The most popular and comprehensive Open Source ECM platform
Let us know more
Compliance: Security Assessment versus Security Audit
Typically a security audit is one hurdle that needs to be cleared as part of a financial audit. There is a lot of talk about security audits and security assessments. But what’s the difference? A blog by Kevin Coleman explains.
Security assessments are internal checks that typically happen as a preliminary step prior to an audit. The assessment need not be formal, although formal processes like ISO 27000 specify in great detail what should be considered in the assessment. The assessment is a method for gathering data about current security measures and attempts to compare what the current situation is with how it should be.
Security assessment data is collected using methods like:
* Surveys
* Interviews
* Standards
* Statistics
* Record reviews
The security audit, on the other hand, is a systematic evaluation of the company’s information system by comparing it to an established set of criteria. A security audit produces a written record of the results that document the system capabilities. The security audit typically satisifies the requirements of regulatory compliance like HIPAA and Saranes-Oxley.
Coleman gives an example that illustrates the difference between the assessment and audit. The example he gives is authentication for access control. The assessment would check to see if the organization had a strong password policy in place, while the audit would actually test the system to see if the strong password policy is correctly implemented, probably by attempting to create a weak password.
The result of a security assessment typically identifies items within a security policy that should be reconsidered or revisited. Ignoring suggestions from the assessment often lead to problems later when an audit is performed. There usually is no or little consequence with the failure of part of an assessment, but failure of an audit, especially when tied to compliance regulations, can bring stiff consequences.
First of all, security was here way before ISACA and auditing. I have been auditing as a security professional years before the current audit principals. Audit was primary used for financials, and some reason now moved to technology. I do disagree with Coleman, one can perform a security assessment to include policy reviews and validation by collecting key artifacts. The word “test” is misleading because both security and audit performs some portion of testing.
Both are vital for the success of the security company. Many times, these questions are fielded to the most senior security staff member from your team at their site, but there is often a lack of in-depth industry knowledge by this staff member to give a qualified answer to questions.
Assessments and audits are part of the business strategy.