27
procedures
in
running
intrusion
detection
systems
and
acquiring
the
outcome
to
be
audited and analyzed.
In
order
to
effectively
control
information
technology
management in
business-
oriented
process,
ISACA
designs
a
set
of
frameworks
called
Control
Objectives for
Information
and
related
Technology
(COBIT)
that
delivers
comprehensive control
objectives and
general
audit
and
management
guidelines. COBIT
framework
has
helped
to
define
standard
and
measurement of
procedures
for
P3
IS
Auditing
Procedure:
Intrusion
Detection
System
Review
Documentation by
ISACA.
The
main
objective
of
this
procedure
documentation is
to
appropriately
deliver
complete
guidance
in
implementing and
administrating
IDS
and
support
the
IDS
administrators or
IS
auditors
in using and reviewing IDS, as well as basic explanations about IDS.
The
P3
document
principally defines
suggestion
of
procedures related
to
the
intrusion
detection
system
applications. According
the
guideline
[11],
there
are
several
steps of procedures for which the administrators or IS auditors need to take:
•
The
first
step
is
to
establish
the
review
planning.
IS
auditor
is
responsible
in
collecting
specific
data
about
the
overall
structure
of
the
system,
including
the
size,
complexity,
and
process
environment of
the
system.
IS
auditor
requires
to
prepare
the
understanding of
the
organization’s
dependence
of
information
systems
and
the
perceptive
of
the
organization’s
ideas
and
business
objectives
and
determine
the
information
system
risks
and
exposures.
They
also
need
to
understand
how accountable the IT staffs of the organization have
in
maintaining
the
IDS.
The
objective
needs
to
meet
criteria
requirements
acknowledged
by
 |