Ontology support for Ontology support for Management System Audit Management System Audit Programs Programs é g é Assisted Prot é g é Assisted Management System Auditing Management System Auditing Prot A. Gehrmann Gehrmann, S. , S. Ishizu Ishizu A. Aoyama Gakuin Gakuin University, Japan University, Japan Aoyama
Auditing and audit programs Auditing and audit programs • Caution • Caution: The term audit is used in many domains: : The term audit is used in many domains: Management, Computer security, Finance etc., Management, Computer security, Finance etc., • We refer to Management System Audits • We refer to Management System Audits as defined as defined in ISO 19011:2002 ISO 19011:2002: : in – systematic systematic, independent and , independent and documented process documented process for for – obtaining audit evidence and and evaluating evaluating it objectively to it objectively to obtaining audit evidence determine the extent to which to which audit criteria audit criteria are fulfilled; are fulfilled; determine the extent ISO 19011:2002 clause 3.1 audit ISO 19011:2002 clause 3.1 audit • A set of audits for a defined purpose constitutes an • A set of audits for a defined purpose constitutes an audit program; e.g. evaluation of effectiveness of ; e.g. evaluation of effectiveness of audit program management system management system
Problem and approach Problem and approach rd Party Management System Auditing is • 3 • 3 rd Party Management System Auditing is criticized for not delivering values; we see criticized for not delivering values; we see the difficulty to deal with organizational the difficulty to deal with organizational complexity as one main obstacle to value- - complexity as one main obstacle to value adding auditing adding auditing • We understand the management of • We understand the management of complexity of organizations as a main complexity of organizations as a main factor for improvement and propose the factor for improvement and propose the é g é for use of an audit ontology and prot é g é for use of an audit ontology and prot enhancing the value of auditing enhancing the value of auditing
Origins of complexity in 3 rd party auditing Origins of complexity in 3 rd party auditing 1. Third party auditors have to 1. Third party auditors have to deal with hundred of less deal with hundred of less familiar domain concepts in a very short time, but as in a very short time, but as familiar domain concepts human beings can cope only with 7 (+ / - - 2) concepts at 2) concepts at human beings can cope only with 7 (+ / a time a time 2. Management standards are 2. Management standards are generic in nature and give generic in nature and give raise to many interpretational issues, therefore , therefore raise to many interpretational issues fundamental concepts such as Quality, Contract, Design, fundamental concepts such as Quality, Contract, Design, I ntegrity and Availability of I nformation assets lacking I ntegrity and Availability of I nformation assets lacking often on clarity in the context of an organization and often on clarity in the context of an organization and are not shared consistently between the auditee and are not shared consistently between the auditee and the auditors; leads to conceptual inconsistencies / the auditors; leads to conceptual inconsistencies / clashes clashes 3. Many requirements 3. Many requirements might be applicable : Quality and might be applicable : Quality and I nformation Security, I T risk management based, I nformation Security, I T risk management based, ’ s client ’ s Quality Manuals, I nternal Procedures, Auditee ’ Quality Manuals, I nternal Procedures, Auditee s client ’ s ’ s client ’ s quality procedures specification, Auditee ’ s client ’ s quality procedures specification, Auditee 4. Demand on 4. Demand on documentation documentation is high is high 5. Organizational 5. Organizational complexity is high complexity is high (horizontal, vertical) (horizontal, vertical) 6. Auditing needs 6. Auditing needs team communication team communication
Conceptual clashes: Availability Conceptual clashes: Availability SP800- -30 (Appendix A): 30 (Appendix A): • SP800 I SO/ I EC 17799:2000 : I SO/ I EC 17799:2000 : • • • ensuring that authorized that authorized The security goal security goal that generates the that generates the ensuring The requirement for protection against requirement for protection against users have access have access to to users Intentional or accidental attempts to Intentional or accidental attempts to information and associated information and associated – Perform unauthorized deletion of Perform unauthorized deletion of – assets when required assets when required data or data or – Otherwise cause a denial of service Otherwise cause a denial of service – or data or data – Unauthorized use of system Unauthorized use of system – resources resources
é g é Auditing as on- -going knowledge acquisition with Prot going knowledge acquisition with Prot é g é Auditing as on Phase 4 Phase 1 Phase 3 Phase 2
é g é going knowledge acquisition with prot é g é Auditing as on- -going knowledge acquisition with prot Auditing as on Phase 1
é g é going knowledge acquisition with prot é g é Auditing as on- -going knowledge acquisition with prot Auditing as on Phase 2
é g é going knowledge acquisition with prot é g é Auditing as on- -going knowledge acquisition with prot Auditing as on Phase 3
Auditing as on- -going knowledge acquisition with prot going knowledge acquisition with prot é é g g é é Auditing as on Phase 4
A case: The auditee A case: The auditee -Total Business Information Systems Ltd. Total Business Information Systems Ltd.- - - CEO Procurement Finance Technical service IT Hardware Software IT Security Installation Medical Network Testing General Windows Novell Development 5 Levels, 50 Engineers, 10 technical assistants, 10 clerical staff Service: Total network solutions including information security solution
The task ahead The task ahead • 12 Interviews at 5 levels covering variety of • 12 Interviews at 5 levels covering variety of engineering fields engineering fields • Time available is limited to 3 working days • Time available is limited to 3 working days • 2 auditors • 2 auditors • CEO is non • CEO is non- -technician, lawyer technician, lawyer • Managers: Former Hacker, MBA • Managers: Former Hacker, MBA • Students, Part • Students, Part- -timer, non timer, non- -technical clerics technical clerics • 300 pages internal procedures and Management • 300 pages internal procedures and Management standard standard
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
TBIS structure -organizational units-
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Conduct interview, Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
Selecting stored requirements
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context of a process Select Right Level in organization Select Right interviewee Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
Selecting required processes and activities
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Conduct interview, Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
Recording an interview
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Gather facts Refer to controlled concepts Move in Organization Link information Confirm findings Make conclusions
C o n c e p t v e r i f i c a t i o n R e q u i r e m e n t s e l e c t i o n e q u i r e m e n t v e r i f i c a t i o n Access to controlled concepts
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
Understand Organizational Structure Identify Applicable Requirement Interpret Requirement In context Select Right Level in organization Select Right interviewee Gather facts Verify Common Understanding Move in Organization Link information Confirm findings Make conclusions
The audit console in Protege Organizational Units
Recommend
More recommend
