By assessing the security understanding of unit managers and staff, an auditor can gain a sense of the overall security program's effectiveness. Once an organization has made a commitment to security, it wants to ensure the investment is not being undermined by poor practices. Quantifying results can range from evaluating the security education program to assessing how different business groups incorporate security into their daily operations and functions. The Western Union breach happened because the IT staff disabled database-encryption protocols and left the network connected to the Internet while performing routine maintenance. An audit in this case may have revealed some of the flawed practices.
Technology is only as effective and secure as the people flipping the switches.
Many organizations become comfortable with their internal evaluation methods and fall into a routine of diagnostic tasks that reveal few weaknesses. An independent audit, using the same tools, can sometimes find overlooked security gaps. The fatal flaw in most antivirus programs and intrusion detection systems is that they typically react to yesterday's threats. Malicious users are constantly coming up with new vectors of attack to penetrate defenses and capture digital goodies. IT professionals may believe their security measures are working as intended, and for today's risks they may be right.