Excerpt. © Reprinted by permission. All rights reserved.
Auditing is not, at first appearance, an exciting topic. So why would anyone volunteer to spend months of effort writing a booklet that may never be read? Well, for a real answer, we have to look beyond the simple, well-known notion of the security audit.
Auditng is about the rigorous examiniation of a system, the identification of any shortfalls in compliance or practices, and the organised repair and improvement of that system. It is about ensuring that appropriate controls and processes are in place, and that staff are able to perform their jobs with appropriate training, resources and support.
Auditing is a very important tool for technical communities such as system administrators to have at their disposal. It can help them gain a better appreciation of the surrounding context of their actions and the impact of the changes they are planning. It allows them to step out of the day-to-day mire of problems, to see the wood for the trees, and to plot the path forward.
