Stephen D. Gantz
Copyright
Acquiring Editor:Steve Elliot
Editorial Project Manager:Benjamin Rearick
Project Manager:Malathi Samayan
Designer:Matthew Limbert
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
2014 Elsevier Inc. All rights reserved
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described here in. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Gantz, Stephen D.
The basics of IT audit: purposes, processes, and practical information / Stephen D. Gantz.
pages cm
Includes bibliographical references and index.
ISBN 978-0-12-417159-6 (pbk.)
1. Information technologyAuditing. 2. Computer security. 3. Computer networks--Security measures. I. Title.
T58.5.G37 2013
004.068'1--dc23
2013036148
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
For information on all Syngress publications, visit our website at store.elsevier.com/Syngress
ISBN: 978-0-12-417159-6
Printed and bound in the United States of America
14 15 16 13 12 11 10 9 8 7 6 5 4 3 2 1
![Dedication Dedicated to my wife Rene my son Henry and my daughters Claire and - photo 3](/uploads/posts/book/58902/images/F000122fm03-9780124171596.jpg)
Dedication
Dedicated to my wife Rene, my son Henry, and my daughters Claire and Gillian, without whose support and forbearance I would not have been able to devote the necessary time and energy into this project.
Acknowledgments
I would like to acknowledge the very capable support provided by members of the Syngress/Elsevier team in bringing this project to completion, particularly including Steve Elliot and Ben Rearick. Thanks also go to Steven Maske for his helpful feedback, comments, and technical edits on this book. I am also grateful for the guidance and constructive criticism on my writing provided by Dr. Thomas Mierzwa, who served as my dissertation adviser as I completed my doctorate in management shortly before beginning work on this book.
Work in information technology (IT) characterizes my entire careeras a consultant, as a software and security architect, and as an educator and author. I appreciate the many professional opportunities I have received during that time, including my initial exposure to fraud detection and forensic investigation from Malcolm Sparrow more than 15 years ago and subsequent experience in IT auditing and information security since that time. I have been fortunate to work for many managers and executives who have encouraged my continued career development and self-directed projects and writing initiatives. I am especially grateful for the leadership and support of my current management team, including Michele Kang, Davis Foster, Aaron Daniels, Tom Stepka, and Sean Gallagher, who collectively helped in providing a dynamic and engaging work environment and the opportunity to challenge myself on many types of internal and client-facing projects.
About the Author
Dr Stephen D. Gantz (CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO) is an information security and information technology (IT) consultant with over 20 years of experience in security and privacy management, enterprise architecture, systems development and integration, and strategic planning. He currently holds an executive position with a health information technology services firm primarily serving federal and state government customers. He is also an associate professor of Information Assurance in the Graduate School at University of Maryland University College (UMUC) and an adjunct lecturer in the Health Information Technology program of the Catholic University of Americas School of Library and Information Science. He maintains a security-focused web site and blog at http://www.securityarchitecture.com.
His security and privacy expertise spans program management, security architecture, policy development and enforcement, risk assessment, and regulatory compliance with major legislation such as FISMA, HIPAA, and the Privacy Act. His industry experience includes health, financial services, higher education, consumer products, and manufacturing, but since 2000 his work has focused on security and other information resources management functions in state and federal government agencies and in private sector industries responsible for critical infrastructure. He holds a Doctor of Management degree from UMUC, where his dissertation focused on trust and distrust in inter-organizational networks, alliances, and other cooperative relationships. He also earned a masters degree in public policy from the Kennedy School of Government at Harvard University and a bachelors degree from Harvard. He currently resides in Arlington, Virginia with his wife Rene and children Henry, Claire, and Gillian.
About the Technical Editor
Steven Maske (CISA, CISSP) is an information security professional with over 12 years in the information technology (IT) industry. As the lead security engineer for a Fortune 1000 company he designs, develops, and tests information security solutions and establishes policies, procedures, and controls to ensure regulatory compliance. He is responsible for identifying and managing risks and overseeing IT projects and strategic initiatives. He has previous experience as a consultant where he performed over 150 vulnerability assessments, penetration tests, and IT audits.
He is an active member of the security community and can be found on Twitter as @ITSecurity or via his blog, http://SecurityRamblings.com.