Auditing The Security Of Information Systems Within An Organization

The safety provided by a well configured firewall is no excuse for neglecting the standard security procedures; setting up and installing a firewall is the first line of defense and not a full proof solution, auditing being only one component of the system, whilst the other is protecting the resources and when we consider auditing as being the process of recording certain events that take place on a computer or within a network, we must come to the conclusion that this is the only technique that allows us to identify the source of a possible issue within the network. Information security is used as a means to protect the intellectual property rights, whilst the main objective in setting up an information security system is to enlist the confidence of prospective business partners. In accordance with the legal requisites and the principle of maximizing one’s investment, regardless of the many forms it could take, or the means through which it is stored, transmitted or distributed, information must be protected. Information security is not only a technical problem, but mainly a managerial issue, as the security standard, ISO/IEC 17799 meets the needs of any type of organization, be it public or private, through a series of practices related to the management of information security. This paper aims to present the process of taking entry data from a plethora of programs and storing it in a central location. Due to its flexibility, this process can be a useful auditing instrument, as long as we are familiar with the way it works and how the events are recorded.