nach oben

Erschienen in:

2023 | OriginalPaper | Buchkapitel

CRAG: A Guideline to Perform a Cybersecurity Risk Audits

verfasst von : Isaac D. Sánchez-García, Tomás San Feliu Gilabert, Jose A. Calvo-Manzano

Erschienen in: Telematics and Computing

Verlag: Springer Nature Switzerland

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

The cybersecurity risk audit is a relatively new field. The objective of cybersecurity risk audits is to identify deficiencies or deviations in cybersecurity countermeasures. Currently, cybersecurity risk audit guidelines do not include an internal control approach that aligns with cybersecurity standards such as ISO 27001 or the NIST CSF. Internal control is essential for addressing cybersecurity risk audits. This article proposes a cybersecurity risk audit guideline called CRAG (Cybersecurity Risk Audit Guideline), created using the SADT (Structured Analysis and Design Technique) model. CRAG aims to be comprehensive in the various applications that a cybersecurity risk audit guideline can have. The CRAG guideline consists of seven steps and 28 activities, as well as the content that the resulting audit report should include. Additionally, this article provides guidelines for its proper implementation, as well as examples of its potential applications.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Interactions in the Digital Learning Ecosystem in Teacher Learning Outcomes

Nächstes Kapitel Adversarial Attack Versus a Bio-Inspired Defensive Method for Image Classification

Li, H., No, W.G., Boritz, J.E.: Are external auditors concerned about cyber incidents? evidence from audit fees. Auditing: A J. Pract. Theory 39(1), 151–171 (2020). https://doi.org/10.2308/ajpt-52593CrossRef

Rosati, P., Gogolin, F., Lynn, T.: Audit firm assessments of cyber-security risk: evidence from audit fees and sec comment letters. Int. J. Account. 54(03), 1950013 (2019). https://doi.org/10.1142/S1094406019500136CrossRef

Tom Smith, T.J., Higgs, J.L., Pinsker, R.E.: Do auditors price breach risk in their audit fees? J. Inform. Syst. 33(2), 177–204 (2019). https://doi.org/10.2308/isys-52241CrossRef

Li, H., No, W.G., Wang, T.: SEC’s cybersecurity disclosure guidance and disclosed cybersecurity risk factors. Int. J. Account. Inf. Syst. 30, 40–55 (2018). https://doi.org/10.1016/j.accinf.2018.06.003CrossRef

Calderon, T.G., Gao, L.: Cybersecurity risks disclosure and implied audit risks: evidence from audit fees. Int. J. Audit. 25(1), 24–39 (2021). https://doi.org/10.1111/ijau.12209CrossRef

Beuren, I.M., Machado, V.N., Dall Agnol, A.J.: Relevance of internal controls for risk management: empirical evidence from the perception of its executors and reviewers in a multinational company. Corporate Governance: Int. J. Bus. Soc. 23(6), 1233–1250 (2023). https://doi.org/10.1108/CG-05-2022-0200CrossRef

Chalmers, K., Hay, D., Khlif, H.: Internal control in accounting research: a review. J. Account. Lit. 42(1), 80–103 (2019). https://doi.org/10.1016/j.acclit.2018.03.002CrossRef

Haislip, J.Z., Masli, A., Richardson, V.J., Sanchez, J.M.: Repairing organizational legitimacy following information technology (IT) material weaknesses: executive turnover, IT expertise, and IT system upgrades. J. Inf. Syst. 30(1), 41–70 (2016). https://doi.org/10.2308/isys-51294CrossRef

International Organization for Standardization: “ISO/IEC 27004:2016,” Information technology — Security techniques — Information security, 2016. https://www.iso.org/standard/64120.html. Accessed 24 Oct 2022

10.

National Institute of Standards and Technology: NIST Cybersecurity framework. In: Proceedings of the Annual ISA Analysis Division Symposium, vol. 535, pp. 9–25 (2018)

11.

Information Systems Audit and Control Associatio: COBIT 2019. www.isaca.org/COBIT (2018). Accessed: 08 May 2022

12.

Galligan, M.E., Rau, K.: COSO in the cyber age (2015)

13.

IAASB: International Auditing and Assurance Standards Board. https://www.iaasb.org/ (2023). Accessed 22 May 2023

14.

Public Company Accounting Oversight Board. Sarbanes Oxley Act. (2002)

15.

Al-Matari, O.M.M., Helal, I.M.A., Mazen, S.A., Elhennawy, S.: Integrated framework for cybersecurity auditing. Inform. Secur. J. 30(4), 189–204 (2021). https://doi.org/10.1080/19393555.2020.1834649CrossRef

16.

European Confederation of Institutes of Internal Auditors: ‘Risk in focus 2021. Hot topics for internal auditors. https://www.eciia.eu/wp-content/uploads/2020/09/100242-RISK-IN-FOCUS-2021-52PP-ECIIA-Online-V2.pdf (2020)

17.

Duncan, B., Whittington, M.: Compliance with standards, assurance and audit: Does this equal security? In: ACM International Conference Proceeding Series, Association for Computing Machinery, pp. 77–84 (2014). doi: https://doi.org/10.1145/2659651.2659711

18.

Sánchez-García, I.D., Feliu Gilabert, T.S., Calvo-Manzano, J.A.: Countermeasures and their taxonomies for risk treatment in cybersecurity: a systematic mapping review. Comput. Secur. 128, 103170 (2023). https://doi.org/10.1016/j.cose.2023.103170CrossRef

19.

Sánchez-García, I.D., Mejía, J., Feliu Gilabert, T.S.: Cybersecurity risk assessment: a systematic mapping review, proposal, and validation. Appl. Sci. 13(1), 395 (2022). https://doi.org/10.3390/app13010395CrossRef

20.

Congram, C., Epelman, M.: How to describe your service. Int. J. Serv. Ind. Manag. 6(2), 6–23 (1995). https://doi.org/10.1108/09564239510084914CrossRef

21.

Islamova, O.V., Zhilyaev, A.A., Bozieva, A.M.: SADT technology as a tool to improve efficiency in the use of process approach in management of engineering enterprise. In: 2016 IEEE Conference on Quality Management, Transport and Information Security, Information Technologies (IT&MQ&IS), IEEE, pp. 65–68 (2016). https://doi.org/10.1109/ITMQIS.2016.7751903

22.

Olbort, J., Röhm, B., Kutscher, V., Anderl, R.: Integration of communication using OPC UA in MBSE for the development of cyber-physical systems. Procedia CIRP 109, 227–232 (2022). https://doi.org/10.1016/j.procir.2022.05.241CrossRef

23.

Bygdas, E., Jaatun, L.A., Antonsen, S.B., Ringen, A., Eiring, E.: Evaluating threat modeling tools: microsoft TMT versus OWASP threat dragon. In: 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), IEEE, pp. 1–7 (2021). https://doi.org/10.1109/CyberSA52016.2021.9478215

24.

Derradji, R., Hamzi, R.: Multi-criterion analysis based on integrated process-risk optimization. J. Eng. Des. Technol. 18(5), 1015–1035 (2020). https://doi.org/10.1108/JEDT-08-2019-0201CrossRef

25.

Microsoft Global: ISO/IEC 27001:2013 Information Security Management Standards (2021). https://docs.microsoft.com/en-us/compliance/regulatory/offering-iso-27001. Accessed 01 Sep 2021

26.

Security Standards Council: PCI DSS Quick Reference Guide. www.pcisecuritystandards.org (2018)

27.

Center for Internet Security: CIS Critical Security Controls® CIS Critical Security Controls. www.cisecurity.org/controls/ (2021)

28.

Yildiz, M., Abawajy, J., Ercan, T., Bernoth, A.: A layered security approach for cloud computing infrastructure. In: 2009 10th International Symposium on Pervasive Systems, Algorithms, and Networks, , pp. 763–767. IEEE (2009). https://doi.org/10.1109/I-SPAN.2009.157

29.

ISACA: An Introduction to the Business Model for Information Security. www.isaca.org (2009)

30.

Mancero Arias, M.G., Arroba Salto, I.M., Pazmiño Enríquez, J.E.: Modelo de control interno para pymes en base al informe COSO – ERM. Universidad Ciencia y Tecnología 24(105), 4–11 (2020). https://doi.org/10.47460/uct.v24i105.375CrossRef

31.

Aditya, B.R., Ferdiana, R., Santosa, P.I.: Toward modern IT audit- current issues and literature review. In: 2018 4th International Conference on Science and Technology (ICST), pp. 1–6. IEEE (2018). https://doi.org/10.1109/ICSTC.2018.8528627

Titel: CRAG: A Guideline to Perform a Cybersecurity Risk Audits
verfasst von: Isaac D. Sánchez-García
Tomás San Feliu Gilabert
Jose A. Calvo-Manzano
Verlag: Springer Nature Switzerland
Buch: Telematics and Computing
Print ISBN: 978-3-031-45315-1

Electronic ISBN: 978-3-031-45316-8

Copyright-Jahr: 2023
DOI: https://doi.org/10.1007/978-3-031-45316-8_33

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Premium Partner