Conducting an IT Audit: Industry Compliance and Data Protection

Businesses of all sizes are vulnerable to network attacks, which can result in lost data or funds, fraud, identity theft, lawsuits, a disabled system, or corrupted files. Although small and medium-size companies and organizations are particularly vulnerable, all businesses utilizing an electronic information system for recordkeeping or offering credit card transactions need a network strategy that incorporates risk assessment and management and involves regular IT audits. Losing data can harm your business, but effective network security is also part of industry best practices standards, such as FFIEC and Sarbanes-Oxley for finance and HIPAA for health care. These industry standards require a business or organization to develop and implement a network security strategy that includes regular audits for compliance.

Hackers and online criminals continue to revise strategies for breaching network security and obtaining insider information. The recent WikiLeaks incident is a large-scale security breach, but your system can be damaged by far smaller threats. To find these weak points, also called "vulnerabilities," have an IT audit conducted on your system.

An IT audit examines network security from three angles: physical, technical, and personal. Ethical hacking, vulnerability scanning, and social engineering are common tactics used to identify these weak points. Approaching the network perimeter and interior as an outside party, a white hat, or ethical, hacker attempts to break into a system using common to sophisticated tactics.

As a full assessment of your business's security, an IT audit is conducted through penetration tests, personal interviews, vulnerability scans, examining operating system and network settings, and researching historical data, or past security breaches. A certified ethical hacking professional considers the following factors when analyzing your network:

? Company security policies and their implementation

? Passwords

? Presence of access control lists and audit logs

? Reviewing of audit logs

? Industry practices and security settings

? Removal of, updated, and custom-built applications

? Backup systems

? Data encryption tools

? Configuration and code changes

? Previous security incidents

An IT audit culminates in a report, which details all vulnerabilities inside and on the perimeter of a network. In addition to identifying them, the report provides strategies for fixing these weak areas and strengthening the network.