Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Auditing Information Systems Security

S. Rao Vallabhaneni, SRV Professional Publications

Why Audit Information Systems and Security?

Government Laws, Directives, and Regulations: The Sarbanes-Oxley Act of 2002

Professional Auditing Standards

Risks and Exposures, Including Computer Crime and Fraud

Good Business Practices

What Is the Scope of the Information Security Audit?

Who Performs the Information Systems Security Audits?

Types of Auditors Available

Types of Audits Performed

What Is the Audit Process?

Phase 1. Audit Planning

Phase 2. Audit Fieldwork

Phase 3. Audit Assessment

Phase 4. Audit Reporting

What Is the Management's Response to the Audit Results?

Audit Objectives, Audit Work Programs, and Audit Tools and Techniques

Conclusions

Glossary

Appendix: Government Laws, Directives, and Regulations

The Clinger-Cohen Act of 1996

U.S. Computer Security Act of 1987

U.S. Privacy Act of 1974

U.S. OMB Circular A-130, Management of Federal Information Resources

Circular A-123.U.S.OMB Circular A-123, Internal Control Systems

Paperwork Reduction Act

U.S. Freedom of Information Act

Security and Freedom Through Encryption (SAFE) Act

Electronic Communications Privacy Act (ECPA)

The Promotion of Commerce Online in the Digital Era Act and the Encryption Communications Privacy Act

The Economic Espionage and Protection of Proprietary Economic Information Act of 1996

U.S. Federal Sentencing Guidelines

Organization for Economic Cooperation and Development (OECD)

U.S. Computer Fraud and Abuse Act ...