120 - How to conduct a security audit

Tutorial:OverviewHow To Conduct ASecurity AuditInformation security encompasses more than just IT systems - people who use the systemscan also inadvertently open security loopholes. A security audit aims to detect and highlightany problem areas within the IT infrastructure and staff behaviours.By Justin Kappefore you can assess what you rity audit comprises a number of pertise and ability to communicate theare securing or about to audit it stages, summarised in Figure 1. These findings of the audit.Bis important to understand stages will be covered in more detail It is also important that the auditorwhat it is you are protecting. Your final later. has an understanding of the organisa-goal is to have your information se- You can choose to focus the audit on tion under review. When auditing sys-cured and to minimise the risk of los- different areas, such as the firewall, tems that hold data which requiresing this information. host or network. However, a security security clearance from government,Firstly we should define what infor- audit will address issues with your IT then the auditor must have the re-mation security is. Information is an systems, including software and hard- quired clearances in order to access theasset; like other important business as- ware, your infrastructure (such as systems holding the data.sets it has a value to an organisation mains power, telecomms), your proce- When you perform a security auditand consequently it needs to be ...