Auditing informal

The timestamp of the report does not provide information about the temporal validity of audit information. It is likely that the vulnerability did exist before the audit time. As a conservative measure, we consider that vulnerability exists before the current audit report and up to the time of the previous report if it exists, forever otherwise. When a new report becomes available, events generated after the time of the previous report are reevaluated in the light of the current report. They remain as is they were... 

Another annoying feature of most audit assessment tools is that they provide information about the vulnerabilities found, and not the ones that do not exist in the information system. It is therefore difficult to practice anticorrelation and degrade the severity of events that are not security risks for the information system. To obtain this effect, we currently manually maintain a set of simple rules indicating which vulnerability sets cannot be found in our corporate network. For example, we exclude all IIS vulnerabilities from events coming from hosting zones, as we do not offer this platform in our services. Note that we do not consider here the case where the vulnerability assessment tool fails to discover the vulnerability. Audit information is considered trusted. 

Similar to complaint trends, internal audit information that reveals recurring noncompliance patterns related to such product-specific activities as manufacturing, process controls, stability testing, and operator performance should alert QA of the possibility this may have on released product. The key is to intercept the product before it is released and a recall is demanded. 

Audit information Primary individuals who were involved in conducting the audit can be identified by name and position title. This will provide those reading the audit report with a list of individuals who can be contacted if there are questions regarding the audit. The date the audit was conducted can be recorded. The name and general information of the school that was audited can be included to specifically identify the school that is the topic of the report. 

Institute a range of quality control procedures to ensure that el ibility criteria are respected, payments are audited, information systems have appropriate safeguards, and so on. (See chapter 6.)... 

Compilation of audit information through interviews and document review... 

The system provides the operator a global or partial plant status display by means of several diagrams and/or tables, mimics, histograms, graphs, alphanumeric and auditive information, etc. 

---