Question 1. What is the role of an internal IT audit group in an organization? Why is having such a group important for an organization and why should it report outside the normal IT reporting channels?
Question 2. Where should threat modeling be used in the system development process? Why is it so challenging for some individuals to understand? What can be done to make learning how to do it effectively easier?