Managing Network Security  How Does a Typical IT Audit Work?  by
Fred Cohen  Series Introduction    A lot of people think of the
tax collector when the work audit comes up. I had one of those
and it certainly seems like a negative association to me. Others
think of financial audits, compliance audits, and so forth. In
most of these, people are asked the most embarassing possible
questions by people who understand very little about what these
people do in their work, and the objective is to find some
mistake or malicious act that has resulted in some financial
harm to the organization. If nothing is found, the auditor must
not have been looking hard enough.  I wish I could tell you that
IT audit is much different, but to most people, it is not. I
figured it might be worthwhile to give you a view from the
inside of an IT auditor's head - my own - about what we do and
why we do it this way.  Outline of an audit:  Whenever I do an
IT audit activity, I always seem to start at the same place. It
is a system I have