Methodology and software development for auditing information security management systems

Objectives. Classification of information systems (IS) security indicators and the creation of the method of improved software tool based on its results (in comparison with similar software tool developed earlier by the authors) for auditing information security management systems of organizations in the Republic of Belarus.
Methods. During the development and improvement of the software tool using the method of systeminformation analysis and the approaches to its implementation were identified based on following capabilities: organization of questionnaires of heads of departments and services whose specialists work with IS designed to information processing not classified as state secrets or IS with limited dissemination; assessment of the level of compliance of the organization's IS information protection system with the requirements established by the legislation of the Republic of Belarus and other national regulatory legal acts; systematization of recommendations for improving the level of compliance of the organization's IS protection system with the established requirements.
Results. Based on the results of the developed improved software tool approbation, it was found that the use of this tool makes it possible to reduce by 20–30 % the financing of costs for the implementation of the auditing the information security management systems of an organization.
Conclusion. The developed improved software tool, compared to analogues, is characterized by reduced cost due to the following properties: ease of launch and configuration; independence from the type of operating system; the possibility of organizing both local and remote access. The developed improved software tool was tested in the branch "Long-Distance Communication Branch" of RUE "Beletelecom".

1. Boiprav V. A., Kovalev V. V., Utin L. L. Software for audit of information protection system of the organization. Doklady Belorusskogo gosudarstvennogo universiteta informatiki i radioèlektroniki [Reports of the Belarusian State University of Informatics and Radioelectronics], 2018, № 5(115), рр. 44–49 (In Russ.).

2. Pandey S. K., Mustafa K. A comparative study of risk assessment methodologies for information systems. Bulletin of Electrical Engineering and Informatics, 2012, vol. 1, no. 2, рр. 111–122.

3. Sagitova V. V., Vasil'ev V. I. Application of the method of expert assessments to automate the audit of personal data information systems. Vestnik Ufimskogo gosudarstvennogo aviacionnogo tehnicheskogo universiteta [Bulletin of the Ufa State Aviation Technical University], 2017, vol. 21, no. 3(73), рр. 105–112 (In Russ.).

4. Yakimova Z. V., Pushkina A. S. Dynamics of the level of personnel involvement depending on the length of service in the organization. Azimut nauchnyh issledovanij: jekonomika i upravlenie [Azimuth of Scientific Research: Economics and Management], 2018, no. 1(22), рp. 283–286 (In Russ.).

5. Kuzminykh I., Ghita B., Sokolov V., Bakhshi T. Information security risk assessment. Encyclopedia, 2021, vol. 1(3), рр. 602–617.

6. Nest D. P. van der, Smidt L., Lubbe D. The use of generalised audit software by internal audit functions in a developing country: a maturity level assessment. Risk Governance and Control: Financial Markets & Institutions, 2017, vol. 7(4–2), рр. 189–202.

7. Lehmann C. M. Integrating generalized audit software and teaching fraud detection in information systems auditing courses. Journal of Forensic & Investigative Accounting, 2012, vol. 4, iss. 1, рр. 319–368.

8. Steinbart P. J., Gal G., Dilla W. N., Raschke R. L. SECURQUAL: An instrument for evaluating the effectiveness of enterprise information security programs. Journal of Information Systems, 2015, vol. 30(1), рр. 71–92.