I am currently the team lead of the IT audit and risk team at my company. Recently business processes in IT are being re-engineered and management has approached us about assisting them to improve certain IT controls and cybersecurity incident response procedures.
While I have decent experience in IT security / risk management domain from several years of work experience and soon to be CISA, I am always open to critique and hearing of current best practices as cyber security is a very dynamic field within IT. Many members of my professional network work in InfoSec and I am in fairly close contact with them. We do not work in the same industries and we do not compete as rivals.
I would like to ask them about some successful techniques / best practices they may be using to monitor cybersecurity controls at their company, without coming across as intrusive. I realize this knowledge is security sensitive and may be exploitable by blackhats if misused. I also realize that from a business perspective, I am a 3rd party that should rightly raise trust issues.
Is asking other professionals in the same industry in your network to share such knowledge appropriate in such circumstances?
If yes, how can I ask for such knowledge sharing without appearing self - serving or intrusive?