IT Security Audits: Processes, Frameworks, and Best Practices

Introduction

ICT advancements have made vast quantities of data available, but they have also created considerable risks to the data itself, to computer systems, and to the critical infrastructures and operations those systems support. Despite developments in information security, numerous information systems continue to display susceptibility to both external and internal breaches (Suduc, Bîzoi & Filip, 2010). Internal information security auditing enhances the likelihood that suitable security measures will be implemented to avert such breaches and reduce their adverse impacts.

Security Risks to Information Systems

Two classes of risks exist against which corporate information systems require protection: logical and physical. Physical risks are more concerned with devices than with the information system itself and encompass natural calamities such as floods, earthquakes, and typhoons, as well as terror attacks, vandalism, fire, illegal tampering, power surges, and break-ins. Vlad and Lenghel (2017) put forward a collection of controls defending information systems from such physical threats.

These controls include different kinds of locks, hardware insurance coverage, and coverage of information recreation costs; processes for everyday data and information system backups; tested, state-of-the-art disaster recovery interventions; and rotation and off-site backup data storage in a secure location. Logical risks denote illegal access and purposeful or inadvertent modification or destruction of information or entire information systems. Such threats may be reduced using logical security controls that limit user system accessibility and prevent unauthorized system access. All of these precautions become increasingly important when dealing with central information systems.

Suduc and colleagues (2010) identify the following major kinds of information technology risks that modern corporations must address: availability, security, compliance, and performance risks. Security risks encompass accessing data without permission, including information leakage, fraud, endpoint security concerns, and data privacy violations. This class also includes broad threats from external sources (e.g., viruses) and more targeted attacks on particular users, data, or applications. A survey performed by Ernst and Young revealed that security incidents cost organizations as much as $17–28 million per case (Suduc et al., 2010). A second study conducted over 13 years with the assistance of 522 American IT security experts identified virus incidents as the most frequent risk (reported by 49 percent of respondent firms), followed by insider network abuse (44 percent) and mobile device — including laptop — theft (42 percent) (Suduc et al., 2010). Corporate security measures tend to concentrate on external threats owing to their high incidence — sometimes accounting for more than half of all risks — and the fact that they exploit legitimate network use.

The Case for IT Security Auditing

Khan (2017) reports that despite significant developments in information security — including object/subject access matrix models, star-property and information-flow-reliant multilevel security, access control lists, cryptographic protocols, and public-key cryptography — many information systems remain at risk of both internal and external attacks. Security configurations are time-consuming to establish and contribute nothing to productive output; consequently, an overly permissive setup may go unnoticed until an audit is conducted or the system is actually attacked. This finding underscores the need for internal IT security auditing in all organizations.

According to an experienced Security Administrator and System Auditor with nearly two decades of experience, the following computer activity domains must be routinely monitored: user access control, audit trails, and system activity monitoring (Davis & Yen, 2019; Suduc et al., 2010). These tasks relate to the primary security measure adoption mechanisms described by Suduc and colleagues (2010), which include authenticating principals (identifying which individuals, groups, programs, or devices have access to data), authorizing access (determining which entities are permitted to carry out specific operations on a given object), and decision auditing (determining what occurred and why).

The goal of user access control security is to optimize productive computing time, guarantee data confidentiality, mitigate fraud and error risks, and prevent unauthorized access. Permanent monitoring of system activity is equally vital, since malicious fraud and sabotage are more likely to occur when the probability of detection is low. The following questions should be posed concerning potential risk areas: (1) Can this event occur here? (2) In what form will it transpire? (3) Do current security measures prove sufficient for threat prevention and detection? (4) How can the measures be improved? (Suduc et al., 2010). The application of sound system controls and security practices can, to a great extent, decrease the occurrence and adverse effects of risk events by improving the chances of detection and prevention.

Maintaining thorough logs of access time, the credentials of the accessing individual, and whether a security breach was attempted constitutes a second essential security action. These details prove highly informative to system auditors.

Conclusion

A variety of security methods may be adopted, and the appropriate set of security processes depends on the likely risks faced by a given organization. However, for proper and successful protection of company assets, it is necessary to assess existing security measures critically. Both external and internal security audits represent an ideal means of determining the effectiveness of a firm's security posture. Numerous security auditing standards exist that outline the procedures required to ensure adequate protection of a company's IT resources. Firms suffering significant losses due to inadequate information system security should consider implementing regular security audits as a foundational element of their risk management strategy.