tailieunhanh - Management Planning Guide for Information Systems Security Auditing

If you make configuration changes while maintaining an open Threat Analyzer session, your configuration changes will not take affect in regards to actually seeing the changes in the Threat Analyzer. The Threat Analyzer must be closed and re- opened to view your changes. Configuration changes can include changing the policy of a VIPS, splitting a port pair into two single ports and applying a separate policy to each port; exporting User-defined Signature to the Manager’s attack database, then applying a policy containing custom attacks to a VIPS; and so forth as configuration changes that affect policy application are made. . | National State Auditors Association and the U. S. General Accounting Office A Joint Initiative Management Planning Guide for Information Systems Security Auditing December 10 2001 References to specific vendors services products and Web sites noted throughout this document are included as examples of information available on information security. Such references do not constitute a recommendation or endorsement. Readers should keep in mind that the accuracy timeliness and value of Web site information can vary widely and should take appropriate steps to verify any Web-based information they intend to rely on. December 10 2001 On behalf of the U. S. General Accounting Office GAO and the National State Auditors Association NSAA it is our pleasure to present this Management Planning Guide for Information Systems Security Auditing. The rapid and dramatic advances in information technology IT in recent years have without question generated tremendous benefits. At the same time however they have created significant unprecedented risks to government operations. Computer security has in turn become much more important as all levels of government utilize information systems security measures to avoid data tampering fraud disruptions in critical operations and inappropriate disclosure of sensitive information. Such use of computer security is essential in minimizing the risk of malicious attacks from individuals and groups. To be effective in ensuring accountability auditors must be able to evaluate information systems security and offer recommendations for reducing security risks to an acceptable level. To do so they must possess the appropriate resources and skills. This guide is intended to help audit organizations respond to this expanding use of IT and the concomitant risks that flow from such pervasive use by governments. It applies to any evaluative government organization regardless of size or current methodology. Directed primarily at executives and senior managers