Audit of Information Security - the Main Stages, Conceptual Framework, Classification of Types
Purpose. The control of adequacy of methods and means of protection is important for a process of creating of an information security system. Audit of information security perform such the control. However, the published works do not contain a system classification of audit activities. Test as one of the types of audit activities of information security is not sufficiently examined. Test of real systems are considered only as "penetration testing" or " instrumental audit". The purpose of the paper is to systematize of main stages of a information security audit, theoretical and practical methods of audit, classification of audit activities. The testing as experimental research of the information system is considered with particular attention. Results and their novelty. The author's approach to the systematization and classification of audit and testing activities is presented in the paper. The theoretical approach to the audit based on the concept of "model based testing" is considered in the paper. A new practical approach to the audit is proposed in the paper as well. This practical approach is based on a study of the information systems using special means such as cyber-attacks and information-psychological influences. Methods were used. Methods of system analysis, logical induction and deduction were used for the systematization and classification of audit activities. Practical relevance. Systematization and classification of audit and testing activities, as well as proposals for audit in the form of experimental studies can be used to creation new means of cyber-attacks and information-psychological influences for testing and audit of information security.