Audit

While responding to requirements identified during an IT audit, both internal and external, I have observed many cases where the identified need was to demonstrate that an implementation plan was in place to mitigate several risks. Instinctively one would think that undertaking the implementation was implied in the requirement, but this is often far from the truth.

Upon presenting the plan in detail along with expected results at each stage of the implementation, the management reminded us that the action was specifically to demonstrate that a detailed plan existed.

The auditor’s report did not explicitly state that we must implement the plan. Consequently, management chose not to sanction further work.

From the auditor’s point of view, defining an action in the form of ‘tell me how you are going to fix this problem’ is logical as a next step. However, far too often, it results in a focus on closing audit actions rather than resolving the underlying issue that caused the audit action to be defined. As security professionals, we have a duty to decision-makers to challenge the requirements under these conditions, by illustrating the potential consequences of inaction.

Undertaking a cyclical audit is better than no audit at all; however, risks remain in that problems identified during audits could have existed for a significant length of time. If for example user accounts are not deactivated promptly once a member of staff has left the company, someone else could use them.  Continuous monitoring and auditing allow quick identification and correction of problems.

Continuous auditing and monitoring have benefits across a multitude of business and technology functions. A combination of the following will allow the use of data efficiently and effectively to improve the business and the audit function.

• With known controls which need to be audited, investigate the data sources required for monitoring and auditing, and how the data can be gathered and processed continuously to provide the necessary level of assurance

• Investigate and analyse available data sources, gain insights from the data, and feed the options back to auditors

The insights demonstrate how existing data can be transformed into actionable intelligence to enhance audit effectiveness and mitigate risks.

Identity and Access Management

Below are example data sources and insights related to Identity and Access Management (IAM).

With access to the following data sources:

• Master list of user accounts (authoritative data source)

• Individual application user accounts

• Application-level permissions (entitlements)

• Current staff list

• Application access log files

• Business roles

Examination and data analysis will allow you to:

• Identify active user accounts belonging to staff members no longer with the company

• Identify where application permissions exceed those required for the user to perform their role within the company

• Identify unusual or suspicious application and data access

• Identify toxic access combinations

• Use the data to identify where access management processes have failed

Software Asset Management

Below are example data sources and insights related to Software Asset Management (SAM).

With access to the following data sources:

• Software licences purchased

• Authorised devices on the network

• User accounts

• Software applications on individual devices

• Application files on individual devices

Examination and data analysis will allow you to:

• Identify immediately when the number of software installations exceeds the number of purchased software licences

• Identify when someone installs unauthorised software on devices

• Identify where dormant software installations may indicate underutilised resources, unused licences, or potential security risks.

The financial services industry is experiencing seismic change with increased regulation, coupled with customer expectation for services to be delivered faster. Unfortunately, the shorter the customer journey, the less time is available to detect irregularities which may indicate fraud. Therefore, the objective is to identify potential issues as early as possible to allow corrective action. Continuous monitoring and auditing make effective use of data within an organisation to achieve this objective.

Companies undertake audits periodically to satisfy regulatory requirements or to adhere to internal policies. With vast amounts of data available across multiple systems, organisations can now collect and process data daily or in real time using dashboards, and provide detailed reports to auditors to verify compliance. Where the data indicates that one or more processes have failed, the business can take corrective action.

Problems identified during official audits undertaken by regulators and authorities can have serious consequences such as revocation of licences or imposed financial sanctions. Additional lines of defence help mitigate this risk:

• Departmental monitoring and auditing – performed within the department checking their adherence to standards and procedures; including other monitoring which forms part of standard processes such as security monitoring and fraud detection.

• Internal audit – undertaken by an internal team that looks at the business – results from internal audits influence the creation and adaptation of standards, procedures and controls to strengthen and protect the company.

• External audits – as with internal audit, the results influence standards, procedures and controls. However, external audits can be statutory or voluntary, and undertaken by a third party.

With traditional auditing, controls are identified manually, performed cyclically such as every six months or annually depending on the risks, and assessed and tested based on a sample of data. With continuous auditing, the process is automated, repeatable and provides greater insight into potential threats.

• The more data sources available, the greater the reporting capability. Every new data point adds an extra dimension of reporting and insight.

• Continuous monitoring, auditing and exception reporting will increase operational efficiency and reduce risks.

• Data sources can be used efficiently with ad hoc reporting to support audit activities and quickly investigate specific incidents.

• Ad hoc reporting can be adapted to become part of continuous monitoring and auditing activities.

• Data can be analysed to identify potential problems and determine where standards and procedures are missing.