Logo des Repositoriums
 
Zeitschriftenartikel

Towards data-driven decision support for organizational IT security audits

Vorschaubild nicht verfügbar

Volltext URI

Dokumententyp

Text/Journal Article

Zusatzinformation

Datum

2018

Zeitschriftentitel

ISSN der Zeitschrift

Bandtitel

Verlag

De Gruyter

Zusammenfassung

As the IT landscape of organizations increasingly needs to comply with various laws and regulations, organizations manage a plethora of security-related data and have to verify the adequacy and effectiveness of their security controls through internal and external audits. Existing Governance, Risk and Compliance (GRC) approaches provide little support for auditors or are tailored to the needs of auditors and do not fully support required management activities of the auditee. To address this gap and move towards a holistic solution, a data-driven approach is proposed. Following the design science research paradigm, a data-driven approach for audit data management and analytics that addresses organizational needs as well as requirements for audit data analytics was developed. We contribute workflow support and associated data models to support auditing and security decision making processes. The evaluation shows the viability of the proposed IT artifact and its potential to reduce costs and complexity of security management processes and IT security audits. By developing a model and associated decision support workflows for the entire IT security audit lifecycle, we present a solution for both the auditee and the auditor. This is useful to developers of GRC tools, vendors, auditors and organizational decision makers.

Beschreibung

Brunner, Michael; Sillaber, Christian; Demetz, Lukas; Manhart, Markus; Breu, Ruth (2018): Towards data-driven decision support for organizational IT security audits. it - Information Technology: Vol. 60, No. 4. DOI: 10.1515/itit-2018-0002. Berlin: De Gruyter. PISSN: 2196-7032. pp. 207-217

Zitierform

Tags