Q&A

Former ISACA Head: SAS 70 Changes Coming

Marios Damianides, a partner in Ernst & Young's technology and security risk services group and past president of ISACA's board of directors, expects changes for SAS 70 and more collaboration between security and non-security management groups

By Bill Brenner, Senior Editor

Page 2

ISACA has a formal working relationship with ASIS and ISSA. How did that come about?
Some years back the then-president of ISSA and I were speaking at a conference in L.A. and we met afterwards and agreed there was a lot of commonality between what the two groups were doing. We also agreed there was a convergence happening between the physical and the logical security worlds, and we ultimately invited the ASIS folks to join us in the discussion. That's how our alliance was born.

What specifically have the three groups achieved together?
We've brought together the various professionals at the management level of organizations, the technical security practitioners who aspire to be managers, and the physical security leadership. We issued several joint studies, including a convergence study a couple years ago and we have set up security councils.

What's the next step?
We're talking to groups more focused on program management to see if they would consider a closer working relationship with us, and we want to expand how we look at security convergence beyond our individual boundaries. We want to look at security in a broader form than what the three of us are focused on.

The functions represented by these organizations all have an obvious connection to the "risk management" function, i.e. the Risk and Insurance Management Society (RIMS) and the insurance world. Have you approached them? What might be achieved by working with those folks?
We have approached them. We considered if there was a broader risk framework that could be deployed and thought that since RIMS has some of those elements taken care of it could be framework we could adopt, adapt and develop a common methodology. We've had discussions. It's something that's in progress.

There's been a lot of turmoil in the banking sector of late, especially with the FBI investigating several lenders for mortgage fraud. Talk about the affect this has had, if any, on how security, audit, loss prevention and related functions/fields need to work together.
The problems in this sector are leading to more changes around compliance. In some instances, there was either no policy or policies that were not in tune with the speed and functionality of today's environment. The policies were written when there was more time to do analysis and to take into account everything out there, and when the speed of information picked up, analysts started cutting corners to keep up. So policies are being revised to make sure corners are not being cut when system data is reviewed.