Audit: Information Security Essay

Submitted By kemeisha28
Words: 2930
Pages: 12
Open Document
2010 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology

A Security Framework for Audit and Manage Information System Security
Teresa Susana Mendes Pereira
Informatics Department
Superior School of Business Studies
Polytechnic Institute of Viana do Castelo
Valenca, Portugal
¸
Email: tpereira@esce.ipvc.pt

Henrique Santos
Information System Department
School of Engineering
University of Minho
Guimaraes, Portugal
˜
Email: hsantos@dsi.uminho.pt

established security standard ISO/IEC_JTCI11 [4].
The paper is structured as follows: in the section II it will be presented an overview of security management concepts; section III presents the proposed conceptual model, which contains the semantic concepts specified in the information security domain, and their relationships, hierarchical structured in an ontology; section IV presents the proposed framework to manage and audit information systems security, based on the ontology structure; conclusions and future work are presented in section V.

Abstract—Auditing Information Systems Security is difficult and becomes crucial to ensure the daily operational activities of organizations as well as to promote competition and to create new business opportunities. A conceptual security framework to manage and audit Information System Security is proposed and discussed. The proposed framework is based on a conceptual model approach, based on the ISO/IEC_JCT1 standards, to assist organizations to better manage their Information
Systems Security.
Keywords-Security audit management, information system security, ontology and conceptual model.

II. S ECURITY M ANAGEMENT

I. I NTRODUCTION

Managing information system security is increasingly concerning organizations, due to the continuous growing dependence of organizations on technology to conduct theirs businesses, to create a competitive advantage and achieving higher ROI. Organizations rely significantly on technology, such as Internet, for businesses operations and secure business transactions [6]. However organizations must consider how they are going to succeed to the continuous changing risk environment, since the technical controls alone are no longer guaranteed, but mainly dependent on other security requirements such as legislation, culture or the environment
[6]. Currently security is a fundamental principle for organizations businesses performance. As a result, organizations need to evolve security management strategies in response to the evolving information security requirements. A properly security strategy demands for a rigorous process, similar to any other business process, where every agent interacting with critical resources need to be aware and participate in security management, both adopting secure behaviors and continuous evaluating security control’s performance [1].
The regular audit of information system security is one approach to evaluate the organizations information systems practices and operations. An auditing process will enable to obtain evidences of organizations information systems security policies efficiency to maintain the assets integrity, confidentiality and availability, the typical organizations security

Speed and accessibility operations promoted by information and communication technologies, particularly the
Internet and the new Internet-enabled services, leads the organizations to become heavily dependent on the performance of their information systems. On the other hand the evolution of wireless communication and the rapid growth and availability of new services to facilitate accessibility, such as, for example, the new cloud computing services, have been gaining popularity not just by the organizations, but by generic users as well. Although these new solutions offer a better service with a promising technological initiatives at low operating cost, they also brings a set of new and
unexpected
Show More

Related Documents: Audit: Information Security Essay

Sarbanes Oxley Summary Essay

quality of their audit Oversight and management of risk Oversight of the preparation of financial statements Review of compensation agreements with senior executives Resources available to directors to carry out their duties Nomination of individuals for positions on the board. What went wrong? Executive compensation grossly disproportionate to corporate result CEOs and senior executives involved in a serious conflict of interest Misuse of corporate funds Trading on insider information Misrepresentation…

Words 3806 - Pages 16

Essay on Article Review

paper of Suduc, Bizoi and Filip (2010), based on the introduction of current IT security risks and several audit standards, the authors suggest two main audit plans for information system security. In another paper (Suresh 2009), the author mentions a presentation issue in information governance that many executives don’t pay enough attention on information controls, in addition, the author recommends COBIT to be a good audit framework for IT governance. 2. Analysis In the paper of Suduc, Bizoi…

Words 535 - Pages 3

Auditing and Assurance Services Essay

Chapter One – The Demand for Audit and Other Assurance Services Objective 1.1 Describe Auditing. Auditing is the accumulation and evaluation of evidence about information to determine and report on the degree of correspondence between the information and established criteria. Auditing should be done by a competent, independent person. The criteria for evaluating information vary depending on the information being audited. In the audit of historical financial statements by CPA firms, the criteria…

Words 853 - Pages 4

QTTR Pre Audit Survey Essay

QTTR pre-audit survey ---The Third Floor This pre-audit survey is a structured questionnaire to guide the QTTR auditors in testing the third floor of XYZ Company being audited. Scoping and pre-audit survey During this phase, the QTTR auditors determine the area (the third floor) of focus for the audit that is explicitly out-of-scope, based on an initial risk-based assessment plus discussion with clients and director. During the pre-audit survey, the QTTR auditors identify and ideally make…

Words 1667 - Pages 7

Audit and Audit Standards Essay

The intent of testing is to appraise the level of security and identify vulnerabilities for mitigation measures. Vulnerability assessments identify and report on security weaknesses and vulnerabilities in the target system. This analysis is an important element of any activity in risk management. Vulnerability assessment components help in integrating all the steps in this analysis by automating the process of detecting, identifying, measuring, and understanding the vulnerabilities found in a target…

Words 650 - Pages 3

Case Study Essay

Guidance required by auditors on contingencies: Contingent fee arrangement can be described as a fee structure that gives incentives to the auditors for completing the audit work on or before time and could get penalized for not being able to complete the audit work on time. Contingent fee structure could create bonus or incentives for the auditors for assessing the highest amount of tax and for interpreting the laws and regulations aggressively. The auditors are not eligible for any incentive for…

Words 652 - Pages 3

STARBUCKS CORP2 Essay

certain regulations based on the Securities and Exchange Commission or better known at the SEC (IAC, 2012). The role of the Securities and Exchange Commission or SEC is to protect investors and shareholders by maintaining fair markets (US Securities and Exchange Commission). The SEC enforces two laws: The Securities Act of 1933 (also referred to as the “truth in securities” law) and the Securities Exchange Act of 1934 (US Securities and Exchange Commission). Securities to be sold in the United States…

Words 657 - Pages 3

The Role Of The Public Accountant In The American Economy

companies filed for bankruptcy and constituted the largest companies in American history to do so. The extent of the accounting irregularities and fraud being investigated and disclosed brought into question the effectiveness of financial statement audits. In addition, the criminal conviction of Arthur Andersen, LLP, one of the then Big 5 accounting firms, on charges of…

Words 5490 - Pages 22

DOT Arra Case Essay

department established a number of websites supported by servers and databases that the public could access to monitor the spending of their tax dollars. The DOT’s expanded web interface inherently exposed it to greater risk. This case study reviews an audit of that risk, the department’s shortfalls in mitigating the risk, its systems that may have contributed to those failures, and this reviewer’s recommended solutions. Case Study Review Situation That legislation required unprecedented levels…

Words 828 - Pages 4

A Breach of Professional Accounting Ethics Essay

depending on the crime. As part of the largest financial fraud in U.S. history, in March 2009 David Friehling an American accountant was arrested and charged for his role in the Madoff investment scandal. For many years, Bernard L. Madoff Investment Securities LLC books were audited by Friehling & Horowitz, a little-known accounting firm in New City, New York (Wikipedia, 2009). The firm consisted of two principles-Friehling and Jerome Horowitz-and a secretary. Horowitz met Madoff in 1963, when the Madoff…

Words 1426 - Pages 6