1

TL;DR

Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ?

Hello,

Let's say you're a software developer. And you need to create a web app for managing information in a database. The process you'll follow to deliver the sofware here will go like this

  • database modeling (with tools such as ER diagram)
  • software architecture modeling (with UML )
  • Database implementation with a DBMS (ex : MySQL) and SQL
  • Software programming with design pattern like MVC and programming language like Java

An IT security framework is a series of documented processes used to define policies and procedures around the implementation and ongoing management of information security controls in an enterprise environment.

Source : https://searchsecurity.techtarget.com/tip/IT-security-frameworks-and-standards-Choosing-the-right-one

Such frameworks are COBIT, ISO 27001, NIST SP 800 53, CIS controls, HITRUST CSF, etc.... Those are more like guide like for managers to help them make sure their system is compliant with a standard

My question is : for an IT security analyst/auditor, are there standards that combine the two situations above i.e. a process of conducting technical analysis/audits of a system maintaining a standard ?

I'm asking that because when reading materials like CEH or Cyber Kill Chain, they do not look "professional". It's just a bunch of black hat techniques (not really methodologies) that are combined and offered to so called white hats.

But on a day-to-day basis, how would a technical team of analysts/auditors would organised itself to be professional (possibly by following a framework) without spending their time doing reconnaissance, scanning, exploitation etc... non sense acting like black hackers instead of being productive security professional

Improve this question

1 Answer 1

Reset to default
3

Yes, ISO/IEC 27007 provides guidance on managing an information security management system (ISMS) audit program, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011:2011.

ISO/IEC 27007 is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit program.

See the index here and the complete content of 19011:2011 here.

Improve this answer
4
  • Yes. I read a little about it here. I'm wondering if the how in ....determining what to audit, when and how... may be a little to vague, theorerical, not too technical (for instance it won't say "Take Burp and do this or that".... But since I have not read the document, I can't really say. Do you have a copy ? PM me please. lol .... Anyways as soon as I get enough money I'll buy it. Thank you Overmind
    – Jason Krs
    Commented Jun 6, 2019 at 20:47
  • Check the links I have added.
    – Overmind
    Commented Jun 7, 2019 at 5:41
  • 1
    @JasonKrs Standards are always theoretical, not technical. Because standards are only updated every few years, and technology moves faster than that, but the underlying theory changes much more slowly.
    – Mike Scott
    Commented Jun 7, 2019 at 5:53
  • That is correct, they are meant as general guidelines, nothing more. More than than, there are things very situation-specific that won't fit-in.
    – Overmind
    Commented Jun 7, 2019 at 5:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .