah there's a good one um so when
auditors are here for an extended amount
of time
uh they'll usually usually eat on site
and we've had one that's like a decade
ago where basically
some colleagues who ran the audit office
basically let them run loose
on campus for the hour of lunch without
accompanying them
and basically they spent their hour in
the canteen
and listening to the chatter from
colleagues
and they picked up some stuff that was
interesting and it ruined our
whole afternoon so that's one thing
i know i didn't touch on it because
that's more on the side of like the
audit manager up top but
it should come without saying if you
have externals coming into your site
especially if they're digging maybe
don't let them just run free
right again we're supposed to have a
controlled environment
so that includes breaks right
all right festivals again um
basically this is my weird and messed up
way of reminiscing about
last summer or the summers before and
maybe give a few pointers to those of
you hopefully get to enjoy some live
events soon
right so most of this will be based on
my experience at larger festivals like
something like this right but most of it
will also apply to any sort of similar
outdoorsy event right
um so i've been a volunteer medic for
like 20 years now i
i've loved live music for even longer um
and
most of what i say just like the first
part will sound stupidly obvious
right but i can tell you just from
patient
um i think we have a quest in the wrong
channel here but
all right um most of what i say will
sound super basic and obvious just based
on patient
conversations i've had and the injury
patterns i've seen
i assure you it is not uh
just a short disclaimer because uh we
are a pg-13 conference
this talk will have zero explicit
medical imagery
i will not go into any sort of medical
gruesome depressing or whatever detail
so you're good
so some prep work i'm going to cheat a
little bit because i didn't
go into any sort of infosec topic
actually in the first part so i'm going
to touch on it a little bit now
do some oceans kinda
what i mean is um most larger events
have a treasure trove of information
available
to help you prepare and have a better
time as a result right
just some general information like area
maps timetables
opening hours right also what you can
buy on site
versus what you need to bring or buy
along the way right
most festivals are quite isolated out of
necessity for the space they need
right some will have a like a small shop
on site
some don't um
also what are you allowed to bring onto
the campgrounds
or the infield right just for
explanation campground is where you camp
infield is the area
next to the stages usually separated by
an extra layer of security
and for the campground especially can
you take your
car onto the campgrounds to your tent or
not
right some festivals have just like yeah
plop everything down in the corner and
you're good some have specific parking
areas
and that makes a difference
a little side note
don't assume that you will have a stable
cell or wi-fi on site
it's getting better but still again we
are
a bit isolated you are having tens of
thousands of people
so try to have any info you need at
least locally
um so now you have all the info you need
time to get packing
what and how much you take will widely
differ
depending on the kind of event and how
you travel
but um just a few things to consider
when putting together your gear
right what do you want to buy on site
and instead of bringing it from home
right especially everything that's food
and drink related
will also depend if you want to make
your own food or buy on concession
stands
um you might to have to haul all that
gear
for half a mile over uneven terrain
especially in the cases i had before
with where the car is not where the tent
is
uh you are possibly going to need like
some smallish bag for the stuff you want
on you during the day right like
reasonably pickpocket safe
and mosh pit ready if that's your jam
and that bag and its content need to
pass in-field security because not
everything that you're allowed to have
in your tent
let's say a long cooking knife is
allowed
in field right includes by the way most
drink containers so you can have like
your glass bottles and campsites
but not in field
so and uh another side note once you
have found your little cozy spot lock
your gear or there
set everything up right away instead of
at 2 am in the dark when you're drunk
so now that we're all set up let's go to
what we're actually going to see on the
medical side a little bit
i'm going to structure this a little bit
like using a mnemonic that is very
common in accessing patients which is
called abcde
uh starting with ab which stands for
airways and breathing
so we don't see too many common
diagnoses in that area
but one thing i'd recommend especially
now that we've gotten used to it
bring some face masks because if it's
dry it's going to get dusty
and even people without asthma regularly
come in with respiratory problems
and also unfortunately we get we're
seeing more and more pyros
in the crowd here and there sometimes
even part of the show so brought in by
the artists
but that's a different story um
small tangent again since i touched on
asthmatics
if you are an asthmatic diabetic need
any other
daily daily medication for any other
reason
check if you can store it with the
medical team
especially with like larger events
there's a good chance they are going to
offer
um they're going to offer like
to to store your refrigerated medication
at least
all right moving on to circulation
so that mostly covers like blood loss
and other fluid problems
so blood loss luckily is very rarely an
issue
dehydration on the other hand is very
common
i mean you're out in the sun for eight
plus hours you're jumping and dancing
you're going to need water by the
gallons right
and no beer doesn't count
even if it's light american beer
so because you know i'm not your mom
but something tells me you'd rather be
in front of a stage than snoring in the
drunk tank
so pace yourselves this is a marathon
not a sprint
next up disability and dysfunction
it's not a very descriptive term but the
mnemonic wanted the d
so we're going with that um
it is a bit of a catch-all for anything
affecting or impairing your
consciousness
right including alcohol but we already
covered that
um what we haven't covered yet are all
the other narcotics you might be
inclined to
right again i'm not your mom a few
important things
medics won't judge you for being high as
balls
they won't drag you out to securely
unless you attack them
but we need to know right
we need to know what you've taken
because it influences our treatment on
you
and again other side note
if you want to if you want to take
something maybe don't buy your gear on
site from a stranger
right know yourself what you are
consuming
and also maybe don't try new stuff for
the first time
right the whole situation is going to be
overwhelming as it is
so maybe don't add another layer to it
um another very common issue we
see is um sun stroke i touched on it
before
bears repeating you're going to be in
the scotching sun for hours
you're basically trying your brain right
so do yourself a favor
and wear some kind of hat right
get some shade if you feel dizzy or
start getting a headache
it doesn't have to be this big but you
know whatever floats about
i thought i've got a pink but that's
fine okay
next finally we come to e
for exposure this is a bit of an
umbrella for anything
else exterior that affects the patient
like
including injuries
since we already talked about sun
strokes let's expand this to sunburns in
general
right now turning red like mr krabs is
not something that
regularly needs medical attention but
again you're out there for hours and
i've seen blisters the size of my hand
and that can have some serious
physiological implications
some other things protection-wise people
forget on a frequent basis
sunglasses just as a little aside
stages will when possible be facing
north if it's
geographically and logistically possible
because
we don't want to fry this the singers on
stage
but that also means the audience will
usually be looking in the general
direction of the sun
earplugs should be obvious
right but still you most vessels even
give you free
earplugs nowadays use them
and condoms yes
you'd be surprised how many
prescriptions for plan b change hands
during a festival weekend
you might not plan for a hookup but be
prepared for one
please um
there's a running joke at some festivals
when we say that usually there are more
people
coming back from festivals that that
then went to
all right um until now
we've mostly been talking about warm
weather right on the flip side
wet weather can be devastating if you're
not prepared
right this applies to both your clothing
during the day as well as your tent
during the night
so don't forget your raincoat and maybe
don't rely on those cheap like 20
throw tents and a little blanket to keep
you warm at night
right
all right i'm gonna
do one more thing on exposure because
i already mentioned injuries and if
there's only one thing i want you to
take away from this
one single thing wear some decent shoes
i can tell you that bad footwear
accounts directly or indirectly for
maybe half of all injuries we see right
whether you're spraining an ankle
walking or dancing on an even terrain
whether you're tripping
slipping or anything else and injuring
other parts of your body
uh whether you are standing on some hot
surfaces or sharp objects
um or just other people stepping on your
toes right
i'm not saying you need to walk around
in work boots
although i personally do even off duty
but that's because i have them with me
anyway
um i'm saying keep in mind that you will
be walking several miles a day over
multiple days
and partying
remember what i said about all the gear
you had to haul
to your campground at the beginning
imagine
having to haul all of it back after
three days of partying with a hobbled
foot
not fun
all right um i'm gonna finish with some
miscellaneous things i didn't fit
everywhere else but i just want to
at least mention um
[Music]
obviously everything is more fun and
safer with friends right
so if you can get a little group of
people together
also allows you to pool your tents and
your food etc
um plan on not having access to a power
outlet and plan your phone usage
accordingly right
power banks are your friend some
festivals are starting to
offer like charging stations some even
for free
and small tip from me would be leave
your power bank to chan
to charge not your phone
again and i said it before again and
again a festival is a marathon not a
sprint
it is designed to have something for
everybody
and if you are remotely curious or
open-minded you will want to do more and
see
more than there are hours in a day right
just at some point just tell yourself
okay
chill um
and um
yeah please clean up after the event
yeah that's uh actually a thing
yeah um one thing that is being offered
more and more also tattoos piercing and
other body mods
just don't right just a straight up
don't do that at a festival this is not
a knock on all the vendors and tattoo
shops who
offer it right but no amount of
sanitizing on their part
can save you if you are rolling in the
dirt afterwards
an infected tattoo is ugh
all right um one last thing for all the
budding social engineers in the audience
who might want to social engineer their
way backstage and
since the internet tells me that
listicles are all the rage
here are top five things to do backstage
number five get run over by a truck full
of equipment
number four snap a blurry pick of an
artist in the 10 seconds between they
leave stage
and disappear into a van number three
get run over by an atv number two
hide from security in the ditch
and number one get run over by forklifts
in case the sarcasm isn't obvious just
stay out of areas you don't belong in
right hundreds and thousands of people
are working in a high pressure
environment
and don't need some idiot standing in
their way
okay that's just my personal pet peeve
but
okay and um
[Music]
thank you and in general just stay safe
and uh don't worry about us getting
bored because we'd rather just enjoy the
scenery with you
than patch you up
and that's it from me do we have any
open
questions in the chat uh i've seen i've
seen some comments i didn't touch on
like
cleaning up after yourself obvious um
[Music]
yeah it looks like we're not seeing any
real open questions just kind of
some commenting research some points are
really good they're
not really primarily in the medical
thing or things i see all the time so i
didn't touch on them
but yeah all right well overall
that was a great talk on both of your
points hoping that one day we can see
each other at a festival and we can be
around people again
i wouldn't mind so preferably not
because i'm triaging you
yeah it looks like we're slowly starting
to get things a little back to normal
yeah one of my i just had a concert
finally get rescheduled to
to august that looks like it might
actually happen so
plenty of good there i've gone 14 months
without a concert i still know the last
one i went to
and i'm still annoyed by it my last
concert was january of
2020 yeah february for me like
mid-february but still
it's awful well thanks for the talk and
uh thank you for having me in the chat
if anybody else comes up with any
additional questions
yeah yeah i'll be on with under cluthulu
i'll be in the chat uh
in the track 2 chat for let's say at
least the next hour
um so have fun