TFL Vsebine / Revija SIR*IUS

Cybersecurity auditing

Dogodki na področju kibernetske varnosti v prvi polovici 2017 v Sloveniji in svetu nas opozarjajo, kako zelo smo ranljivi in premalo ozaveščeni na tem področju. Kibernetski napadi manjših in večjih razsežnosti se dogajajo in so del naše stvarnosti. Države, podjetja in posamezniki se različno odzivajo na te grožnje in ranljivosti. Dvigovanje odpornosti proti tem tveganjem lahko izvajamo samo z načrtnim in rednim spremljanjem varnostnih dogodkov, sprotnim nadgrajevanjem zaščitnih in varnostnih ukrepov in rednim preverjanjem – revizijo kibernetske varnosti. Prispevek seznani bralca s trenutnim stanjem v Sloveniji ter predstavi pomembne standarde, metodologije in dobre prakse na tem področju. Podrobno je opisan celovit okvir za preverjanje stanja kibernetske varnosti. V prispevku so predstavljene tudi izkušnje iz dajanja zagotovil na tem področju v Sloveniji ter nekatere možne aktivnosti v zvezi z njihovim izvajanjem. Revizorji informacijskih sistemov moramo biti pri dajanju zagotovil, revizijah ali pregledih pozorni na celovitost in kompleksnost tega področja. Prispevek osvešča revizorje informacijskih sistemov in jih usmerja k uporabi predstavljenega celovitega okvira za revizijo kibernetske varnosti.

Events in the field of cyber security in Slovenia as well as in the world in the first half of 2017 remind us how much we are vulnerable, and how big is lack of awareness in this area. Cyberattacks of smaller and larger dimensions happen and are part of our reality. Countries, companies and individuals respond differently to these threats and vulnerabilities. Raising resistance against these risks can only be carried out with systematic and regular monitoring of security events, ongoing upgrading security and safety measures and regular checking – auditing cybersecurity. The paper acquaints the reader with the current situation in Slovenia and presents the relevant standards, methodologies and best practices in this field. The framework for cybersecurity is presented. In addition, the paper presents the experience with regard to providing assurance in this field in Slovenia, as well as some of the possible activities in relation to their implementation. Information systems auditors have to pay attention to the integrity and complexity of this area. The paper raises the awareness of information system auditors and instructs them on the use of the presented integrated framework for cybersecurity audits.