TFL Vsebine / Revija SIR*IUS

The information systems auditors' issues at the logical access audit assurance activities

Eden najpomembnejših gradnikov pri varovanju informacij za učinkovito ter varno uporabo informacijskih sistemov so ustrezni dejavniki prepoznavanja uporabnika ob dostopu do informacijskega sistema ter učinkovita uporaba ustreznih varnostnih ukrepov za kontrole upravljanja in nadzora uporabniškega dostopa. Vendar se moramo zavedati, da je najpomembnejši in morda tudi najšibkejši člen človek – uporabnik informacijskih sistemov. Prispevek seznani bralca z dejavniki prepoznavanja neprivilegiranega uporabnika ter predstavi pomembne standarde, metodologije in dobre prakse na tem področju. V pregledu literature so predstavljeni nekateri strokovni in znanstveni prispevki o tej temi. V prispevku so predstavljene tudi izkušnje iz dajanja zagotovil na tem področju v Sloveniji ter nekatere možne aktivnosti v zvezi z njihovim izvajanjem. Revizorji informacijskih sistemov moramo biti pri dajanju zagotovil, pri revizijah, pregledih in dogovorjenih postopkih pozorni na nepravilnosti in nezakonita dejanja. Posojanje gesel spada med nepravilnosti in predstavlja varnostne incidente ter kršitev varovanja informacij. S temi izzivi se lahko srečujemo na vseh področjih: dejavnosti posameznih organizacij, kjer so dostopi do podatkov v informacijske sisteme zaščiteni z uporabniškimi imeni in gesli. Prispevek revizorje informacijskih sistemov opozarja na te nepravilnosti in pojasnjuje načine prepoznavanja teh dejanj in zmanjševanja tveganj.

One of the most important building blocks of information security in an effective and secure use of information systems is the relevant identification of the user having access to the information system. Information security must provide effective use of appropriate safety measures for the control of the management and of user access. However, we must be aware that the most important and perhaps the weakest link within the information system are people – the information system users. The paper acquaints the reader with the elements identifying the user, and presents some important standards, methodologies and best practices in this field. The literature review presents some technical and scientific input on this topic. The paper also presents the experience of assurances in this area in Slovenia, and some possible activities for providing them. Information systems auditors have to provide assurance in audits, reviews and agreed-upon procedures and should pay attention to irregularities and illegal acts. Lending passwords are one of the irregularities constituting security incidents and violation of information security. Such challenges may be encountered in all areas of activities of individual organizations, where the access to data in the information systems is protected by usernames and passwords. The contribution of information system auditors draws attention to these irregularities and explains how to identify them and reduce the risks.