IT security audit: An introduction

All organizations handling user data are expected to ensure data confidentiality, integrity, and availability, also known as the CIA triad. Confidentiality refers to protection from unauthorized viewers. Integrity is maintaining the data accuracy over its entire life cycle. And data should be available when required—a disaster recovery plan should be in place for worst case scenarios.

Organizations employ risk management systems to identify vulnerabilities and threats to their data assets. IT security auditing is the collection of evidence that the IT controls, security systems, and risk mitigation strategies employed by the organization are up to industry standards.

Some of these standards are NIST Cyber Security Framework (NIST CSF), ISO 27001, and IEC 62443, which define techniques and guidelines for cybersecurity. Compliance regulations vary with industry and region.

Since both the business environment and the threat landscape are constantly evolving, this is an iterative process. Risk management and subsequent auditing of risks should therefore be a continuous process rather than a one-time or infrequent assessment. It's important to have an IT security audit system in place.

Broadly speaking, IT security audits evaluate:

• Security
• Controls
• Performance
• Risk mitigation processes

Security of IT systems refers to the firewall security in the network, physical access security, password security, computer security settings, user rights, etc. IT controls include organization and management of the IT infrastructure , physical and logical access to network resources, disaster recovery controls, and so on.

Performance of the network, computers, and applications is also evaluated. This usually entails measuring parameters such as response time, turnaround time, and disk usage and availability, to name a few. Risk mitigation processes include the preventive, detective, and corrective measures taken by the organization to predict and report on incidents, and minimize their impact. This involves activities like monitoring automated processes; identifying unusual activity; monitoring data access; testing, monitoring, and controlling remote access; and generating audit trails.