MyMIS ii. Internal control audit These tools are used to determine the effectiveness of control or safety measures. It includes analysis on both ICT and non-ICT based controls or safety measures. Techniques used include inquiry, observation and testing to detect illegal acts, misuse, errors, irregular incidents or a general lack of compliance iii. Security checklist This is a tool normally developed by system owners to ensure that changes to the ICT system configuration has been reviewed. The checklists should be formulated to reflect local operation of an ICT installation. iv. Penetration testing The penetration test could be used as a tool to emulate the real life situation of potential attackers attempting to break into ICT systems. Findings from the tests are used to overcome vulnerabilities and weaknesses. On conducting such tests the ‘attackers’ should be using tools as would be used by the genuine attacker such as: * automated tools as described previously; * manual penetration; * internet tools; and * social engineering. 2.5.2.2 Public Sector ICT Security need to be monitored continuously. Monitoring Methods and Tools The ICTSOs and senior management in the public sector need to be sensitive to the vulnerabilities of the Public Sector ICT Security and react to ICT incidents. Thus it is important that the monitoring of the entire Public Sector ICT Security should be treated as an on-going process. Many tools are available today and there are more being developed to handle new and complex attacks on ICT establishments. Below are some of the tools used for monitoring which also complements tools used in auditing. These tools enable monitoring to review ICT systems regularly and in real time. Access to audit tools, tabulation analysis and recommendations should be restricted and authorised. (a) ICT System Logs A documented evidence and a chronological event of all ICT system activities. This log should consist of information such as identification of unauthorised access, unexplained or abnormal activities. The logs should be viewed regularly in order to verify the usual and/or unusual activities in the ICT system. Best practice : View and check the log daily on critical or sensitive systems. Copyright MAMPU Chapter 2 - 16