4.2.2: Information Security Audit (continued)

Establishing audit objectives

In this step, the auditor outlines the objectives of the audit. Auditors consider multiple factors that relate to data center procedures and activities that potentially identify audit risks in the operating environment and assess the controls in place that mitigate those risks. The initial risk assessment forms an important part of the process and answers questions pertaining to three primary security goals, confidentiality, integrity, and reliability. After thorough testing and analysis, the auditor is able to adequately determine if the data center maintains proper controls and is operating efficiently and effectively.

Risk assessment consists of ranking the potential threats from low to high, or other scientific or complex metrics. The ranking depends on the severity of the issue with respect to the extent of damage it can cause or the ease of exploitation. Vulnerabilities that are easy to exploit and those causing a high degree of damage must be ranked comparatively higher.

Following is a list of objectives the auditor should review:

• Personnel procedures and responsibilities, including systems and cross-functional training
• Change management processes are in place and followed by IT and management personnel
• Appropriate back up procedures are in place to minimize downtime and prevent loss of important data
• The data center has adequate physical security controls to prevent unauthorized access to the data center
• Adequate environmental controls are in place to ensure equipment is protected from fire and flooding
• Review of security infrastructure and systems
• Review of IT systems to gain assurance of the safety
• Examine the development process and procedures involved at various stages of the system
• Evaluation of the performance of a specific program or system

Audit objectives and scope are not limited to the aspects mentioned above. It should be able to cover all the critical areas of the security aspect, such as security settings, passwords, firewall security, user rights, physical access security, and so on.

Performing the review

Collecting evidence is required in order to satisfy data center audit objectives. This involves traveling to the data center location and observing processes and within the data center.

The three main types of audit evidence include:

• Documentary audit evidence
• Analysis
• Observed process and existence of physical items

Physical verification implies the actual investigation or inspection of tangible assets by the auditor. The following methods can be used for the collection of audit evidence.

The following review procedures should be conducted to satisfy the pre-determined audit objectives:

• Data centre personnel – All data center personnel should be authorized to access the data center (key cards, login ID's, secure passwords, etc.). Datacenter employees are adequately educated about data center equipment and properly perform their jobs. Vendor service personnel are supervised when doing work on data center equipment. The auditor should observe and interview data center employees to satisfy their objectives.
• Equipment – The auditor should verify that all data center equipment is working properly and effectively. Equipment utilization reports, equipment inspection for damage and functionality, system downtime records and equipment performance measurements all help the auditor determine the state of data center equipment. Additionally, the auditor should interview employees to determine if preventative maintenance policies are in place and performed.
• Policies and Procedures – All data center policies and procedures should be documented and located at the data center. Important documented procedures include data center personnel job responsibilities, back up policies, security policies, employee termination policies, system operating procedures and an overview of operating systems.
• Physical security / environmental controls – The auditor should assess the security of the client's data center. Physical security includes bodyguards, locked cages, man traps, single entrances, bolted-down equipment, and computer monitoring systems. Additionally, environmental controls should be in place to ensure the security of data center equipment. These include Air conditioning units, raised floors, humidifiers and uninterruptible power supply.
• Backup procedures – The auditor should verify that the client has backup procedures in place in the case of system failure. Clients may maintain a backup data center at a separate location that allows them to instantaneously continue operations in the instance of system failure

Adapted from:
"Information security audit" by Various authors, Wikipedia is licensed under CC BY-SA 3.0