3.5System audit and legal affairs

No matter how thorough the technical controls, management and business partners cannot trust their effectiveness unless they are objectively verified by an independent third party. Also, a security professional's own actions (diagnostics, investigations, etc.) can be penalized even when well-intentioned if they fall outside the bounds of the law. This section covers the "verification mechanism" of auditing and the major laws relevant to information security practice, building the judgment needed to determine how a given act is treated legally, and how it would be flagged in an audit.

3.5.1System audit (independence, audit procedures, audit trail)

• System audit is the activity by which a qualified professional, from an objective standpoint, verifies and evaluates whether controls over information-system-related risks are appropriately designed and operated. Without independence (standing independent from the audited department), the objectivity and credibility of the audit are undermined.
• An audit generally proceeds according to audit procedures: developing an audit plan, carrying out document review, interviews with relevant personnel, and on-site inspection, collecting and evaluating evidence, and producing an audit report. The auditor must properly retain the records underlying their own judgments (the audit trail—logs, records of procedures performed, etc.) so a third party can later verify them.

3.5.2Internal control

• Internal control refers collectively to the processes and structures built into an organization (segregation of duties, approval processes, monitoring, etc.) to ensure operations are conducted properly and efficiently. Evaluating the effectiveness of internal control over information systems overlaps with the system audit that targets IT controls.
• A system auditor is responsible for verifying whether the IT control portion of the internal control built by management (access-privilege management, change management, backup operations, etc.) is actually functioning. Do not confuse the division of roles: "building" internal control is management's responsibility, while "verifying its effectiveness" is the auditor's role.

Suppose a system auditor is assigned to audit Company A's customer management system. Before starting, it comes to light that this auditor was previously involved as a developer in the system's requirements definition and design. In this case, even if the auditor is highly knowledgeable, having them evaluate a system they themselves helped design would compromise independence, so either a different auditor must be assigned, or at minimum the conflict of interest must be documented explicitly in the audit report. Once the audit actually begins, the auditor follows audit procedures: reviewing the access-privilege ledger, interviewing responsible staff, and checking actual access logs. Suppose it emerges that a departed employee's account had not been deactivated even three months after their departure. This fact alone does not reveal why deactivation failed, so the auditor verifies whether an account-deactivation procedure exists, and if so, whether it was followed. If no procedure exists at all, the finding is recorded as "a deficiency in internal control over account management"; if a procedure exists but was not followed, it is recorded as "an operational deviation"—each a distinct kind of finding. Furthermore, the records underlying this finding—the access-privilege ledger review and interview notes—must be retained as the audit trail, so that if Company A's management or an external party later asks "why did you reach that conclusion," the auditor can trace back and present the grounds. System audit is thus not merely "finding and pointing out problems," but a process of systematically building the grounds for a finding from an independent standpoint and leaving them in a verifiable form.

3.5.3Related laws (Unauthorized Computer Access Law, Personal Information Protection Act, Basic Act on Cybersecurity, Penal Code)

• The Act on Prohibition of Unauthorized Computer Access prohibits acts that bypass access-control functions using another person's ID/password without authorization (unauthorized access), as well as providing an ID/password with the intent of facilitating such acts. Penetration testing conducted under legitimate business authority, with proper authorization from the requesting party, does not constitute the illegal unauthorized access this law targets.
• The Act on the Protection of Personal Information requires businesses that handle personal information to specify the purpose of use, obtain it appropriately, take safety-control measures, and restrict third-party provision, among other obligations. For a security professional, the practically important points are the obligation to report to the Personal Information Protection Commission and to notify affected individuals when personal data is leaked or similarly compromised.
• The Basic Act on Cybersecurity establishes the basic principles of the nation's overall cybersecurity policy and the responsibilities of the national government, local governments, and critical-infrastructure operators, and it is also the legal basis for establishing NISC (the National center of Incident readiness and Strategy for Cybersecurity). Note that it does not directly regulate individual technical acts, but rather has the character of defining a policy and institutional framework.
• The Penal Code provisions on unauthorized creation of electromagnetic records (the so-called "virus creation offense") penalize, without legitimate reason, creating, providing, executing, acquiring, or storing a program that issues unauthorized commands such as a computer virus. Even storing malware samples for analysis or research purposes requires that it be done under a structure and controls recognized as having legitimate reason.

3.5.4Section summary

• System audit lives or dies on independence. It proceeds according to audit procedures, and the grounds for judgment are retained as a verifiable audit trail
• Do not confuse the division of roles: building internal control is management's responsibility, while verifying its effectiveness is the auditor's role
• The Unauthorized Computer Access Law judges by whether authorization exists, regardless of good intent; the Act on the Protection of Personal Information imposes reporting/notification obligations on a leak; the Basic Act on Cybersecurity sets a policy framework; the Penal Code defines offenses such as virus creation