How the type of computer security software has changed over the years, what about checking if your system provides sufficient security, why not pass security audit"
The system of
computer security audit has changed dramatically over the years. Whereas
in the beginning all of the software that was crucial was produced by giants
like Hewlett Packard, and it was adjusted to suit the customer"s specific
needs, now it has been almost totally replaced with ready made products, as
they proved to be very cost-effective for businesses.
While the performance of these
products is not the same as it used to be with the previous generation of
hand-tailored software, final users have still had to put up with it as well
as with the fact that they have to take all the necessary
security measures, as the
developing companies disclaim any liability for incurred damages.
So what is exactly a computer security audit" To put it bluntly, it is a series of tests intended to assess a company"s security policies are used and if they are effective. In order to do this, computer security auditors may conduct various procedures, like personal interviews, system vulnerability benchmark tests, and others.
Computer security auditors
usually start with checking if the company has a written security policy
code. The latter does not exist in a lot of even modern companies, which is
very unfortunate, since unless all the staff members of the company have
understood and signed the security policy agreement, the security system may
be extremely vulnerable.
Furthermore, this document must be living and regulations reflected in it
must be implemented daily. That is to say, a lot of employees still choose
convenience over security. For instance, users must be aware that every
password should be somewhat sophisticated and should include numbers as well
as letters and should not be a mere word or two words together. However,
many employees are simply too lazy to come up with a password of this kind,
which leaves the company"s security system vulnerable.
When auditors are checking the system, they should follow some kind of a standard procedure, a list of check-ups that they generally do, but also keep their eyes open for some unexpected problems. When the check has been completed, first of all, auditors should inform the administration and the staff of the obvious errors and flaws in the system. This should be done in a way that does not show the administration that the conclusions are definitive and final.
A
thorough follow-up check-up might be needed to clear up the difficulties.
Some errors, though, have to be corrected right on the spot. The final audit
report should be carefully considered and written in a simple logical form
so that every staff member should understand it correctly. Each problem,
with its background and the solution should be laid out on a separate
worksheet. In the meantime, the management of the company should be
constantly supervising the faulty areas, just to make sure that the
recommendations provided by the auditors are being implemented.
Though even when the report has been issued, the
auditors and the management should
keep in mind that organizations generally evolve, they do not stay the same,
and as they evolve, so do their security systems. Therefore, the auditors
should always be able to consult the company workers, in case some changes
are to take place.