Finance - Accountancy 81

Information Systems Security Audit

Abstract:The article covers:

¾Def i
ningani nformati onsystem;benef i
tsobtai
nedbyi ntroducingnew i nformati ontechnol
ogi
es;
IT management;
¾Def i
ningprerequisites,anal
ysi s,desi
gn,implementationofIS;
¾Inf ormati
onsecuri tymanagementsystem;aspectsregardi ngISsecuri typol icy;
¾Conceptualmodelofasecuri tysystem;
¾Audi ti
nginformati onsecuritysystemsandnetworki nfrastructuresecurity.
Key words:—˜›–Š’˜—ȱœ¢œŽ–ǰȱ’—˜›–Š’˜—ȱŽŒ‘—˜•˜’ŽœǰȱȱœŽŒž›’¢ǰȱ‹Šœ’Œȱ›Žž•Š’˜—œǰȱ
œŠ—Š›œǰȱ—˜›–œǰȱŠž˜–ŠȱŠŠȱ™›˜ŒŽœœ’—ȱœ¢œŽ–œȂȱŠž’ǰȱ’—˜›–Š’˜—Š•ȱœ¢œŽ–œȂȱŠž’ǰȱ’—˜› Ȭ
–Š’˜—ȱœŽŒž›’¢ȱ–Š—ŠŽ–Ž—ȱœ¢œŽ–ǰȱȱœŽŒž›’¢ȱ™˜•’Œ’Žœǰȱ’›Ž Š••ǯ

1. Information Systems – Development, throughout allm anagem ent decisionallevels

Audit, Security Policies
An information systemȱǻǼȱ›Ž™›ŽœŽ—œȱŠȱ
œŽȱ˜ȱ‘ž–Š—ȱŠ—ȱŒŠ™’Š•ȱ›Žœ˜ž›ŒŽœǰȱ’—ŸŽœŽȱ
 ’‘’—ȱŠ—ȱŽ—’¢ȱ˜›ȱ‘Žȱ™ž›™˜œŽȱ˜ȱŒ˜••ŽŒ’—ȱ
Š—ȱ™›˜ŒŽœœ’—ȱ‘Žȱ—ŽŒŽœœŠ›¢ȱŠŠȱ’—ȱ˜›Ž›ȱ˜ȱ
™›˜žŒŽȱ’—˜›–Š’˜—ǰȱ ‘’Œ‘ȱŒŠ—ȱ‘Ž—ȱ‹ŽȱžœŽȱ
Š—ȱ’—ȱŒ˜—›˜••’—ȱ‘Žȱ˜›Š—’£Š’˜—ȂœȱŠŒ’Ÿ’¢ǯ
—ȱ‘Žȱ—•˜Ȭ–Ž›’ŒŠ—ȱ•’Ž›Šž›ŽǰȱŠ• Ȭ
‘˜ž‘ȱ‘Žȱ’œ’—Œ’˜—ȱ’œȱ–ŠŽȱ‹Ž ŽŽ—ȱȃ’— Ȭ
˜›–Š’˜—ȱœ¢œŽ–ȄȱŠ—ȱȃŒ˜–™žŽ›ȱ‹ŠœŽȱ’— Ȭ
˜›–Š’˜—ȱœ¢œŽ–ȄǰȱžŽȱ˜ȱ‘ŽȱŽŒ‘—˜•˜’ŒŠ•ȱ
•ŽŸŽ•ȱ›ŽŠŒ‘Žȱ‹¢ȱǰȱŠ••ȱŠž‘˜›œȱŠŽ›ȱ–Š” Ȭ
’—ȱ‘ŽȱœŠ’ȱ’Ž›Ž—ŒŽǰȱžœŽȱ‘ŽȱŽ›–ȱȃ’—˜› Ȭ

No. 6 ~ 2007
 82 Finance - Accountancy
–Š’˜—ȱœ¢œŽ–Ȅǰȱ–˜’ŸŠ’—ȱœžŒ‘ȱ‹¢ȱ‘Žȱ‘’‘ȱ
level of informational activities automation.
M ost benefits are obtained in a business
‹¢ȱ’—›˜žŒ’—ȱ‘Žȱ—Ž ȱ information tech-
nologies ǻǼǯȱ—ȱ‘ŽȱŒŠœŽȱ˜ȱŠȱȱ™›˜“ŽŒǰȱ‘Žȱ
‹Ž—Ž’œȱŠ›Žȱ—˜ȱ˜‹Š’—Žȱ’––Ž’ŠŽ•¢ǰȱ‹žȱ
‘›˜ž‘˜žȱ‘Žȱ™›˜“ŽŒȂœȱ•’ŽȱŒ¢Œ•Žǯȱ•˜—ȱ
 ’‘ȱ‘Žȱ‹žœ’—ŽœœȱŒŠœŽȱœž¢ǰȱž™˜—ȱ‘Žȱ‹Ž’—Ȭ
—’—ȱ˜ȱŠȱ™›˜“ŽŒȱ˜›ȱŽœ’—’—ȱŠȱǰȱ™•Š——’—ȱ
–žœȱ‹Žȱ™Ž›˜›–Žȱ˜ȱ‘Žȱ‹Ž—Ž’œȂȱŠŒ‘’ŽŸŽ Ȭ
–Ž—ǰȱ ‘’Œ‘ȱ–žœȱ‹Žȱ‘Ž—ȱ˜••˜ ŽȬž™ȱ‹¢ȱ
–ŽŠ—œȱ˜ȱŠ—ȱŽ’Œ’Ž—ȱ–Š—ŠŽ–Ž—ȱ™›˜ŒŽœœǰȱ
 ‘’Œ‘ȱ’—Œ•žŽœDZ
Ȭȱ Š•’Š’—ȱ‘Žȱ‹Ž—Ž’œȱ™›ŽœŽ—Žȱ’—ȱ
the business;
Ȭȱ •Š——’—ȱ‘Žȱ‹Ž—Ž’œȱ˜ȱ‹ŽȱŠŒ‘’ŽŸŽDz
Ȭȱ ŽœŒ›’‹’—ȱ‘Žȱ‹Ž—Ž’œǰȱ–ŽŠœž›’—ȱ
the outcome and the objective;
Ȭȱ ŽœŽŠ›Œ‘’—ȱŠœœž–™’˜—œDz
Ȭȱ Ž’—ȱž™ȱ”Ž¢ȱ›Žœ™˜—œ’‹’•’’Žœȱ˜›ȱ
achieving the benefits.
The benefits achievement management
’œȱŠ—ȱ’–™˜›Š—ȱŒ˜–™˜—Ž—ȱ˜ȱ™›˜“ŽŒȱ–Š— Ȭ
ŠŽ–Ž—ǰȱŠ•œ˜ȱ’—Ÿ˜•Ÿ’—ȱ‘Žȱ™›˜“ŽŒȂœȱœ™˜— Ȭ
sors.
IS Development ’œȱŠ—ȱŽ¡›Ž–Ž•¢ȱŒ˜– Ȭ
™•Ž¡ȱŠŒ’Ÿ’¢ǯȱŒžŠ•ȱ™›˜žŒ’˜—ǰȱŒ˜—œ’œ’—ȱ
’—ȱ›Š’—ǰȱŽœ’—ȱŠ—ȱ˜™’–’£’—ȱ‘Žȱ™›˜ Ȭ
›Š–œǰȱŠœȱ Ž••ȱŠœȱ‘Žȱ›ž•Žœȱ˜›ȱžœ’—ȱœžŒ‘ǰȱ
–žœȱ‹Žȱ™›ŽŒŽŽȱ‹¢ȱŽœ’—’—ȱŠȱ™›˜“ŽŒǰȱ
that must establish the necessary details for
Ž’—’—ȱ‘Žȱ™›˜ŒŽž›Žœǰȱ‘˜ ŽŸŽ›ȱ—˜ȱ‹Ž
˜›ŽȱŽœŠ‹•’œ‘’—ȱ ‘’Œ‘ȱŠ›Žȱ‘Žȱ—ŽŒŽœœŠ›¢ȱ
™›˜›Š–œȱŠ—ȱ’—ȱ ‘Šȱ•˜‹Š•ȱŒ˜˜™Ž›Š’˜—ȱ
›Š–Ž ˜›”ȱǻ’—ȱ ‘ŠȱŽ—Ÿ’›˜—–Ž—Ǽȱ ’••ȱ‘Ž¢ȱ
ž—Œ’˜—ǯȱ‘Žȱ™›˜“ŽŒȱŽœ’—ȱŒŠ——˜ȱ‹Žȱ–ŠŽȱ
 ’‘˜žȱ”—˜ ’—ȱ‘Žȱ ’—˜›–Š’˜—ȱ™›Ž›Žšž’ Ȭ
sitesȱ ‘’Œ‘ȱ‘Žȱœ¢œŽ–ȱ–žœȱ–ŽŽǯȱ••ȱ‘ŽœŽȱ
‘ŠŸŽȱŠ•›ŽŠ¢ȱœ‘Š™ŽȱŠȱœŽȱ˜ȱŠŒ’Ÿ’’Žœȱ˜ȱ‹Žȱ
ž•’••ŽDZȱdefining the prerequisites, analysis,
design, creating the IS.
No. 6 ~ 2007
Information systems’audit represents a
complexactivity for assessing an information sys-
tem in order to set forth a qualified opinion re-
garding the conformity between the system and
the regulating standards, as well as over the infor-
mation system’ s capacity of achieving the organi-
zation’s strategic obj ectives, by efficiently using
the informational resources and by ensuring the
integrity of the processed and stored data.
œžŠ••¢ǰȱœžŒ‘ȱŠŒ’Ÿ’¢ȱ–žœȱ‹ŽȱŒŠ››’Žȱ
˜žȱ‹¢ȱŠȱŒ˜–™ŽŽ—ȱ™Ž›œ˜—ǰȱ›Š’—ŽȱŠ—ȱšžŠ•Ȭ
’’Žȱ’—ȱ‘Žȱ’Ž•ȱ˜ȱ’—˜›–Š’˜—ȱœ¢œŽ–œȂȱŒ˜—Ȭ
›˜•ǰȱœŽŒž›’¢ȱŠ—ȱ–Š—ŠŽ–Ž—ǰȱ™Ž›œ˜—ȱ ‘˜ȱ
’œȱ—Š–ŽȱȃȱŠž’˜›ȄǯȱžŒ‘ȱœ˜›ȱ˜ȱ•’ŒŽ—œ’—ȱ
is granted by ISACAǰȱ‹¢ȱ–ŽŠ—œȱ˜ȱ‘Žȱ CISA
(Certified Information System Auditor).
—Ž›ȱœžŒ‘ȱŒ’›Œž–œŠ—ŒŽœǰȱ IT security
’–™•’Žœȱ’–™•Ž–Ž—’—ȱœ™ŽŒ’’ŒȱȱŽ—Ÿ’›˜— Ȭ
–Ž—ȱ™›˜ŽŒ’ŸŽȱ–ŽŠœž›ŽœȱǻŒ˜–™žŽ›œǰȱ—Ž Ȭ
 ˜›”œǰȱ’—˜›–Š’˜—ȱœ¢œŽ–œǰȱŠ—ȱŠŠȱ‹ŠœŽœǼȱ
‹˜‘ȱŠŠ’—œȱŠŒŒ’Ž—Š•ȱŠ–Š’—ȱŠŒ’˜—œǰȱ
Š—ȱŠŠ’—œȱ’—Ž—ŽȱŠŠŒ”œǰȱœžŒ‘ȱŠœȱŽœ™’˜ Ȭ
—ŠŽǰȱœŠ‹˜ŠŽǰȱ–ž›Ž›ȱŽŒǯȱŠ”’—ȱ’—˜ȱŒ˜— Ȭ
œ’Ž›Š’˜—ȱ‘ŽȱœŠ’ȱ›’œ”œǰȱ’—ȱŘŖŖŖȱ‘Žȱ—Ž›—Š Ȭ
’˜—Š•ȱŠ—Š›’£Š’˜—ȱ›Š—’£Š’˜—ȱǻǼȱ
Š˜™ŽȱŠœȱ’—Ž›—Š’˜—Š•ȱœŠ—Š›ȱ‘ŽȱBritish
Standard BS 7799ǰȱ‹¢ȱ™ž‹•’œ‘’—ȱ’ȱž—Ž›ȱ‘Žȱ
—Š–Žȱ˜ȱȱŗŝŝşşȱȮȱ “Practical Code for In-
formation Security M anagement”.
Ȭ
The said StandardȱŠ••˜ ȱ˜›ȱřŜȱŒ˜—›˜•ȱ
˜‹“ŽŒ’ŸŽœȱŠ—ȱŗŘŝȱŒ˜—›˜•ȱŽ•Ž–Ž—œȱ˜ȱ‹Žȱ’Ž— Ȭ
’’Žǰȱ›˜ž™Žȱ’—ȱŽ—ȱŒŠŽ˜›’ŽœDZ
1. œŽŒž›’¢ȱ™˜•’Œ¢Dz
2. Œ˜—’—ž˜žœȱ‹žœ’—Žœœȱ™•Š——’—Dz
3. controlling the access to the system;
4. œ¢œŽ–ȱŽŸŽ•˜™–Ž—ȱŠ—ȱ–Š’—Ž Ȭ
nance;
5. ™‘¢œ’ŒŠ•ȱŠ—ȱŽ—Ÿ’›˜—–Ž—Š•ȱœŽŒž›’¢Dz

6. conformity;
7. ™Ž›œ˜——Ž•ȱœŽŒž›’¢Dz
8. ˜›Š—’£Š’˜—ȱœŽŒž›’¢Dz
9. Œ˜–™žŽ›œȱŠ—ȱ—Ž ˜›”ȱ–Š—ŠŽ Ȭ ’—Ž—œǰȱ›Ž™›ŽœŽ—’—ȱŠȱ’’Œž•ȱ™›˜ŒŽœœȱ’– Ȭ
ment;
10.information resources classification
and control.
In order for the ISO 17799 standard to
‹ŽŒ˜–Žȱ˜™Ž›Š’˜—Š•ǰȱ‘ŽȱŒ›ŽŠ’˜—ȱ Šœȱ—ŽŒŽœ Ȭ
sary of the BS 7799-2standard. Its advantage
•Š¢œȱ’—ȱ‘ŽȱŠŒȱ‘Šȱ’ȱŠ••˜ œȱ˜›ȱŠ—ȱ informaȬ
tion security management system to be imȬ
™•Ž–Ž—’—ȱ‹¢ȱœžŒŒŽœœ’ŸŽ•¢ȱž•’••’—ȱ‘Žȱ˜• Ȭ
•˜ ’—ȱ™‘ŠœŽœDZ
a) defining the information security
–Š—ŠŽ–Ž—ȱœ¢œŽ–ȱŠ—ȱŠŽ›Ž—ȱ™˜•’Œ’ŽœDz
b) œŽ’—ȱ˜žȱ›Žœ™˜—œ’‹’•’’ŽœȱŠ—ȱ—ŽŒŽœȬ
sary resources;
c) ŠœœŽœȱœ™ŽŒ’’ŒŠ’˜—ȱŠ—ȱ›’œ”ȱ–Š—ŠŽ Ȭ
ment;
d) ›’œ”ȱŠ–’—’œ›Š’˜—Dz
e) controls selection;
f) Š™™•’ŒŠ‹’•’¢Dz
g) ’–™•Ž–Ž—Š’˜—ǯ
ŒŒ˜›’—ȱ˜ȱ‘’œȱœŠ—Š›ǰȱ‘ŽȱIT Gov-
ernance Instituteȱž—Œ’˜—’—ȱž—Ž›ȱ‘Žȱ ’—ȱ
of ISACAǰȱ™›˜Ÿ’Žœȱthe best practices for the
ȱ™›˜ŒŽœœŽœȱ‹¢ȱ‘Žȱ“COBIT”ȱ™Š™Ž›ȱȮȱȃControl
Objectives for Information and related Tech-
nology”. COBIT structures the ȱ™›˜ŒŽœœŽœ
into four areasDZ
a) ™•Š——’—ȱŠ—ȱ˜›Š—’£Š’˜—Dz
b) ŠŒšž’œ’’˜—ȱŠ—ȱ’–™•Ž–Ž—Š’˜—Dz
c) ž—Œ’˜—’—ȱŠ—ȱœž™™˜›Dz
d) monitoring and evaluation.
—ȱ›ŽŠ•’¢ǰȱ‘ŽœŽȱ˜ž›ȱŠ›ŽŠœȱ’—Œ•žŽȱŘŘŖȱ
Œ˜—›˜•œǰȱŒ•Šœœ’’Žȱ’—˜ȱřŚȱ‘’‘ȱ•ŽŸŽ•ȱ˜‹“ŽŒ Ȭ
tives.
The security policyǰȱŒŽ—›Š•ȱ™Š›ȱ˜ȱ‘Žȱ
œŽŒž›’¢ȱ™•Š—ȱ’–™•’Žœȱ›ŽœŽŠ›Œ‘ȱŠ—ȱ›’˜›˜žœȱ
No. 6 ~ 2007
Finance - Accountancy 83
’—˜›–’—ȱ‹Ž˜›ŽȱŠ™™•¢’—ȱ˜ —ȱŒ˜—›˜•œȱ
˜ȱ‘ŽȱȱŽ—Ÿ’›˜—–Ž—ǯȱ‘ŽȱœŽŒž›’¢ȱ™˜•’Œ¢ȱ
Œ˜–™›’œŽœȱ‘ŽȱŽœŒ›’™’˜—ȱ˜ȱ™ž›™˜œŽœȱŠ—ȱ
™˜œ’—ȱ˜›ȱŠŠ™Š’˜—ȱ˜ȱŽŠŒ‘ȱ˜›Š—’£Š’˜—Ȃœȱ
œ™ŽŒ’’ŒȱŽŠž›Žœǯȱȱ’›œȱœŽ™ȱ’—ȱ’–™•Ž–Ž—’—ȱ
‘ŽȱœŽŒž›’¢ȱ™•Š—ȱ’œȱ›Ž™›ŽœŽ—Žȱ‹¢ȱŽœŠ‹•’œ‘ Ȭ
’—ȱ‘Žȱœ¢œŽ–œǰȱŠ™™•’ŒŠ’˜—œǰȱŠŠȱŠ—ȱŽ—’ Ȭ
’Žœȱ˜ȱ‹ŽȱœŽŒž›’’£Žǯȱ—ŒŽȱ‘ŽȱœŽŒž›’¢ȱ™˜•’Œ¢ȱ
’œȱŒ•ŽŠ›•¢ȱŽ’—Žǰȱ’ȱ’œȱ–Š—Š˜›¢ȱ˜›ȱ‘Žȱžœ Ȭ
ers to be trained.
ȱ Ž••ȱŽ’—ŽȱœŽŒž›’¢ȱ™˜•’Œ¢ȱ–žœȱŽ¡ Ȭ
ŠŒ•¢ȱœ™ŽŒ’¢ȱŠœ™ŽŒœȱ›ŽŠ›’—DZ
ƒ˜›Š—’£Š’˜—ȂœȱœŽŒž›’¢ȱ›Ž•ŠŽȱ˜‹“ŽŒ Ȭ
tivesǰȱ ‘’Œ‘ȱ’–™•’Žœȱ‘Šȱ‘ŽȱŠŠȱ™›˜ŽŒ’˜—ȱ
–žœȱ‹ŽȱŽ—œž›ŽȱŠŠ’—œȱ’—˜›–Š’˜—ȱ•ŽŠ” Ȭ
’—ȱ˜ Š›œȱŽ¡Ž›—Š•ȱŽ—’’ŽœǰȱŠŠȱ™›˜ŽŒ’˜—ȱ
ŠŠ’—œȱ—Šž›Š•ȱŒŠ•Š–’’ŽœǰȱŽ—œž›’—ȱŠŠȱ’— Ȭ
tegrity or ensuring business continuity;
ƒ‘Žȱ™Ž›œ˜——Ž•ȱŽœ’—ŠŽȱ˜ȱŽ—œž›Žȱ
securityǰȱ ‘’Œ‘ȱŒŠ—ȱ‹Žȱ›Ž™›ŽœŽ—Žȱ‹¢ȱŠȱœ–Š••ȱ
 ˜›”’—ȱ›˜ž™ǰȱŠȱ–Š—ŠŽ–Ž—ȱ›˜ž™ȱ˜›ȱ‹¢ȱ
ŽŠŒ‘ȱŽ–™•˜¢ŽŽDz
ƒ‘Žȱ ‘˜•Žȱ˜›Š—’£Š’˜—Ȃœȱ’—Ÿ˜•ŸŽ Ȭ
ment in ensuring securityǰȱŽ¡ŠŒ•¢ȱŽœŠ‹•’œ‘ Ȭ
’—ȱ ‘˜ȱ ’••ȱ™›˜Ÿ’Žȱ›Š’—’—ȱ˜—ȱœŽŒž›’¢ȱ
–ŠŽ›œǰȱŠœȱ Ž••ȱŠœȱ‘Žȱ–˜Š•’¢ȱ’—ȱ ‘’Œ‘ȱ‘Žȱ
œŽŒž›’¢ȱŠœ™ŽŒœȱŠ›Žȱ˜ȱ‹Žȱ’—Ž›ŠŽȱ’—ȱ‘Žȱ˜›Ȭ
Š—’£Š’˜—Š•ȱœ›žŒž›Žǯȱ
In order to achieve security objectives
Š—ȱ˜‹Š’—’—ȱŠȱ‘’‘ȱ™›˜ŽŒ’˜—ȱ•ŽŸŽ•ǰȱ‘ŽȱœŽ Ȭ
Œž›’¢ȱ™•Š—ȱœ‘˜ž•ȱ‹ŽȱŽŸŽ•˜™ŽȱŠ—ȱ’–™•Ž Ȭ
–Ž—Žȱ˜—ȱ•ŽŸŽ•œǯȱ‘žœǰȱ‘ŽȱŒ˜—ŒŽ™žŠ•ȱ–˜Ž•ȱ
˜ȱŠȱœŽŒž›’¢ȱœ¢œŽ–ȱ ’••ȱ’—Œ•žŽȱ‘Žȱ˜••˜  Ȭ
ing levelsDZ
ƒapplication security, first of all imȬ
™•¢’—ȱ‘ŽȱœŽŒž›’¢ȱ˜ȱ‘Žȱœ˜ Š›Žȱ™›˜žŒœȱ
 ‘’Œ‘ȱŒŠ—ȱ‹ŽȱžœŽȱ’—ȱ˜›Ž›ȱ˜ȱŽŸŽ•˜™ȱ‹žœ’ Ȭ
—ŽœœȱŠ™™•’ŒŠ’˜—œǰȱœžŒ‘ȱŠœȱ Ž‹ȱœŽ›ŸŽ›œǰȱȱ
(Secure Sockets Layer) etc.;
 84 Finance - Accountancy
ƒsystem securityǰȱ’–™•Ž–Ž—Žȱ˜—ȱ‘Žȱ
•ŽŸŽ•ȱ˜ȱœ¢œŽ–ȱŒ˜––Š—œǰȱŠ—ȱ ‘’Œ‘ȱ ’••ȱ
Œ˜—›˜•ȱŠ••ȱœ˜ Š›Žȱž—Œ’˜—œȱ˜ȱ‘Žȱœ¢œŽ–ǯȱ
The users are identified and authenticated
on a system level by a single security mechaȬ
—’œ–ǰȱ˜›ȱŠ••ȱ˜™Ž›Š’˜—œȱ‘Ž¢ȱ–’‘ȱ™Ž›˜›–ȱ
on the system;
ƒnetwork securityǰȱ’—Ž›Š—ȱ™Š›ȱ’—ȱ
Žœ’—’—ȱœžŒ‘ǰȱ’—Œ•ž’—ȱŒ˜—›˜•œȱ‹¢ȱ’›Ž Ȭ
 Š••œǰȱȱǻVirtual Private Network) and gate-
ways;
ƒphysical securityǰȱŠ’–’—ȱ˜›ȱœ¢œŽ–œȱ
™›˜ŽŒ’˜—ǰȱ‹ŠŒ”ž™ȱŽŸ’ŒŽœȱŠ—ȱœž™™˜›œǰȱ’— Ȭ
Œ•ž’—ȱŠŒŒŽœœȱŒ˜—›˜•œǰȱž—’—Ž››ž™’‹•Žȱ™˜ Ȭ
Ž›ȱœž™™•’Žœǰȱ›Žž—Š—ȱŒ˜––ž—’ŒŠ’˜—ȱ•’—ŽœDz
ƒorganization securityǰȱ›Žœ™˜—œ’‹•Žȱ
˜›ȱŠ••ȱŠœ™ŽŒœȱ˜ȱ‘Žȱ˜›Š—’£Š’˜—ȂœȱœŽŒž›’¢ȱ
™•Š—ǰȱ’—Œ˜›™˜›Š’—ȱœŽŒž›’¢ȱ™˜•’Œ’ŽœǰȱŠ”’—ȱ
into consideration the training in the field
˜ȱœŽŒž›’¢ǰȱ˜›Š—’£Š’˜—Ȃœȱ‹žœ’—Žœœȱœ¢œŽ–œǰȱ
Š—ȱŠ•œ˜ȱ‘Žȱ™•Š——’—ȱ˜›ȱ›ŽŒ˜ŸŽ›’—ȱ’—ȱŒŠœŽȱ
of disaster.
It is mandatory for the œŽŒž›’¢ȱ™•Š— to
ŽœŠ‹•’œ‘ȱŠȱ ˜›”’—ȱ›Š–Ž ˜›”ȱ˜›ȱ–Š”’—ȱ
œ™ŽŒ’’ŒȱŽŒ’œ’˜—œȱœžŒ‘ȱŠœȱŽŒ’’—ȱž™˜—ȱ‘Žȱ
ŽŽ—œŽȱ–ŽŒ‘Š—’œ–œȱ˜ȱ‹ŽȱžœŽǰȱŠ—ȱŒ˜—œŽ Ȭ
quently on the modality of configuring the
™›˜Ÿ’ŽȱœŽ›Ÿ’ŒŽœǯȱȱ–žœȱ‹Žȱ–Ž—’˜—Žȱ‘Šȱ
™•Š——’—ȱŠȱœŽŒž›’¢ȱœ¢œŽ–ȱŠ—ȱ–Š—Š’—ȱ
Ÿž•—Ž›Š‹’•’’ŽœȱŠ›ŽȱŠŒ’Ÿ’’Žœȱ’–™•¢’—ȱŒ˜– Ȭ
™›˜–’œŽœȱŠ—ȱœžŒŒŽœœ’ŸŽȱ˜™’–’£Š’˜—œǯȱ‘Žȱ
Œ˜—Œ•žœ’˜—ȱŒŠ—ȱ‹Žȱ›Š —ȱ‘Šȱ™•Š——’—ȱœŽŒž Ȭ
rity measures can be also defined as the art of
›ŽŠŒ‘’—ȱŠȱŒ˜–™›˜–’œŽȱ‹Ž ŽŽ—ȱ‘Žȱ›Ž•Š’ŸŽȱ
ŸŠ•žŽȱ˜ȱ‘Žȱ’—˜›–Š’˜—ǰȱ‘ŽȱŒ˜œȱ˜›ȱ™›˜ŽŒȬ
’—ȱœžŒ‘ȱŠ—ȱ‘Žȱ™›˜‹Š‹’•’¢ȱ˜›ȱ‘Ž–ȱ˜ȱ‹Žȱ
ŠŠŒ”Žǯȱ
The main security objectivesǰȱŽ’—Žȱ
•’”ŽȱœžŒ‘ȱ‹¢ȱ‘Žȱ™›Ž›Žšž’œ’Žœȱ˜ȱŠ—¢ȱ‹žœ’—Žœœȱ
Ž—Ÿ’›˜—–Ž—ǰȱŠ›ŽDZ
¾ confidentialityȱȮȱŠœœž–Žœȱ™›ŽŸŽ—’—ȱ
No. 6 ~ 2007
ž—Šž‘˜›’£ŽȱŠŒŒŽœœȱ˜ȱ’—˜›–Š’˜—ǯȱ¢ȱŒ˜— Ȭ
’Ž—’Š•’¢ȱ’ȱ’œȱŽ—œž›Žȱ‘Šȱ‘Žȱ’—˜›–Š’˜—ǰȱ
Ž’‘Ž›ȱ’—ȱ›Š—œ’ȱ˜›ȱœ˜›Žǰȱ’œȱŠŒŒŽœœ’‹•Žȱ˜—•¢ȱ˜ȱ
Ž—’’Žœȱ ‘’Œ‘ȱŠ›ŽȱŠž‘˜›’£Žȱ˜ȱŠŒŒŽœœȱ‘˜œŽȱ
resources;
¾ integrityȱȮȱ’—˜›–Š’˜—ȱ’œȱ™›˜ŽŒŽȱ
›˜–ȱ•˜œœŽœȱ˜›ȱ–˜’’ŒŠ’˜—ȱ’œȱž—Šž‘˜›’£ŽDzȱ
‹¢ȱžœ’—ȱŠŽšžŠŽȱ™›˜ŒŽž›ŽœȱŠ—ȱ–Ž‘˜œǰȱ
by means of the integrity it is ensured that inȬ
˜›–Š’˜—ǰȱŽ’‘Ž›ȱ’—ȱ›Š—œ’ȱ˜›ȱœ˜›ŽǰȱŒŠ——˜ȱ
be modified;
¾ availability – it ensures that authoȬ
›’£ŽȱŽ—’’Žœȱ‘ŠŸŽȱŠŒŒŽœœȱ˜ȱ’—˜›–Š’˜—ȱ›Ž Ȭ
œ˜ž›ŒŽœȱ˜—•¢ȱ ‘Ž—ȱ‘Ž¢ȱ—ŽŽȱ‘Ž–Dzȱ˜›ȱ’— Ȭ
œŠ—ŒŽǰȱ™›ŽŸŽ—’—ȱ˜ȱǻŽ—’Š•ȱ˜ȱŽ›Ÿ’ŒŽǼȱ
ŠŠŒ”œDz
¾ conformityȱȮȱ ’‘ȱŠ™™•’ŒŠ‹•Žȱ•Š œǰȱ
regulations and standards.
‹Ÿ’˜žœ•¢ǰȱ’–™•Ž–Ž—’—ȱŠ—ȱ’—˜›–Š’˜—ȱ
security management systemȱ™›˜Ÿ’Žœȱ—ž–Ž›Ȭ
ous advantagesǰȱŠ–˜—œȱ ‘’Œ‘ȱ Žȱ–Ž—’˜—DZ
¾ Š’—’—ȱ‘Žȱ›žœȱ˜ȱ‹žœ’—Žœœȱ™Š›—Ž›œȱ
ǻŽ’‘Ž›ȱœž™™•’Ž›œȱ˜›ȱŒ•’Ž—œǼDz
¾ ’–™›˜Ÿ’—ȱ™›ŽŸŽ—’˜—ȱœ¢œŽ–œȱŠ—ȱ
›Žœ™˜—œŽȱœ¢œŽ–œȱ’—ȱŒŠœŽȱ˜ȱ’—Œ’Ž—œDz
¾ –’—’–’£’—ȱ‘Žȱ›’œ”ȱ˜›ȱ’—˜›–Š’˜—ȱ
‘ŽǰȱŒ˜››ž™’˜—ȱ˜›ȱ•˜œœDz
¾ safely accessing information (by emȬ
™•˜¢ŽŽœȱŠ—ȱŒžœ˜–Ž›œǼDz
¾ “žœ’¢’—ȱŠ—ȱ˜™’–’£’—ȱŒ˜œœȱ—ŽŒŽœȬ
œŠ›¢ȱ’—ȱ˜›Ž›ȱ˜ȱ’–™•Ž–Ž—ȱœŽŒž›’¢ȱŒ˜—›˜•Dz
¾ ™›˜Ÿ’—ȱ‘Žȱ–Š—ŠŽ–Ž—Ȃœȱ’—Ÿ˜•ŸŽ Ȭ
ment in and commitment to information seȬ
curity;
¾ ™›˜Ÿ’—ȱ‘ŽȱŒ˜—˜›–’¢ȱ‹Ž ŽŽ—ȱ˜ —ȱ
œŽŒž›’¢ȱ™›ŠŒ’ŒŽœȱŠ—ȱ›ŽŒ˜—’£ŽȱœŠ—Š›œDz
¾ Œ˜–™•’Š—ŒŽȱ ’‘ȱ•ŽŠ•ȱ™›Ž›Žšž’œ’Žœǰȱ
regulations and local regulations;
¾ Ž—œž›’—ȱ‘Šȱ›’œ”œȱŠ—ȱŒ˜—›˜•œȱŠ›Žȱ
™Ž›–Š—Ž—•¢ȱ›ŽŸ’œŽDz
¾ business continuity.

ȱ‘Žȱ™›ŽœŽ—ȱ–˜–Ž—ǰȱ‘Žȱ audit and
evaluation toolsȱŠ›ŽȱŽ¡™›Žœœ•¢ȱ˜ŒžœŽȱ˜—ȱ
‘˜œŽȱ‹Šœ’ŒȱŠœ™ŽŒœȱ˜ȱ’—˜›–Š’˜—ȱœ¢œŽ–œȱ
Š—ȱ—Ž ˜›”œǰȱ ’‘˜žȱ™Š¢’—ȱŽ—˜ž‘ȱŠ Ȭ
Ž—’˜—ȱ˜ȱ‘Žȱ™›˜‹•Ž–œȱŽ¡’œ’—ȱ’—ȱ˜›Š
—’£Š’˜—œǰȱ—Š–Ž•¢ȱ‘ŽȱŠ™™•’Žȱ™˜•’Œ¢ȱŠ—ȱ
™›˜ŒŽž›Žœǰȱ˜›ȱ‘ž–Š—ȱŠœ™ŽŒœǰȱŒŠ••’—ȱ˜›ȱ
ŠŽšžŠŽȱ–Š—ŠŽ–Ž—ǰȱŒž•ž›ŽǰȱŠ—ȱ”—˜ • Ȭ
ŽŽǯȱȱ’œȱ—˜ȱœž›™›’œ’—ȱ˜›ȱ’—ŽŸ’Š‹•¢ȱ‘Šȱ
œžŒ‘ȱŠ›ŽȱŠŒ˜›œȱ‘Žȱ’—•žŽ—ŒŽȱ˜ȱ ‘’Œ‘ȱŒŠ—ȱ
™›˜ŸŽȱ›Š–Š’Œȱ˜›ȱ’—˜›–Š’˜—ȱ’—›Šœ›žŒ Ȭ
ž›ŽœȂȱœŽŒž›’¢ǯ
2. Information Systems’
Security Audit
Information systems’ security audit
’–™•’Žœȱ‹˜‘ȱ ™‘¢œ’ŒȱŠŒŒŽœœȱŠž’ and logic
access auditǯȱ˜›Ž˜ŸŽ›ǰȱœ™ŽŒ’’ŒȱŽŒ‘—’šžŽœȱ
must be used (aiming to test the security)
Š—ȱ’—ŸŽœ’Š’˜—ȱŽŒ‘—’šžŽœǯȱ˜—œŽšžŽ—•¢ǰȱ
phasesȱŠ›Žȱž•’••ŽǰȱœžŒ‘ȱŠœDZ
ƒ›ŽŠ—Š•¢£’—ȱ‘ŽȱŽ—’¢Ȃœȱœ™ŽŒ’’Œȱ™˜•’Ȭ
Œ’Žœǰȱ™›˜ŒŽž›ŽœȱŠ—ȱœŠ—Š›œDz
ƒœŽŒž›’¢ȱ™˜•’Œ’Žœȱ›ŽŠ›’—ȱ™‘¢œ’ŒŠ•ȱŠŒȬ
cess;
ƒœŽŒž›’¢ȱ™˜•’Œ’Žœȱ›ŽŠ›’—ȱ•˜’ŒȱŠŒŒŽœœDz
ƒŠ Š›Ž—ŽœœȱŠ—ȱ™Ž›–Š—Ž—ȱ›Š’—’—ȱ˜ȱ
‘ŽȱžœŽ›œȱ˜—ȱœŽŒž›’¢ȱ™˜•’Œ’ŽœDz
ƒŽœŠ‹•’œ‘’—ȱ‘ŽȱŠŠȱ˜ —Ž›œȱŠ—ȱžœŽ›œDz
ƒestablishing the data in custody;
ƒestablishing the security administrator;
ƒŽ’—’—ȱ—Ž ȱžœŽ›œDz
ƒŽœŠ‹•’œ‘’—ȱ˜›–Ž›ȱŽ–™•˜¢ŽŽœȂȱŠŒŒŽœœDz
ƒŽœŠ‹•’œ‘’—ȱŠž‘˜›’£Š’˜—ȱ™›˜ŒŽž›Žœȱ
for accessing documents;
ƒŽœŠ‹•’œ‘’—ȱ‹Šœ’ŒȱœŽŒž›’¢ȱ–ŽŠœž›Žœǰȱ
’–™•¢’—DZȱŽ’—’—ȱ‘Žȱ ˜›”’—ȱŽ—Ÿ’›˜—Ȭ
–Ž—ǰȱŠ—’Ÿ’›žœȱœ˜ Š›Žȱ˜ȱ‹ŽȱžœŽǰȱŠŒŒŽœœȱ
™Šœœ ˜›œȱ˜›ȱŽŸŽ›¢ȱ•ŽŸŽ•ǰȱ‘Žȱ Š¢ȱ’—ȱ ‘’Œ‘ȱ
‹ŠŒ”ž™œȱŠ›Žȱ˜’—ȱ˜ȱ‹Žȱ–ŠŽǰȱŸž•—Ž›Š‹’•’Ȭ
No. 6 ~ 2007
Finance - Accountancy 85
’ŽœȱŽ’—’’˜—ǰȱ–’—’–’£’—ȱœŽ›Ÿ’ŒŽœȱ‘Šȱ
ŒŠ—ȱ‹Žȱ™›˜Ÿ’Žȱ‹¢ȱ‘ŽȱœŽ›Ÿ’ŒŽǰȱ–˜Š•’¢ȱ˜ȱ
™ŠŒ‘’—ȱ‘Žȱœ¢œŽ–ǰȱ’—Ÿ˜•ŸŽȱȱ™Ž›œ˜——Ž•Dz
ƒstandard access.
Ȭ
Logic access audit implies:
ƒŽŽ›–’—’—ȱ‘˜œŽȱœŽŒž›’¢ȱ›’œ”œȱ›ŽȬ
Š›’—ȱ›Š—œŠŒ’˜—œȱ™›˜ŒŽœœ’—Dz
ƒevaluating controls regarding system
ŠŒŒŽœœȱ™Š‘œDz
ƒevaluating the control environment in
˜›Ž›ȱ˜ȱŽœŠ‹•’œ‘ȱ˜ȱ ‘ŠȱŽ¡Ž—ȱ‘ŠȱŒ˜—Ȭ
›˜•Ȃœȱ˜‹“ŽŒ’ŸŽœȱŠ›ŽȱŠŒ‘’ŽŸŽȱ‹¢ȱ‘ŽȱŽœȱ›ŽȬ
sults;
ƒŽŸŠ•žŠ’—ȱ‘ŽȱœŽŒž›’¢ȱŽ—Ÿ’›˜—–Ž—ǰȱ
‹¢ȱ›ŽŸ’œ’—ȱ‘ŽȱžœŽȱ™˜•’Œ’Žœǰȱ™›ŠŒ’ŒŽœȱŠ—ȱ
™›˜ŒŽž›Žœǯȱ
‹Ÿ’˜žœ•¢ǰȱ’—ȱ˜›Ž›ȱ˜ȱ˜‹Š’—ȱŠȱŒ•ŽŠ›ȱœ’Ȭ
žŠ’˜—ȱ˜ȱ‘ŽȱŽ—Ÿ’›˜—–Ž—ȂœȱœŽŒž›’¢ȱŠ—ȱ˜ȱ
›’œ”œȱŽŸŠ•žŠ’˜—ǰȱ‘Žȱ•˜’ŒȱŠŒŒŽœœȱŠž’ȱ—ŽŽœȱ
’›œȱ˜ȱŠ••ȱ˜˜ȱ”—˜ •ŽŽȱ˜ȱ‘ŽȱȱŽ—Ÿ’›˜—Ȭ
–Ž—ǯȱ—ȱ‘’œȱ›Žœ™ŽŒǰȱŠȱŽŽ›–’—Š—ȱŽ•Ž–Ž—ȱ
’œȱ›Ž™›ŽœŽ—Žȱ‹¢ȱ‘Žȱ researching of the acȬ
ŒŽœœȱ™Š‘œǰȱŠ—ȱ–˜›ŽȱŽ¡ŠŒ•¢ȱŽœŠ‹•’œ‘’—ȱ‘Žȱ
•˜’Œȱ Š¢ȱ˜›ȱŽŠŒ‘ȱ’—’Ÿ’žŠ•ȱžœŽ›ȱ˜ Š›œȱ
’—˜›–Š’˜—ǯȱ•œ˜ǰȱ‘ŽȱŠŒŒŽœœȱ˜ȱ‘Žȱœ¢œŽ–Ȃœȱ
Œ˜–™˜—Ž—œǰȱ˜›ȱŠ—ȱŽ’Œ’Ž—ȱŒ˜—›˜•ǰȱ’–™˜œŽœȱ
most times the žœŽȱ˜ȱœ™ŽŒ’Š•’œœȱ’—ȱ‘’œȱ’Ž• .
‘Ž¢ȱŒŠ—ȱ™›˜Ÿ’ŽȱŠŠȱ›ŽŠ›’—ȱœ¢œŽ–ȂœȱœŽȬ
Œž›’¢ǰȱŠ—ȱ‘Šȱ’œȱ ‘¢ȱ‘Ž¢ȱŠ›Žȱ›ŽŠ›ŽȱŠœȱŠȱ
valuable source for the auditor. C onsequentȬ
•¢ǰȱ‘Ž auditor is entitled to request an interȬ
Ÿ’Ž ȱ ’‘ȱ‘˜œŽȱœ™ŽŒ’Š•’œœǰȱ‘Ž—ŒŽȱŽŽ›–’— Ȭ
’—ȱ˜ȱ ‘ŠȱŽ¡Ž—ȱ‘Žȱ–Š—ŠŽ›’Š•ȱ™˜•’Œ’ŽœȱŠ›Žȱ
Ÿž•—Ž›Š‹•Žǰȱ˜›ȱ˜ȱ ‘ŠȱŽ¡Ž—ȱ‘Žȱ•˜’ŒȱœŽŒž Ȭ
›’¢ȱŠ—ȱŒ˜—’Ž—’Š•’¢ȱŠ›ŽȱŒ˜–™•’Žȱ ’‘ȱ’—ȱ
‘Šȱ™Š›’Œž•Š›ȱŽ—’¢ǯȱ•œ˜ǰȱ‘Ž›Žȱ–žœȱ—˜ȱ‹Žȱ
—Ž•ŽŒŽȱ‹¢ȱ‘ŽȱŠž’˜›ȱ‘ŽȱŠ—Š•¢œ’œȱ›Ž™˜›œȱ
›ŽŠ›’—ȱ‘ŽȱŒ˜—›˜•ȱ˜ȱŠŒŒŽœœȱ˜ȱœ˜ Š›Žǰȱ
—˜›ȱ‘ŽȱŠ—Š•¢œ’œȱŠ™™•’ŒŠ’˜—œȱ˜ȱ–Š—žŠ•ȱœ¢œ Ȭ
Ž–ȱ˜™Ž›Š’˜—œǯ
 86 Finance - Accountancy
The techniques used by the auditor
in testing the security are different. Some of
‘Ž–ȱ’—Ÿ˜•ŸŽDZȱ
ƒ”Ž¢œȱŠ—ȱŒŠ›ȱŸŽ›’’ŒŠ’˜—Dz
ƒterminal identification;
ƒusers identification and authenticaȬ
tion;
ƒresources control;
ƒŽ—Ž›’—ȱ‘Žȱ ˜›”’—ȱœŽœœ’˜—ȱŠ—ȱ›Ž Ȭ
™˜›’—ȱž—Šž‘˜›’£ŽȱŠŒŒŽœœDz
ƒ’—ŸŽœ’Š’—ȱž—Šž‘˜›’£ŽȱŠŒŒŽœœDz
ƒž—Œ˜—›˜••ŽȱœŽŒž›’¢ȱŠ—ȱŒ˜–™Ž—œŠȬ
tion controls;
ƒŠŒŒŽœœȱŒ˜—›˜•œȱŠ—Š•¢œ’œȱŠ—ȱ™Šœœ Ȭ ŽœǰȱŠ—ȱŠž‘˜›’£ŽȱŒ‘Š—Žœǯȱ
 ˜›œȱŠ–’—’œ›Š’˜—ǯ
Techniques investigation also involves
’—ŸŽœ’Š’—ȱ‘ŽȱŽŸ’Ž—ŒŽœȂȱ™›˜ŽŒ’˜—ǰȱ‘Žȱ
–˜Š•’¢ȱ˜ȱŒžœ˜¢ȱ˜‹Š’—’—ǰȱŠ—ȱ‘ŽȱŽ¡’œ Ȭ
Ž—ŒŽȱ˜ȱŒ›’–Žȱ’—ȱŒ˜–™žŽ›ȱ—Ž ˜›”œǯȱ
3. Auditing Network
Infrastructure Security
Controls regarding network infrastruc-
ture security audit involve verification by the
Šž’˜›ȱ˜ȱ‘Žȱ—Ž ˜›”ȱŠ›Œ‘’ŽŒž›ŽȂœȱ’Ž—’’Ȭ
ŒŠ’˜—ǰȱŽŽ›–’—’—ȱ‘ŽȱŽ’Œ’Ž—Œ¢ȱ˜ȱŠ™™•¢ Ȭ
’—ȱœŽŒž›’¢ȱ™˜•’Œ’ŽœǰȱŽŽ›–’—’—ȱ‘ŽȱžœŽȱ
œŠ—Š›œȱŠ—ȱ™›˜ŒŽž›Žœǰȱ’Ž—’¢’—ȱ‘Žȱ
™Ž›œ˜——Ž•ȱ’—ȱŒ‘Š›Žȱ ’‘ȱ—Ž ˜›”ȱœŽŒž›’¢ǰȱ
›ŽŠ—Š•¢£’—ȱ‘Žȱ—Ž ˜›”ȱŠ–’—’œ›Š’˜—ȱ™›˜Ȭ
ŒŽž›Žœǰȱ’—ȱŒŠœŽȱŸž•—Ž›Š‹’•’’ŽœȱŠ›Žȱ—˜’ŒŽǯȱ
—ȱ‘’œȱ›Žœ™ŽŒǰȱŠž’’—ȱ’—Ÿ˜•ŸŽœȱ‘ŽȱŠž’ȱ˜ȱ
’œŠ—ŒŽȱŠŒŒŽœœǰȱ‘ŽȱŠž’ȱ˜ȱ‘Žȱ™˜’—œȱ ‘Ž›Žȱ
‘ŽȱŒ˜–™žŽ›œȱ—Ž ˜›”ȱ’—Ž›ŠŒœȱ ’‘ȱ‘Žȱ’— Ȭ
ternet.
Combiningȱ‘ŽœŽȱ™›˜ŒŽž›ŽœȱŒŠ—ȱ‹Žȱ
˜ž—ȱ’—ȱ‘Žȱœ˜ȬŒŠ••Žȱ ™Ž—Ž›Š’˜—ȱŽœœ or of
—Ž ˜›”ȱ intrusion. These tests are of many
”’—œǰȱŽ™Ž—’—ȱ˜—ȱ‘Ž’›ȱ™ž›™˜œŽǰȱ˜‹“ŽŒ’ŸŽȱ
No. 6 ~ 2007
Š—ȱ—Šž›ŽǰȱœžŒ‘ȱŠœDZȱŽ¡Ž›—Š•ȱŽœœȱǻœ’–ž•Š Ȭ
’—ȱŠŠŒ”œȱŠ—ȱŽ¡Ž›—Š•ȱŒ˜—›˜•œǰȱŠ—ȱŠŒŒŽœœȱ
 Š¢ȱ‹Ž’—ȱ‘Žȱ’—Ž›—ŽǼǰȱ’—Ž›—Š•ȱŽœœȱǻœ’–’•Š›ȱ
˜ȱ‘ŽȱŽ¡Ž›—Š•ȱ˜—ŽœDZȱ’—›Š—ŽǼǰȱȃ‹•’—ȄȱŽœœȱ
(that test is limited or has no information reȬ
Š›’—ȱ‘Žȱœ¢œŽ–ǼȱŠ—ȱ˜ž‹•Žȱȃ‹•’—ȄȱŽœœǰȱ
˜ȱ™Š›’Œž•Š›ȱ™ž›™˜œŽǯ
‘Žȱ™‘ŠœŽœȱ˜ȱ‘Žȱ™Ž—Ž›Š’˜—ȱŽœœ ȱŠ›ŽDZȱ
™•Š——’—ǰȱ›ŽŸŽŠ•’—ǰȱŠŠŒ”ȱŠ—ȱ›Ž™˜›’—ǯȱ—ȱ
‘Žȱ™Ž—Ž›Š’˜—ȱŽœ’—ȱ‘Ž›ŽȱŠ›ŽȱŠ”Ž—ȱ’—˜ȱ
Œ˜—œ’Ž›Š’˜—ȱ‘Žȱ—Ž ˜›”ȱŽŸŠ•žŠ’˜—ȱŠ—Š•¢ Ȭ
œ’œǰȱ‘Žȱȱ—Ž ˜›”ȱŽŸŠ•žŠ’˜—ǰȱ‘ŽȱŽŸŽ• Ȭ
˜™–Ž—ȱŠ—ȱŠž‘˜›’£Š’˜—ȱ˜ȱ—Ž ˜›”ȱŒ‘Š—Ȭ
4. Security M easures in the
Entity – Client Relationship
Security of commercial transactions
The matter of security concerns the cliȬ
Ž—ǰȱ‘Žȱ—Ž ˜›”ǰȱ‘Žȱ’—˜›–Š’˜—ȱœ’Žȱ˜ȱ‘Žȱ
Œ˜–™Š—¢ȱ›Š’—ȱ’œȱ™›˜žŒœȱ˜›ȱœŽ›Ÿ’ŒŽœȱ˜—ȱ
‘Žȱ’—Ž›—Žǯȱ‘Žȱ›’œ”œȱŠ›’œ’—ȱ˜—ȱ‘ŽȱŒ•’Ž—Ȃœȱ
behalf are closely connected to disclosing
Œ˜—’Ž—’Š•ȱ’—˜›–Š’˜—ǰȱŠ—ȱŠ•œ˜ȱ˜ȱž—•Š  Ȭ
ž•ȱžœŽǯȱ‘ŽȱœŽŒž›’¢ȱ’œœžŽœȱ˜—ȱŠȱ—Ž ˜›”ȱ•ŽŸȬ
Ž•ȱŠ›ŽȱŒ˜—Œ›Ž’£Žȱ’—ȱŽ›–œȱ˜ȱ™Ž›˜›–Š—ŒŽœȱ
›Ž™›ŽœŽ—Žȱ‹¢ȱ‘Žȱ›Žœ™˜—œŽȱ’–ŽǰȱŠŠȱ›Š Ȭ
’ŒȱŽŒǯȱ—ȱ’–™˜›Š—ȱ›’œ”ȱ‘ŠȱŒŠ—ȱ‹ŽȱŠŒŽȱ
by the entity is that regarding the informaȬ
’˜—ȱŽ—Ÿ’›˜—–Ž—ȱ™Ž—Ž›Š’˜—ȱ›˜–ȱ‘ŽȱŸŽ›¢ȱ
’—Ž›—Žȱœ’Žǰȱ’—’—ȱŠž‘˜›’£Š’˜—ȱœ˜•ž’˜—œȱ
’—ȱŠ••ȱ™˜œœ’‹’•’’Žœȱ˜ȱžœ’—ȱœžŒ‘ǯ
Buyer-seller connection security
Ensuring trading transactions security
is not only a matter of security of the interȬ
—ŽȱŒ˜——ŽŒ’˜—ȱ‹Ž ŽŽ—ȱ‘ŽȱŒžœ˜–Ž›ȱŠ—ȱ‘Žȱ
œŽ••Ž›ǰȱ‹žȱ’ȱ’œȱŽšžŠ••¢ȱŠȱ–ŠŽ›ȱ˜ȱ‘ŽȱŒ•’Ž—ȱ
œŽ›Ÿ’ŒŽǯȱ‘ŽȱŒ•’Ž—Ȃœȱ’—˜›–Š’˜—ȱŽ—Ÿ’›˜—–Ž—ȱ
œ‘˜ž•ȱ‹Žȱ’Ž›Ž—ȱ‘Š—ȱ‘ŽȱœŽ••Ž›Ȃœȱ’—˜›–Š Ȭ

tion environment. An internet connection
‹Ž ŽŽ—ȱŠȱ‹›˜ œŽ›ȱŠ—ȱŠȱ Ž‹ȱœŽ›ŸŽ›ȱŒŠ—ȱ‹Žȱ
established by using the logic SSL module
(Secure Sockets Layer). SSL is integrated into
‘Žȱ‹›˜ œŽ›ȱŠ—ȱŽ—œž›ŽœȱŒ˜—’Ž—’Š•’¢ǯȱ
‘Žȱ–Š’—ȱŒ›Ž’ȱŒŠ›ȱ˜™Ž›Š˜›œȱ™›˜–˜Žȱ
SET (Secure Electronic Transaction). In this
ŒŠœŽǰȱ‘Žȱ›Š—œŠŒ’˜—ȱŠ—ȱŒ•’Ž—ȂœȱŒ›Ž’ȱŒŠ›ȱ
—ž–‹Ž›ȱŠ›ŽȱŽ—Œ’™‘Ž›Žȱ‹¢ȱ‘ŽȱŠ™™•’ŒŠ’˜—ȱ
and it is only then that they are sent to the
œŽ••Ž›ǯȱ‘ŽȱœŽ••Ž›ǰȱ’—ȱ’œȱž›—ȱ ’••ȱ›Ž’–‹ž›œŽȱ’œȱ
identification number and message returning
’ž›Žȱ‹Ž˜›Žȱ‹Ž’—ȱœŽ—ȱ˜ȱ‘Žȱ‹Š—”ǯȱ™˜—ȱ›ŽȬ
ŒŽ’™ǰȱ‘Žȱ‹Š—”ȱ ’••ȱŽŒ˜ŽǰȱŠž‘Ž—’ŒŠŽȱŠ—ȱ
’Ž—’¢ȱ‘ŽȱžœŽ›ǰȱ’—ȱ‘ŽȱœŠ–Žȱ’–ŽȱŽ•’ŸŽ›’—ȱ
’œȱŠ›ŽŽ–Ž—ȱ˜ȱ‘ŽȱœŽ••Ž›ȱ ‘’Œ‘ȱ’—ȱ’œȱž›—ȱ
 ’••ȱ™Ž›˜›–ȱ‘Žȱ›ŽšžŽœŽȱ›Š—œŠŒ’˜—ȱ˜›ȱ—˜ǯȱ
ȱ—˜ȱ–˜–Ž—ȱž›’—ȱ‘Žȱ›Š—œŠŒ’˜—ȱ ’••ȱ‘Žȱ
Œ›Ž’ȱŒŠ›ȱ‹Žȱ–ŠŽȱ™ž‹•’Œȱ˜›ȱ ’••ȱ‘ŽȱœŽ••Ž›ȱ
be identifiable.
Server securitizing
ŽŒž›’’£’—ȱ‘ŽȱœŽ›ŸŽ›ȱ’—Ÿ˜•ŸŽœȱŒ˜—›˜•Ȭ
ling the requests addressed to such and seȬ
Œž›’’£’—ȱ‘Žȱ’—˜›–Š’˜—ȱœ¢œŽ–ȱ˜ȱ ‘’Œ‘ȱ
it collaborates in order to return the service
requested by the customers. G rounded on
‘Žȱœ›’Œȱœ¢œŽ–ȱŒ˜—’ž›Š’˜—ǰȱ’œȱ™›˜ŽŒ Ȭ
’˜—ȱŠŠ’—œȱ‘ŽȱŽ¡Ž›’˜›ȱ’œȱžœžŠ••¢ȱ–ŠŽȱ‹¢ȱŠȱ
firewall. A firewall configuration is made by
the security criteria established for filtering
‘ŽȱŒ˜ŸŽ›Žȱ›Š’ŒȱŠ—ȱ‘žœȱŠȱŒ˜—›˜•ȱ™˜•’Œ¢ȱ
’œȱŠ™™•’Žȱ˜ŸŽ›ȱ‘Žȱœ¢œŽ–ȱŠŒŒŽœœǯȱ‘Ž›Ž˜›Žǰȱ
ŠŠȱ™›˜ŽŒ’˜—ȱŒ˜—œ’œœȱ˜ȱ•’–’’—ȱŠŒŒŽœœȱ˜ȱ
œžŒ‘ǰȱŠœȱ Ž••ȱŠœȱ˜ȱ™•ŠŒ’—ȱ‘Ž–ȱ˜ȱ‘Žȱ’œ™˜œȬ
Š•ȱ˜ȱŠž‘˜›’£ŽȱŒ•’Ž—œǯȱ
REFERENCES:
ŗǯȱOprea, Dumitru, Analysis and Design of Economic Information Systems ǻ˜–Š—’Š—DZȱ—Š•’£Šȱó’ȱ™›˜’ŽŒ-
Š›ŽŠȱœ’œŽ–Ž•˜›ȱ’—˜›–Šö’˜—Š•ŽȱŽŒ˜—˜–’ŒŽǼǰȱ˜•’›˜–ȱž‹•’œ‘’—ȱ
˜žœŽȱŗşşşǯ
No. 6 ~ 2007
Finance - Accountancy 87
—ȱ‘’œȱ›Žœ™ŽŒȱ‹žœ’—ŽœœŽœȱŒŠ—ȱŠ•œ˜ȱžœŽȱ
Œ˜–™Š—’Žœȱ‘ŠȱŠ›Žȱœ™ŽŒ’Š•’£Žȱ’—ȱŒ›ŽŠ’—ȱ
ŠŠȱœŽŒž›’’£’—ȱ–˜Ž•œȱ˜›ȱŽŸŽ—ȱœ™ŽŒ’Š• Ȭ
’£ŽȱŽ¡™Ž›œȱ’—ȱ‘’œȱ’Ž•ǯȱ˜—Ž‘Ž•Žœœǰȱ—Ž Ȭ
 ˜›”ȱŠ–’—’œ›Š˜›œȱ ’••ȱ—˜ȱ‹ŽȱŠ‹•Žȱ˜ȱ’– Ȭ
™•Ž–Ž—ȱŠ—ȱ–Š’—Š’—ȱ‘Žȱž—Œ’˜—Š•’¢ȱ˜ȱ‘Žȱ
Žœ’—Žȱ™•Š—ǯȱ›Š—’£Š’˜—œȱ–žœȱŽ—œž›Žȱ
material and financial conditions in order to
›Š’—ȱ‘Ž’›ȱ˜ —ȱ—Ž ˜›”ȱŠ–’—’œ›Š˜›œǰȱ‘žœȱ
ŠŸ˜’’—ȱž—™›Ž’ŒŽȱœ’žŠ’˜—œǯ
—ȱ›ŽŠ•’¢ǰȱ‘Ž›Žȱ ’••ȱ—ŽŸŽ›ȱ‹Žȱ™˜œœ’‹•Žȱ
for an information system to be totally secuȬ
›’’£Žǰȱ‹ŽŒŠžœŽȱ‘ŠŒ”Ž›œȱ ’••ȱŠ• Š¢œȱ’œŒ˜Ÿ Ȭ
Ž›ȱœŽŒž›’¢ȱŸž•—Ž›Š‹’•’’Žœȱ¢˜žȱŒ˜ž•—Ȃȱ‘’—”ȱ
˜ǰȱ ‘’Œ‘ȱ‘Ž¢ȱ ’••ȱžœŽȱ’—ȱ˜›Ž›ȱ˜ȱ‹›ŽŠ”ȱ‘Žȱ
œ¢œŽ–ǯȱŽ™Ž—’—ȱ˜—ȱ‘Žȱ‘ŠŒ”Ž›œȂȱ™ž›™˜œŽǰȱ
‘Ž¢ȱ ’••ȱŠŽŒȱ‘Žȱœ¢œŽ–ȱ˜›ȱ‘Ž¢ȱ ’••ȱ˜—•¢ȱ
Š›ŠŒȱ‘ŽȱŠŽ—’˜—ȱ˜ŸŽ›ȱ‘Žȱ›Žœ™ŽŒ’ŸŽȱȃ’œ Ȭ
œž›ŽœȄǯȱ—ȱ’–Žǰȱ‘Žȱ˜›Š—’£Š’˜—Ȃœȱ’—˜›–Š Ȭ
’˜—ȱœ¢œŽ–ȱŽŸ˜•ŸŽœȱŠ—ȱŽ¡™Š—œȱ‹¢ȱ—Ž ȱ
‘Š› Š›ŽȱŠ—ȱœ˜ Š›ŽȱŒ˜–™˜—Ž—œǯȱ•˜—ȱ
 ’‘ȱ‘Žȱœ¢œŽ–ȂœȱŽŸ˜•ž’˜—ǰȱ˜‘Ž›ȱŸž•—Ž›Š Ȭ
‹’•’’Žœȱ ’••ȱŠ•œ˜ȱŠ™™ŽŠ›ȱ˜›ȱ ‘’Œ‘ȱ—Ž ȱœŽŒž Ȭ
›’’£’—ȱœ˜•ž’˜—œȱœ‘˜ž•ȱ‹ŽȱŽŸŽ•˜™Žǯ
In conclusionǰȱ ŽȱŒŠ—ȱŠœœŽ›ȱ‘Šȱ˜—•¢ȱ
‹¢ȱ™Ž›–Š—Ž—•¢ȱ’—ŸŽœ’—ȱ’—˜ȱŠȱŒ˜–™•Ž¡ȱœŽ Ȭ
Œž›’¢ȱ–˜Ž•ȱ Žȱ ’••ȱ‹ŽȱŠ‹•Žȱ˜ȱ‘ŠŸŽȱœŠŽ›ȱ
ȱœ¢œŽ–œǯȱ‘Ž›Ž˜›Žǰȱ‘ŽȱœŽŒž›’¢ȱœ˜•ž’˜—œȱ
Š—ȱŠ•œ˜ȱ‘ŽȱœŽŒž›’¢ȱ™˜•’Œ¢ȱœ‘˜ž•ȱ‹ŽȱŒ˜—œ’Ȭ
Ž›Žȱ•˜‹Š••¢ǰȱŠ—ȱ—˜ȱ“žœȱ™ž—ŒžŠ••¢ǯȱ‘Ž›Žȱ
must not be neglected the fact that the securiȬ
¢ȱ•ŽŸŽ•ȱ˜ȱ‘ŽȱŽ—’›Žȱœ¢œŽ–ȱ’œȱ›Ž™›ŽœŽ—Žȱ‹¢ȱ
’œȱ ŽŠ”Žœȱ•’—”ǰȱŠ—ȱ‘Šȱ’œȱ ‘¢ȱ‘ŽȱœŽŒž›’¢ȱ
™˜•’Œ¢ȱœ‘˜ž•ȱ‹Žȱž™ŠŽȱ™Ž›’˜’ŒŠ••¢ǯȱ
 88 Finance - Accountancy

ŘǯȱŸŠ—ȱǯǰȱ˜óŒŠȱ ‘ǯǰȱŠ™’œ’£žȱǯǰȱInformation Systems Audit ǻ˜–Š—’Š—DZȱAuditul sistemelor informaticeǼǰȱ

ȱž‹•’œ‘’—ȱ
˜žœŽǰȱžŒ‘Š›ŽœǰȱŘŖŖśǯ
řǯȱMunteanu, A, Accountancy Information Systems’ Audit ǻ˜–Š—’Š—DZȱAuditul sistemelor informationale
contabileǼǰȱ˜•’›˜–ȱž‹•’œ‘’—ȱ
˜žœŽǰȱŠœ’ǰȱŘŖŖŗǯ
ŚǯȱŠœŠœŽȱǯǰȱ•’ȱǯǰȱŠœŠœŽȱǯǰȱŠ—Œ’žȱǯǰȱ˜™ŽœŒžȱ ‘ǯǰȱ ‘Ž˜›‘Žȱǯǰȱ©‹ŽŠ—žȱǯǰȱȱ˜•ŽŠ—žȱȱǯǰȱ
Gavrila AlǯǰȱInformation Systems’ Audit and Control ǻ˜–Š—’Š—DZȱAuditul si controlul sistemelor informationaleǼǰȱȱ
Œ˜—˜–’ŒŠȱž‹•’œ‘’—ȱ
˜žœŽǰȱžŒ‘Š›ŽœǰȱŘŖŖŝǯ
5. Popescu, Gheorghe, Internal Control Proceedings and Financial Audit ǻ˜–Š—’Š—DZȱProcedurile controlu-
lui intern si auditul financiarǼǰȱ Žœ’ž—ŽŠȱž‹•’œ‘’—ȱ
˜žœŽǰȱžŒ‘Š›Žœǰȱŗşşŝǯ
ŜǯȱPopescu, Veronica, Expert Systems for Auditing M anagement Information Systems ǻ˜–Š—’Š—DZȱSisteme
expert pentru auditarea sistemelor informatice de gestiuneǼǰȱ Žœ’ž—ŽŠȱž‹•’œ‘’—ȱȱ
˜žœŽǰȱžŒ‘Š›ŽœǰȱŘŖŖŜǯ
7.    ǯ’œŠŒŠǯ˜›g
Şǯȱ‘™DZȦȦŒŒ˜ǯŒ’œŒ˜ǯŒ˜m

No. 6 ~ 2007