Guide: Assessing Context, Priorities and Learning Styles (Integrated Security) ACTIVITIES INTERVIEWS Summary The auditor conducts interviews with various staff members to gather information on the organizations risks and capacity. Q&A sessions are unabashedly white box aspects of a security assessment, and you will occasionally hear push-back along the lines of, "You wouldn't have found that thing if we hadn't told you about this other thing." Compelling black box findings certainly do have an advantage when it comes to persuasiveness, but obtaining them can be quite timeconsuming, so relying exclusively on vulnerabilities that you can identify without "help" is generally a mistake in this resource-constrained sector. Overview Set up secure channels for communication Interview managerial staff Interview technical staff Use the Categories (at the end of the sample interview questions) to help scope which questions to ask Use the Capacity Assessment Cheat-Sheet to track topics you have covered Materials Needed Considerations If the auditor or organization believes that there is a good chance of surveillance on the channel you are communicating over, do the rest of the interview on a secured channel or in person where possible, though some information-gathering is critical to do before planning the audit. Inability to do so contributes towards a no-go situation. Walkthrough Page 31 of 240