Audits in Cybersecurity

The objective of this chapter is to provision a comprehensive literature review of the most relevant approaches for conducting cybersecurity audits. The study includes auditing perspectives for specific scopes and the best practices that many leading organizations are providing for security and auditing professionals to follow. The chapter reviews relevant features for auditing approaches in the following order: ISO/IEC 27001:2013, ISO/IEC 27002:2013, Control Objectives for Information and Related Technology (COBIT) 2019, Information Technology Infrastructure Library (ITIL) 4, AICPA, ISACA, NIST SP 800-53, NIST CSF v1.1, IIA, PCI DSS, ITAF, COSO, ENISA, NERC CIP, and CSAM.

Análisis de información de la gestión de incidentes de seguridad en organizaciones

Los incidentes de seguridad en una organización se consideran la fuente principal para evaluar la correcta aplicación de los controles de seguridad en organizaciones públicas o privadas. La investigación está basada en el comportamiento de los incidentes ante la participación de controles de tecnologías de información conjuntamente con los procesos formales en las organizaciones. Se utilizaron buenas prácticas de seguridad basadas en las normas internacionales ISO/IEC 27001 e ISO/IEC 27002. Se aplicó la metodología Magerit v3 y técnicas de inteligencia de negocios para integrar y procesar la información obtenida a través de fuentes heterogéneas de información implementadas en las organizaciones bajo estudio. La información obtenida se estableció en 9 controles de seguridad comunes a las organizaciones en estudio aplicados bajo un estudio experimental. El análisis de los datos permitió establecer que el constante monitoreo y supervisión de la aplicación de los controles de seguridad eleva los niveles de seguridad en las organizaciones garantizando la continuidad de los servicios y procesos.

Analisis Tingkat Keamanan Aplikasi SIMAK Menggunakan Standard ISO/IEC 27002:2013 (Studi Kasus: UPTTIK Universitas Siliwangi)

The issue of data security seems to be one of the most intriguing topics to observe in the development of information technology in recent time/. The information technology related to the management processes, one of which is the SIMAK application at the University of Siliwangi needs a higher security concern. This study aims to determine the level of security of the SIMAK application in which the researchers can provide recommendations to SIMAK managers. This could be the basis for the future improvements. Researchers used 4 domains from ISO / IEC 27002: 2013, namely domain 5, it contains information security policies. Domain 6, it contains organizational information security. Domain 9, it contains access control. Lastly, Domain 11, it contains physical and environmental security. When they are specified from the four domains, 38 controls are obtained. Security, from the results of the questionnaire and weighting, the result of the 5 domains maturity value is= 1.49, the result of the domain 6 maturity value is= 1.52, while domain 9 maturity value is= 1.32 and domain 11 maturity value constitute to 1.97. If it is averaged, the Siliwangi University SIMAK application is at level 2 or repeatable.

Audits in Cybersecurity

The objective of this chapter is to provision a comprehensive literature review of the most relevant approaches for conducting cybersecurity audits. The study includes auditing perspectives for specific scopes and the best practices that many leading organizations are providing for security and auditing professionals to follow. The chapter reviews relevant features for auditing approaches in the following order: ISO/IEC 27001:2013, ISO/IEC 27002:2013, Control Objectives for Information and Related Technology (COBIT) 2019, Information Technology Infrastructure Library (ITIL) 4, AICPA, ISACA, NIST SP 800-53, NIST CSF v1.1, IIA, PCI DSS, ITAF, COSO, ENISA, NERC CIP, and CSAM.