2 cissp ® Official Study Guide Eighth Edition

665
Security Audits
Security audits
use many of the same techniques followed during security assessments but 
must be performed by independent auditors. While an organization’s security staff may 
routinely perform security tests and assessments, this is not the case for audits. Assessment 
and testing results are meant for internal use only and are designed to evaluate controls 
with an eye toward finding potential improvements. Audits, on the other hand, are evalua-
tions performed with the purpose of demonstrating the effectiveness of controls to a third 
party. The staff who design, implement, and monitor controls for an organization have an 
inherent conflict of interest when evaluating the effectiveness of those controls.
Auditors provide an impartial, unbiased view of the state of security controls. They 
write reports that are quite similar to security assessment reports, but those reports are 
intended for different audiences that may include an organization’s board of directors, gov-
ernment regulators, and other third parties. There are three main types of audits: internal 
audits, external audits, and third-party audits.
Government Auditors discover Air Traffic Control Security vulnerabilities
Federal, state, and local governments also use internal and external auditors to perform 
security assessments. The U.S. Government Accountability Office (GAO) performs audits 
at the request of Congress, and these GAO audits often focus on information security 
risks. In 2015, the GAO released an audit report titled “Information Security: FAA Needs 
to Address Weaknesses in Air Traffic Control Systems.”
The conclusion of this report was damning: “While the Federal Aviation Administration 
(FAA) has taken steps to protect its air traffic control systems from cyber-based and other 
threats, significant security control weaknesses remain, threatening the agency’s ability 
to ensure the safe and uninterrupted operation of the national airspace system (NAS). 
These include weaknesses in controls intended to prevent, limit and detect unauthorized 
access to computer resources, such as controls for protecting system boundaries, identi-
fying and authenticating users, authorizing users to access systems, encrypting sensitive 
data, and auditing and monitoring activity on FAA’s systems.”
The report went on to make 17 recommendations on how the FAA might improve 
its information security controls to better protect the integrity and availability of the 
nation’s air traffic control system. The full GAO report may be found at 
http://gao.gov/
assets/670/668169.pdf
.