The Organization of Auditing of Information Security

Abstract

The article generalizes and systematizes the views of the auditing of information security of the economic subjects. As a result of this research, the author summarized the contemporary condition of the specified subject areas of the auditing and outlined his views regarding the possibility of its application in the condition of permanent influence of the internal environment and the external surroundings on the economic entities, discovered its significant advantages for the system management of this entity. In the article the author outlines the main organizational stages of the processes of information security auditing within the auditing of the business as a modern concept of auditing in general. The features of each of the above mentioned stages as well as the recommendations for their implementation are discovered in the article. The result of the proposed by the author industry approach to the information security auditing is a comprehensive model of the auditing cycle within the auditing of the business which in turn allows to carry out the research of this subject area, which serves as the basis for the preparation of the information for making best and optimal management decisions.

Keywords

• оценка ресурсов
• анализ угроз
• анализ уязвимостей
• оценка эффективности контрмер
• анализ рисков
• экономический субъект
• бизнес-системы
• assets and resources evaluation
• threat assessment
• vulnerability assessment
• control evaluation
• counter-measures efficiency evaluation
• risk assessment
• the economic subject
• business-systems