Explain The Three Main Area Of Accountability Regarding Information Security

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of IDI which must be managed with care. All information has a value to IDI. However, not all of this information has an equal value or requires the same level of protection. Access controls are put in place to protect information by controlling who has the rights to use different information resources and by guarding against unauthorised use. Formal procedures must control how access to information is granted and how such access is changed. This policy also mandates a standard for the creation of strong passwords, their protection and frequency of change.

Security is the degree of resistance to, or protection from, harm. It applies to any asset, such as a person, dwelling, community, item, nation, or organization. Information held on your IT systems is vitally important. Its availability, integrity and confidentiality may be critical for the continued success of your business. Security can be breached in several ways, e.g. by system failure, theft, inappropriate usage, unauthorised access or computer viruses. This will lead to the loss of sensitive or critical information, directly affect your competitiveness and cash flow, also damage your reputation.

Information Security Policies are a very important part of a company’s protection; these policies are put in place to protect the company and well as the clients. It is important to maintain a constant watch over all security departments daily to ensure that everything is in working order. The policy below is a great way to keep track of the steps needed to protect your company and clients.

Organizations that are using information technology solutions for their businesses, need to evaluate the competence and the level of security of their information security infrastructure periodically. Such evaluations will help to cope up with the changing faces of information security risks, understanding the level of security of their current infrastructure and finding out possible and necessary security countermeasures to strengthen their information security framework. For such evaluation or information security audits, organizations hire third party security companies. The ABC Accounting Firm has also hired a third-party information security firm to evaluate the current IT infrastructure of ABC Accounting Firm and understanding the scope, process,

Whitman, M. E. & Mattord, H. J. (2013). Management of information security. (4th. ed). Retrieved from  https://www.betheluniversityonline.net/

Information systems are frequently exposed to various types of threats which can cause different types of damages that might lead to significant financial losses. Information security damages can range from small losses to entire information system destruction. The effects of various threats vary considerably: some affect the confidentiality or integrity of data while others affect the availability of a system. Currently, organizations are struggling to understand what the threats to their information assets are and how to obtain the necessary means to combat them which continues to pose a challenge. The ISF’s Information Risk Analysis Methodology (IRAM) enables organizations to access business information risk and select

20. What are the three categories of information security controls? How is each used to reduce risk for the organization?

The Information Security team commits to the confidentiality, integrity, and availability of assets. Even more, security policies clarify how the company intends to protect company assets against similar breaches in the future. For example, the Monitoring and Logging Policy define the following procedures to review:

Information security incidents include accidental or deliberate infringements of systems or data confidentiality or privacy, interruptions to systems or process availability, and damage to system or data integrity.

Gartner key metrics of data for 2010, found that companies spent an average of 5% of their IT budget on security and will reach $76.9 billion in 2015[1]. Every company has security controls and policies in place, however no one checks if they are followed rigorously. Likewise, new threats to information security which demand new procedures and tools are often overlooked. No matter how strong the information security policies and controls are a company won’t know the inadequacies, unless verified continually. An audit is carried out in connection with a financial statements and performance audit to evaluate compliance to applicable policies and laws. A report released by Maryland Department of Legislative Audits on Dec. 4, 2014 stated that an audit performed at University of Maryland’s Division helped in preventing a data breach.

The traditional security perimeter of the organization has now extended to include people, their devices and actions. Hence, organizations like MSD, must ensure the security of information and information assets by implementing a sophisticated organization-wide information security program that ensures protection of valuable corporate information.

We can define information security as safe guarding organizational data from external and internal threats. External threats include computer viruses, spam, hacking incidents While internal threats includes the use of unauthorized hardware, physical theft of hardware, abuse of computer access control. In short protecting data from unauthorized access or modification for the purpose of confidential and integrity of computer system data is called information security.

Information is a critical strategic asset for organizations. It is the basis of competitive advantage for a company. In today’s business world, information comes in a variety of different forms. As more and more organizations establish themselves in a dynamic economy and social environment, they begin to recognize the importance of information in dealing with uncertainty.

This paper is meant to be a guide for general readers including IT professionals, external auditors and so on. This research paper has a main focus on the external auditing of information security. It provides a basic understanding of the reasons for external auditing of information security. It is also meant as an aid for auditors to have solutions and Biblical implications and other possible recommendations. A variety of research techniques are used in this passage, such as analysis of files, writing questions, listing examples and making conclusions. In conclusion, It is essential that IT and audit work together in

This paper represents the IT Audit and Control course and will address the following four issues.