Information Security Audit
Name
Institution

Information Security Audit When conducting information security audit may people tends to confuse it with information systems audit. Information system audit is a substantial, expansive term that envelops boundary of obligations, equipment an server administration, incidents and problem administration, safety, network division, privacy and security assurance (Pathak, 2004). Then again, as the name suggests, information security audit has a one point plan and that is the security of information and data when it is at the point of being transmitted and stored. Here, information should not be mistaken for just electronic information as print information is similarly critical and its security is secured during the audit process. There is a process that is followed when conducting information security audit. The first step in the information security audit is identifying assets and classifying them. This is the methodology of distinguishing valuable resources and classifying them into groups that are manageable. There are different approaches to assemble this information, including talking with key IT staff, inspecting any past reviews, and exploring stock records. In the wake of distinguishing resources, group them in relation to availability, integrity and confidentiality. Example of resources that need confidentiality that is strict are under study grades, bank records, and health records. Resources that oblige integrity (significance they can't be modified) incorporate payroll and lesson plans. Resources that need to be available anytime they are required are participation frameworks, lesson plans, and online frameworks that give homework overhauls to students. By performing this step, you'll realize what particularly needs security and what kind of protection may be justified. The second step in the security audit process vulnerability and threat evaluation (Pathak, 2004). This is a standout amongst the most paramount steps in the information security review process. When all assets have been grouped, list potential threats to the grouped assets. The National Institute of Standards and Technology characterizes a risk source, as any situation or occasion with the possibility to cause mischief to an IT framework. Next, focus the relating vulnerabilities for every danger source. A helplessness can be activated incidentally for instance, a framework crash that happens because of a surge or a system configuration imperfection or deliberately, for example, an understudy hacking into the system and changing his or her evaluations. It is important to note that it is advisable to seek for professional services from an external information security auditors, in order for him or her to identify potential threats as well as vulnerabilities to an organization’s information security. The third step in the security audit involves evaluating the security control measures put in place by the organization. When resources, vulnerabilities and threats have been recognized, assess potential countermeasures. These ought to be considered as far as whether they counteract, distinguish, or react to assaults and whether they're specialized, strategy, or faculty arranged. The fundamental purpose of this step is to figure out if a single security plan is sufficient for securing information within an organization (Böhr & Müller, 2013). The main objective of this step is to determine whether the security measures put in place by the firm, under review are sufficient to ensure that the data is secure from the various threats as well as vulnerabilities identified in the step two above. The last step in the IS review process involves analyzing the information gathered, making decision and documenting the decision made. This involves dissecting your controls and after that settling on choices about which ones you need to execute. Start with an expense advantage examination. Assessment costs for all recommended defends and dole out a dollar add up to the normal formal for everyone. Notwithstanding the genuine sticker, make certain to consider execution, operations, support, convenience, versatility, and execution costs (Moeller, 2010). In numerous examples, more than one controlled measures will be distinguished to relieve a danger. For every risk or danger, focus on what degree they chose protections will diminish the probability of an event, the harm of such an occurrence, or both. The cost-benefit examination, alongside whatever is left of your review information, ought to be incorporated in a formal report. Notwithstanding furnishing administration with the data they have to choose proper countermeasures, it makes gauge information for the future reviews. It is important to know that COBIT can help in the IS audit process. As in any IT review process, to be viable, COBIT ought to address internal control, compliance, governance issues and risk management. COBIT (Control Objectives for Information and Related Technology) is a benchmarked system, outlined, created and consistently upgraded by the Information System Audit and Control Association (ISACA) for successful IT administration and management (Halpert, 2011). The objective of this system is to 'research, create, advertise and advance a legitimate, progressive, worldwide set off for the most part acknowledged data engineering control targets for normal use by business chiefs, IT, review and confirmation experts.' Fundamentally, COBIT methodology goes for synchronizing business destinations with IT objectives and methods for streamlining the venture goals. The IT inspector ought to take after a Risk-Based Approach (RBA) to IT review, surveying inalienable dangers, control risks and group risks and ordering dangers into moderate, high and high, and assessing the controls to relieve them to an acknowledged level in the association, in light of its hazard hankering. COBIT structure outfits the IT reviewer with element ideas, methods, techniques and structures for move to change administrations, with point by point control driven review agendas and conceivable wellsprings of confirmation social occasion, for giving affirmation in regards to the viability of controls (Halpert, 2011).
The structure assesses if all the progressions are legitimately overseen, changes are logged, evaluated, verified, approved and surveyed, against the focused on subjective and quantitative parameters, measuring the conclusions. While investigating the endeavor documentation, the IT examiner ought to search for confirmation of organization of the best practices for frameworks improvement lifecycle (SDLC) by utilizing the development model. The risk, consistence and administration based approach gives information security, database uprightness, and ceaseless vigilance on data structural planning.

References
Böhr, F., Ly, L., & Müller, G. (2013). Business Process Security Analysis – Design Time, Run Time, Audit Time. It – Information Technology, 55(6).
Halpert, B. (2011). Auditing cloud computing. Hoboken, N.J.: John Wiley & Sons.
Moeller, R. (2010). IT audit, control, and security. Hoboken, N.J.: Wiley.
Pathak, J. (2004). Internal Audit and Corporate Governance: A Program for Information Security Review Audit. EDPACS, 31(7), 1-13.