Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 10 down vote favorite
2

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the right direction. Specific links to journals and/or templates that are used would be very helpful.

This question was IT Security Question of the Week.
Read the Sep 23, 2011 blog entry for more details or submit your own Question of the Week.

share|improve this question
Are you starting a program at a company or striking out as a consultant on your own? – Jeff Ferland♦ Sep 13 '11 at 15:11
Any particular market sector? There are many different standards that apply to many different kinds of IT systems. – MToecker Sep 15 '11 at 21:20
Thank you very much for your replies. Yes I have started my CISA examination in one of the chapters they have around the world( Muscat). According to your replies I guess im in the right path. You are right, my knowledge from academia and what I saw in the field was quite different. I failed to make a connection between academia and what I saw in some of sample reports, hence my question here. Thank u again. – skimmer Sep 16 '11 at 0:15

3 Answers

up vote 12 down vote accepted

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents.

From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of specific technologies, and contributed to maybe 50 of those. The time investment is pretty high.

In saying that, I would definitely suggest you join ISACA (the Information Systems Audit and Control Association), which is the definitive body for this industry. A vast amount of information is available through ISACA, including CobIT and audit guidance.

(disclosure - one of my roles is President of the Scottish ISACA chapter)

share|improve this answer
up vote 8 down vote

The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations.

I've met good auditors, and I've met poor auditors, and good auditing is more than having the right software, journals, or templates. I don't know what your masters is in, but it likely has not prepared you for being on-the-ground in an audit. Being in front of clients, asking questions, and digging out the answers that they don't even know they have sometimes. (You don't mention your work experience, which may be relevant for all I know).

Just my .02c. Good luck!

share|improve this answer
+1 - very good point. The disconnect between academia and practice in this discipline is quite astonishing. Nobody does all the things that best practice would indicate they should. – Rory Alsop♦ Sep 13 '11 at 15:45
1  
Don't forget the conflict between the company hiring you and your attempt to find deficiencies. Managing that issue is a complicated business aspect that few can manage well. – this.josh Sep 15 '11 at 18:36
up vote 1 down vote

You could look at PTES - Penetration Testing Execution Standard site - http://www.pentest-standard.org/index.php/Main_Page

It's slowly getting filled out but has a lot of very useful information.

You could also look at the Open Source Security Testing Methodology Manual - http://www.isecom.org/osstmm/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.