Estimation of Labor Time at the Information Security Audit and Improvement of Audit Work Quality by Usage of Probabilistic Risk Assessment

摘要

Based on the factors that are available at the initial phase of the audit task, this paper proposes a labor time estimation method for the information security audit in the form of formula, statistically analyzing the data of the past 20 cases. Initially, audit mode, operation mode, penetration degree, and company size are considered to be the factors that could influence the labor time, and thus the "quantitative analysis I" is conducted with these factors. However the results were not sufficiently positive. As a result, by dividing audit mode into regular and emergency audit and by using company size as the factor, labor time estimation formula has been established by means of the regression analysis. Compared to regular audit, it is found that emergency audit takes more labor time at information security audit. We try to investigate this factor by probabilistic risk assessment.