MyMIS (a) Audit Methods i. Public Sector ICT Security Review Public Sector ICT Security Review can be conducted by internal staff. This review is comparative in nature and is regarded only as informative. Reviews are normally conducted for a short duration but its preliminary initial results may lead to more advanced and detailed types of audits. ii. Internal Audit The internal audit measures the compliance of the ICT systems. The results of this exercise could be used as a guide even though there may be a conflict of interest. In every environment, the internal staff is more knowledgeable in the ICT system installation, system security, etc than a third party. Hence the internal audit review is a required step to be performed. Inadequacy of an internal review is that a poorly designed or poorly operated security system could still be acceptable. On the other hand, there could be a strong desire to improve the Public Sector ICT Security system. iii. External Audit In comparison, external auditing involves a third party that has no stake in the ICT systems. The independent party should review the ICT system installation, system security, etc. In all three cases it is important to ensure that auditing personnel possess sufficient knowledge of Public Sector ICT Security. Suitable generic auditing tools for the various types of audit described above are briefly explained below: (b) Audit Tools i. Automated tools (active and passive tools ) Tools for auditing the Public Sector ICT Security system. The use of automated tools reduces the amount of work that has to be completed. It is used to identify a variety of threats and vulnerabilities such as improper access control, weak password or failure in using current up-dates and patches. Active automated tools are designed to locate vulnerabilities by trying to exploit them. Passive automated tools examine only the ICT system and infer the existence of problems. The government’s Public Sector ICT Security could be in a difficult situation if automated tools are not used. This is primarily due to the fact that hackers use similar tools to identify weaknesses of the ICT system. Some of the current automated tools are easier to use while others require specific skills and pre-requisites. Copyright MAMPU Chapter 2 - 15