Question on IT Auditor Access Rights

and on a need-to-know basis only. Network admins probably have access to company confidential information just like HR and payroll and auditors have access to specific types of confidential information. Auditors are sometimes given read-only access only to information needed during the conduct of a particular audit. Once the audit is completed, there is usually no need for an auditor to have access. As an IT auditor this person should realize that the more eyes there are on something, the better chance that information can be misused.

If you work at a public company, this issue may also arise when you are audited by the external auditors. They will check some or all of the most relevant financial reporting systems to see who has access. They will be mostly concerned with update access but will likely raise a red flag if someone has unnecessary read privileges also. Again, it could be a security risk.

Your company should also have a security policy that states what access rights are appropriate.

External auditor, vetting a job control system.
And how do you do this from here ?
Oh I can't my boss can though.
Where is your boss ?
Out to lunch, hold on I'll log on as him.

True story, red faces all round. Lax password security featured in his report for some reason.

The point though is if he's an auditor, he needs nothing more than guest access. If he's there to make sure you pass external audits, then he needs to be able to check out what scams I mean workarounds are in play and whether your company is going to get caught.

Two very different scenarios.

I am an (internal) IT auditor at a major multinational, and I have NOT ONE special right to any OS-level areas. In the event that we are testing/ auditing in such an area, we might ask for temporary access. More likely, we would work with a resource who normally has the access we need, to see how they normally handle situations. We also request reports run from consoles, etc.

The only special access we have is elevated view access to the SOX documentation for the business unit where we are currently auditing, since that helps give us a head start on understanding the system layout before we arrive at the site.

If anything, I now have way LESS access than I did when I was in a regular IT line position, because I do not need it.

My opinion: this person clearly does not understand the basic tenet of security --> never have more of it than you need, and as such has no business being an auditor. It sounds to me like what he is, is nosy!

A story for your colleague ... I once left a client site as a consultant and when I left, as normal, I requested that my access be terminated. Well, instead of terminating my access, the admin changed the password and was USING my account! He made some very foolish changes, all done under MY user ID, and it took some very fast talking (and some security logs) to prove it was not actually me that did it. Since then, when I leave a site, I stand behind the admin while they show me that the account has been removed. That way, even if they recreate the same named user ID, the SSID is never the same.

Our Internal Auditor, who is working to put together and try to learn enough to do IT Audits, has the access rights of a normal user. If there is something that she needs, say from the loan department, she simply goes for the hard copy, or they provide it upon request.
I would think that an IT Auditor would not need full-time read access to the domain. Audits are typically based on scope, so if he has an audit, he should provide you with the scope of it, and then he would have access to that information. It's up to your organization on how to grant that information (giving read access, hardcopies, whatever).

That would be what I would think anyways, but like I said, we're still working on having an internal IT Audit that's not done by myself.

If you have any system management tools - they may come with auditing/reporting tools that would be granted. Then most other OS level access can be minimized. Beyond that when he needs specific access, you could have a nice LDAP container set up and ready to go to drop him into temporarily to allow his access (just one of many methods).
ASk him for his audit charter and plan. What items is he scoped for auditing within IT? Lay the boundaries - he doesn't need admin access as before, even read only on most things, as long as he can monitor the changes to the systems and accounts.

Thanks for everyone's input. I think this will be helpful and at least for now we have been able to shoot down the "read-only" access for the entire domain. Our stance has always been that he should be trying to find things as a 'normal' or 'outside' user so we can correct them. If you have elevated access you may miss things that aren't configured correctly since you take for granted your access. One MAJOR reason we don't want to grant access is that after leaving this guy already abused the system by utilizing an admin account that hadn't had its password changed yet to gain access to things he shouldn't have and logging in as different users. Quite honestly he shouldn't still be employed here, but our CIO handcuffed us to be politically correct and allowed it to happen. I didn't want to mention that originally because I wanted unbiased opinions from anyone reading this. I appreciate the help!