---
title: "Security audit and security protocols"
subject: "Information System"
chapter: 2
key: "semester_8/information_system:security-audit-role-protocols"
source: https://www.bctengineer.com/q/semester_8/information_system/security-audit-role-protocols
site: BCT Engineering
---

# Security audit and security protocols

Information System · Chapter 2: Control, Audit and Security of Information Systems

- Asked in: 2074 Bhadra, 4+4 marks
- Video: [What is Cybersecurity Audit and why it's important? Importance for IT, Audit & Risk Professionals](https://www.youtube.com/watch?v=5ryXF6swdJk) — Audit Decoded by Mayuri
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/information_system/security-audit-role-protocols
- Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2

## Question

Describe the role of security audit for information system. What are the necessary protocols to ensure the stringent security for modern information system?

## Short answer

A security audit reviews policies and controls to identify vulnerabilities, verify compliance, and recommend improvements, building trust and ensuring system integrity. Essential protocols include SSL/TLS for encrypted web traffic, IPsec for VPNs, SSH for secure remote access, Kerberos for authentication, and WPA3 for wireless security.

## Answer

#### Role of security audit
A **security audit** is a systematic, independent review of an information system's security policies, controls, configuration and practices against a standard (e.g. ISO 27001) to check that they are adequate and working.

Roles:
1. **Identify vulnerabilities** and weak controls before attackers exploit them.
2. **Verify compliance** with laws, policies and standards.
3. **Assess risk** and recommend corrective actions with priorities.
4. **Check access control**, user privileges, logs and backup procedures.
5. **Detect fraud and misuse** by reviewing audit trails.
6. **Confirm integrity and availability** of data and systems.
7. **Build management and customer trust**, and support continuous improvement.
8. **Test incident response** and disaster recovery readiness.

#### Protocols for strong security
| Protocol | Purpose |
|---|---|
| **SSL/TLS** | Encrypts web traffic between client and server |
| **HTTPS** | HTTP over TLS for secure browsing |
| **IPsec** | Secures IP packets; used in VPN |
| **SSH** | Secure remote login and file transfer |
| **SFTP / FTPS** | Secure file transfer |
| **Kerberos** | Ticket-based network authentication |
| **S/MIME, PGP** | Secure email |
| **WPA2/WPA3** | Wireless security |
| **SET / 3-D Secure** | Secure card payments |
| **RADIUS / LDAP** | Centralised authentication and directory services |

Combined with firewalls, multi-factor authentication, strong encryption and regular patching, these protocols provide stringent security.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What is a security audit?
   A. A tool that blocks malware
   B. A systematic independent review of security policies and controls against a standard
   C. A backup of all data
   D. A firewall rule set
   Answer: B. It checks that controls are adequate and working. (Key point: Audit definition)

2. Which is a role of a security audit?
   A. Identify vulnerabilities and verify compliance
   B. Replace all employees
   C. Increase hardware cost
   D. Delete audit logs
   Answer: A. Audits find weak controls and check compliance. (Key point: Audit role)

3. Which protocol encrypts web traffic between client and server?
   A. Kerberos
   B. RADIUS
   C. SSL/TLS
   D. WPA2
   Answer: C. Kerberos is ticket-based authentication, RADIUS is centralised authentication, WPA2 is wireless. (Key point: TLS)

4. What is Kerberos used for?
   A. Secure email
   B. Wireless security
   C. Secure file transfer
   D. Ticket-based network authentication
   Answer: D. S/MIME and PGP are for email, WPA2 for wireless, SFTP for files. (Key point: Kerberos)

## Related in Information System

- [Information audit and its benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ainformation-audit-benefits) — Information System, chapter 2
- [IS audit and CAATs](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-audit-caatt) — Information System, chapter 2
- [Strategic information system and benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Astrategic-is-benefits) — Information System, chapter 1, asked 2×
- [Geographic Information System](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Agis-characteristics-uses) — Information System, chapter 1
- [Short note: HR information system](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ashort-note-hris) — Information System, chapter 6
- [Threats, controls and security measures](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-threats-controls-measures) — Information System, chapter 2, asked 3×

## Related in other subjects

- [Email security with diagram and protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finternet_and_intranet%3Aemail-security-diagram) — Internet and Intranet, chapter 3
- [Role of electrical energy in modern society](https://www.bctengineer.com/question.md?key=semester_7%2Futilization_of_electrical_energy%3Arole-electrical-energy-modern-society) — Utilization of Electrical Energy, chapter 1
- [Short note: information security model](https://www.bctengineer.com/question.md?key=semester_6%2Foperating_system%3Ainfo-security-model-note) — Operating System, chapter 8
- [LTI system and closed loop in modern systems](https://www.bctengineer.com/question.md?key=semester_3%2Fcontrol_systems%3Alti-define-cl-pronounced) — Control Systems, chapter 1