I’ve spent the last few years working in IT support, and over that time I’ve become increasingly interested in the parts of IT that sit behind the technology itself.
When I first moved into IT, my focus was naturally on the technical side. Getting users back up and running, troubleshooting devices, working through Microsoft 365 issues and understanding why something wasn’t behaving as expected. That’s still a big part of what I do, and I enjoy it.
But the more experience I’ve gained, the more I’ve started paying attention to what sits around those technical problems.
How is something actually being managed? Why does a particular process work the way it does? Who is responsible for it? What happens when the documented process doesn’t match what people are actually doing? How do you know that the controls you have in place are doing what you expect them to do?
That’s where my interest in ISO 27001 has come from.
It’s more than the technology#
Working in IT, it’s very easy to think about security in terms of the technology in front of you. MFA, Conditional Access, device compliance, permissions, endpoint controls and logging are all things I work with as part of my normal role.
They’re important, but they’re only part of the picture.
The technology sits inside a much wider environment of people, processes, information and responsibilities. A technical control can be configured correctly and still not achieve what you expect if the process around it isn’t clear, or if nobody really understands who is responsible for maintaining it.
That’s one of the things I find interesting about information security.
It’s not simply about finding the right setting in a portal. There is a much bigger question around how an organisation understands and manages its information and the risks associated with it.
Risk is the part that really interests me#
I’m still learning about this, so I’m not going to pretend I have years of information security or GRC experience behind me.
What I do find interesting is the idea of understanding risk properly rather than simply reacting to individual problems.
What are we actually trying to protect? What could affect it? What would the impact be? What controls do we already have? Are those controls appropriate? Are they actually working? And perhaps most importantly, how do we know?
Those questions feel quite natural to me because they are not completely separate from the way I already approach troubleshooting.
When something doesn’t work, I don’t want to immediately start changing things. I want to understand what is happening first. I’ll look at the available evidence, work through what I can establish and then decide what needs to happen.
I’m finding that I have a similar interest in the security side of things. Understand the situation first, then work out what needs to be done about it.
I’ve already seen some of this in my day-to-day work#
I’m not implementing ISO 27001 in my current role, and I wouldn’t claim that I am.
What I have done is work with areas that have made me more interested in the wider subject.
I regularly deal with identity and access, device compliance, authentication, Conditional Access and audit information. I’ve also worked on documentation and processes where the information available no longer matched the way something was actually being done.
One example was reviewing Joiner, Mover and Leaver documentation and removing legacy steps that no longer reflected the current environment.
That was a relatively practical piece of work, but I found myself thinking about the wider process rather than just editing the document. Why was the process written that way in the first place? Which parts were still relevant? What information did someone actually need to complete the task properly?
That sort of thing has made me more interested in the relationship between technology, process and control.
This is also where my ITIL studies have helped#
I’ve spent a lot of time recently working through ITIL v5, including Foundation, Strategy and Product.
I’m not trying to turn everything I do into an ITIL exercise, but studying service management has changed the way I look at some of the work I’m already doing.
It has made me more conscious of things like outcomes, processes, value, dependencies and continual improvement. It has also made me more interested in what happens around an individual technical issue rather than just the issue itself.
That way of thinking connects quite naturally with what I’m finding interesting about information security.
A problem doesn’t always exist in isolation. There is usually something around it that explains why it happened, how it is managed and what could be done differently.
I’m working towards ISO 27001#
This is an area I’m genuinely interested in developing in, which is why I’m working towards further ISO 27001 training.
I’m particularly interested in understanding the standard properly rather than simply collecting another qualification. I want to understand how an information security management system works in practice, how organisations approach risk, how controls are selected and managed, and how you can use evidence to understand whether things are actually working.
I’m also interested in the auditing side of it because there is something I find appealing about looking at what an organisation says it does and then being able to establish what is actually happening.
That is still something I’m learning about rather than something I currently do professionally, and I think it’s important to make that distinction.
Why I think it suits the way I work#
The more I learn about ISO 27001, the more I can see why it interests me.
I like understanding how things work. I like looking for gaps. I like working through evidence rather than making assumptions, and I like the idea of improving something rather than simply accepting that it has always been done that way.
That doesn’t mean every problem needs a complicated process or another document.
Sometimes the right answer is very simple.
But I think there is real value in being able to look at something and ask whether it is working as intended, whether the risks are understood and whether there is evidence to support what we believe is happening.
That’s the part of ISO 27001 that interests me. I’m still learning it, and I have plenty more to learn.
But it’s an area that genuinely interests me, and I’m looking forward to seeing where that learning takes me.