Information Security and Internal Audit Working

Transcript:Information Security and Internal Audit Working:
Information Security and Internal Audit Working Together Copyright Copyright Paul Lepkowski 2011. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author. Summary There are many ways whereby both Information Security and Internal Audit departments can work together. This session explores the successful model that Rochester Institute of Technology (RIT) has used to drive several IT security audits. Session Outcomes At the end of the session, an audience member would be able to: Identify the steps needed to utilize both audit and information security departments in an audit Design a plan for their next IT security audit Implement their next IT security audit in a more efficient manner Topics Areas of discussion include: Using Infosec resources to complement audit resources Handling the politics of both groups working together Audit planning Technical interpretation and advisement Vulnerability and penetration testing Benefits of this relationship will be explored in-depth About the Speaker Paul Lepkowski Enterprise Information Security Lead Engineer Rochester Institute of Technology (RIT) Certifications: CISSP, GIAC-GPEN Experience: 19 years in both network engineering and security Worked in both university and corporate environments Specializations Network and systems security Vulnerability assessment Penetration testing Private Information (PI) protection Professional Organizations ISSA Rochester Infragard – Vice President IEEE Audit Role Provide technical assistance regarding all aspects of IT audits to RIT Internal Audit Special Acknowledgment Elisa Cockburn, CPA Senior Internal Auditor RIT’s Institute Audit, Compliance, and Advisement Specializes in accounting and information systems auditing MBA in MIS Member of Association of Colleges and University Auditors (ACUA), Institute of Internal Auditors (IIA), and Information Systems Control and Audit Association (ISACA) About RIT Rochester Institute of Technology Founded in 1829 Rochester, NY 17,500 active students 11th largest private university in US 3,600 faculty and staff Undergraduate and graduate level Information Security programs Organizational Considerations At RIT - separate and independent groups: Board of Directors – Audit Committee Chief Financial Officer Internal Audit Global Risk Management Information and Technology Services (ITS) Information Security Office (ISO) The Problem Often the internal audit department does not have the time, technical expertise, or budget to properly handle IT security audits. Audit groups consist of a