Information security audits & certification Security in Organizations 2011 Eric Verheul 1
Literature Main literature for this lecture: 1. NOREA beroepsregels http://www.norea.nl/Norea/Thema's/Gedrags- +en+beroepsregels/Richtlijn+Assurance-opdrachten 2. TTP.NL schema (http://www.ecp.nl/sites/default/files/TTP- NL_Scheme_version_8.1_final__June_2010_.pdf ) Variants on ISO 2700* 3. Common Criteria part 1 (http://standards.iso.org/ittf/PubliclyAvailableStandards/c050 341_ISO_IEC_15408-1_2009.zip ) 2
Assignment #5 • Assignment #3 is on Blackboard • It uses VMWARE image. This is available: • Through Klaus/DVD • On-line sftp://lilo.science.ru.nl/vol/xpsoftware/sio2009/image_1111 09/*.* Variants on ISO 2700* • Note: starting the VMWARE image takes time; first start the image then read the assignment 3
Outline • Audit introduction • IT security audits in general • management system certification audits • IT security product certification audits (‘common criteria’) • Recap & Practicum 4
Audit introduction Types of audits • The audits we are discussing include: • IT security audits in general, • management systemcertification audits, • IT security product certification audits • As there is – as far as we know – no common terminology used for these three types of audits simultaneously, we will introduce our own terminology. This is actually based on a combination of terms taken from these audit types. 5
Audit introduction Terminology • An audit is the process in which an competent, impartial judgment (‘ opinion ’) is formed on one or more aspects of an object (‘criteria’). • The result of an audit is typically a document in which the auditor expresses his opinion, the supporting findings and the limitations that apply. • The opinion provides assurance to the auditee itself or to a third party. • The assurance can be either positive or negative: • Positive assurance - An affirmative statement or opinion given by the auditor, generally based on a high level of work performed. • Negative assurance - A statement indicating that nothing came to the auditor's attention indicating that the subject matter in question did not meet a specified criteria. 6
Audit introduction Terminology Scheme Criteria maintainer maintainer (e.g. association organization) Independent overseer (e.g. association organization) Audit Audit Audit Auditor Criteria Scheme Object Opinion (report) 7
Audit introduction Terminology • The audit process should be reproducible and should not depend on the (qualified) auditor. • An opinion can also take the form of a ‘certificate’. • Audits are historically associated with accounting: a financial audit of the financial accounts (‘ jaarrekening audit’) performed by (registered) accountants. In this situation the criteria are based on the laws on accounting (‘ Wet op de jaarrekening ’). In the accounting context the term ‘audit’ is a very sensitive notion. 8
Audit introduction Terminology • The audit is performed for a client , that also sponsors the audit. • The aspects that form the basis of the audit are formulated as a set of criteria ( audit criteria ), determined prior to the actual audit and agreed upon with the client. In Dutch these criteria are sometimes ‘ de gehanteerde (audit) norm ’. • The set of criteria could be an open standard, a tailored version of it, or even some assertions made by the client management. In the latter case, the opinion can be a statement of the auditor that the assertions are correct. • The object type can vary, examples are: a person, a product, a process, a system or an organization. 9
Audit introduction Audit schemes • Closely linked with the audit criteria is the audit scheme used. These are rules describing how the audits shall be conducted and what requirements should be met by the auditor organization itself • An audit scheme provides a ‘manual’ for conducting audits and typically answers questions like: • What steps shall an audit have? • When is a criterion met? • What qualifications should an auditor have? • When can the auditor ‘built’ on prior work done by other auditors? • When can an opinion be provided and what can be part of it? 10
Audit introduction Audit schemes Important general topics in audit schemes are: • impartiality requirements of auditors and the organizations they work for, • confidentiality, • providing auditees the opportunity to respond to findings (‘ hoor en wederhoor ’) • ethics, e.g., ‘do not audit your own work’, • quality, e.g. filing of evidence 11
Audit introduction Audit schemes The audit scheme can be: • an open standard itself, e.g., • ISO 19011 ‘Guidelines for quality and/or environmental management systems auditing’ • ISO/IEC 17021 ‘Requirements for bodies providing audit and certification of management systems, • and its particularization ISO 27006 ‘Requirements for bodies providing audit and certification of information security management systems’ • a dedicated document, e.g., the TTP- NL scheme ‘Scheme For Certification of Certification Authorities against ETSI TS 101 456’ • or it could be part of the rules of conduct of the professional associations (‘ beroepsverenigingen ’) of auditors, e.g. of NOREA (http://www.norea.nl/Norea/Thema's/Gedrags- +en+beroepsregels/Richtlijn+Assurance-opdrachten) or ISACA (www.isaca.org). 12
Audit introduction Terminology Object Criteria Scheme Opinion Source: https://cert.webtrust.org/SealFile?seal=304&file=pdf 13
Audit introduction Terminology Scheme Criteria maintainer maintainer (e.g. association organization) Independent overseer (e.g. association organization) Audit Audit Audit Auditor Criteria Scheme Object Opinion (report) 14
Outline • Audit introduction • IT security audits in general • management systemcertification audits, • IT security product certification audits (‘common criteria’) • Recap & Practicum 15
IT security audits in general IT (security) audits • An IT security audit is a particular type of an IT audit. • An IT audit is also known as an EDP audit and focuses on the following aspects of IT systems (cf. COBIT): • Effectiveness • Efficiency • Compliance • Reliability • Confidentiality • Integrity • Availability • An IT audit can therefore include much more than information security. 16
IT security audits in general IT audit aspects • Effectiveness Deals with information being relevant and pertinent to the business process as well as being delivered in a timely, correct, consistent and usable manner. • Efficiency Concerns the provision of information through the optimal (most productive and economical) usage of resources • Reliability Relates to systems providing management with appropriate information for it to use in operating the entity, in providing financial reporting to users of the financial information, and in providing information to report to regulatory bodies with regard to compliance with laws and regulations • Compliance Deals with complying with those laws, regulations and contractual arrangements to which the business process is subject; i.e., externally imposed business criteria 17
IT security audits in general IT effectiveness 18
IT security audits in general IT audit aspects • Confidentiality Concerns protection of sensitive information from unauthorized disclosure. • Integrity Relates to the accuracy and completeness of information as well as to its validity in accordance with the business' set of values and expectations. • Availability Relates to information being available when required by the business process, and hence also concerns the safeguarding of resources. 19
IT security audits in general IT security audits • IT security audits (aka IT security reviews) concentrate on information security aspects, i.e.: • Confidentiality • Integrity • Availability • Sometimes IT security audits are called IT security reviews to prevent confusion with financial audits. • IT security audits can be: • technically oriented; then the objects are IT systems, e.g., a whole IT infrastructure, a network, a Windows environment, a specific application • process oriented; then the objects are IT processes, e.g., a security management process, a change management process. • The audit criteria are typically formulated in information security objectives or security controls, e.g. based on ISO 27002. 20
IT security audits in general Example of technical IT Security criteria 21
IT security audits in general Example of non-technical IT Security criteria 22
IT security audits in general Audit evidence • Practically speaking, the auditor should: • determine the scope of the audit (e.g., Windows based office automation network), • agree the audit criteria with the audit sponsor and put them in a table and compare the criteria with the object setting. • But what should an auditor accept as compliance evidence? 23
IT security audits in general Audit evidence • What if the IT administrator says in an interview: ‘Sure, we have this password policy and account lockout setting’? • What if there is an official document stating compliance with these setting? • When should you believe this setting is actually implemented? 24
Recommend
More recommend
