Network Security News

Enterprise software needs auditing

Tuesday, July 8, 2008

As big business becomes more reliant on virtualized enterprise software, an independent data security evaluation strategy needs to be brought into force to ensure that data is protected in the auditing process.

Such is the suggestion of ZDNet enterprise network security blogger Dennis Howlett, who has noted in a recent entry that many firms are facing the prospect of data breaches as their reliance on virtualized enterprise software grows.

Howlett noted that while there are many benefits to using virtualized business services, an effective data security standard needs to be developed in order to minimize the risk of data leaks in the auditing process.

The current auditing standard - the Statement on Auditing Standards (SAS) 70 - may not be able to carry out effective security evaluation as the number of virtualized services and providers proliferates.

Many of these software developers are neglecting their responsibilities as set out by the American Institute of Certified Public Accountants, Howlett suggested.

As such, he concluded: "The SAS70 issue can be addressed but in my opinion requires a different type of audit - one that is informed by systems thinking and not based on financial accounting."