Governance, Audits, and Evidence

What is the main purpose of security governance?

To provide direction, accountability, and policies for managing organizational security.

What is compliance in cybersecurity?

Meeting established requirements, standards, and obligations.

What is the purpose of cybersecurity auditing?

To review and verify evidence showing whether security policies and controls are actually being followed.

What is the difference between governance, compliance, and auditing?

Governance provides direction; compliance defines requirements; auditing provides evidence.

How does penetration testing differ from security auditing?

Penetration testing examines whether weaknesses can be exploited; auditing examines whether security is being managed according to expectations.

Why is evidence important in a security audit?

It allows organizations to verify actual behavior instead of relying on assumptions.

What is the security audit improvement sequence?

Policy → Control → Activity → Evidence → Audit → Improve.

What four organizational risks can audits expose?

Inadequate information security, inefficient resource deployment, weak policies and procedures, and internal IT-related fraud.

What are the three main audit lenses discussed in the notes?

Permissions auditing, usage auditing, and audit logs.

What is permissions auditing?

Reviewing user and group access rights to verify that permissions match job responsibilities and least privilege.

What is usage auditing?

Examining how systems and resources are actually used to determine whether activity follows organizational policy.

What is an audit log?

A record of system activity that helps identify who performed an action, what happened, and when.

What is the difference between permissions auditing and usage auditing?

Permissions auditing examines what users can access; usage auditing examines what users actually do.

What is the principle of least privilege?

Giving users enough access to perform their jobs without unnecessary permissions.

What is privilege creep?

The accumulation of unnecessary access rights when users change roles but retain permissions from previous responsibilities.

Why is privilege creep a security risk?

Accounts gain more access than their current jobs require, increasing opportunities for misuse or fraud.

What should a permissions audit examine?

Least privilege, group memberships, administrative rights, and access that is no longer needed.

An employee changes departments but keeps old administrative permissions. What is this an example of?

Privilege creep.

How can an organization reduce privilege creep?

Review permissions regularly and remove access that no longer matches current job responsibilities.

Can an employee have authorized access but still violate security policy?

Yes. Having permission to access information does not mean every use of that access is appropriate.

An employee repeatedly views records unrelated to their job. Which audit lens is most useful?

Usage auditing.

What is the difference between a role, a right, and use?

Role: job responsibilities; Right: what an account can do; Use: what the person actually does.

What three basic questions should an audit log answer?

Who performed the action, what happened, and when it occurred.

What information might a detailed audit event contain?

Timestamp, username, source device, action, resource, result, session, IP address, and policy.

What is an audit trail?

A chronological sequence of related system events used to reconstruct activity.

Why are chronological audit trails useful?

They can reveal suspicious patterns that individual events may not show.

Why must audit logs be protected?

To prevent unauthorized alteration or deletion and preserve trustworthy evidence.

What four methods help protect audit logs?

Access controls, write-once storage, regular review, and separate evidence storage.

What is write-once storage?

Storage that prevents ordinary modification of records after they have been written.

Why should audit logs be stored separately from monitored systems?

To reduce the chance that compromising one system also destroys its evidence.

Why is regular audit log review necessary?

Logs provide value when suspicious activity is identified, investigated, and addressed.

What are three types of logging discussed in the notes?

Security logs, advanced audit policies, and device logs.

What is risk mitigation?

Reducing an organization's exposure to risk.

What are the five steps from an audit finding to risk mitigation?

Find → Assess → Change → Verify → Monitor.

How do audit logs support compliance?

They provide evidence that required policies, procedures, access restrictions, and security controls are being followed.