Summary
This work presents the planning of an information security audit in an e-commerce company,
focusing on two critical systems: the Inventory Management System (IMS) and the Online
Payment System (OPS). The organizational structure and business plan of the company are
briefly described, highlighting the importance of security in transaction processing and
product management. The audit planning proposes external and internal penetration tests to
identify vulnerabilities and ensure data integrity. The audit timeline is presented over five
weeks, with a focus on protecting the confidentiality, integrity, and availability of the systems.
Abstract
This paper presents the planning of an information security audit for an e-commerce
company, focusing on two critical systems: the Inventory Management System (IMS) and the
Online Payment System (OPS). The organizational structure and business plan are briefly
described, emphasizing the importance of security in transaction processing and product
management. The audit plan proposes external and internal penetration tests to identify
vulnerabilities and ensure data integrity. The audit timeline is scheduled over five weeks,
focusing on protecting the confidentiality, integrity, and availability of the systems.
Table of Contents
Summary..................................................................................................................................1
Abstract................................................................................................................................... 2
Table of Contents.................................................................................................................... 3
1. Introduction......................................................................................................................... 4
2. Organizational Structure.................................................................................................... 5
2.1 Executive Board............................................................................................................ 5
2.2 Information Technology (IT) Department...................................................................... 5
2.3 Sales and Operations Department................................................................................5
2.4 Marketing Department...................................................................................................5
2.5 Finance Department..................................................................................................... 5
2.6 Human Resources (HR) Department............................................................................ 6
2.7 Legal Department......................................................................................................... 6
3. Business Plan..................................................................................................................... 7
3.1 Online Sales..................................................................................................................7
3.2 Expansion through Partnerships................................................................................... 7
3.3 Customer Experience....................................................................................................7
4. Critical Business Systems................................................................................................. 8
4.1 Inventory Management System (IMS).......................................................................... 8
4.2 Online Payment System (OPS).....................................................................................8
5. Systems Audit Planning...................................................................................................10
5.1 Audit Objectives.......................................................................................................... 10
5.2 Methodology................................................................................................................11
5.3 Audit Timeline............................................................................................................. 12
6. Conclusion........................................................................................................................ 15
7. References.........................................................................................................................17
1. Introduction
With the rapid growth of the digitization of business processes, information security has
become a critical factor for the continuity and success of organizations, especially those
operating in the digital environment. The e-commerce sector, in particular, faces increasingly
significant challenges regarding the protection of sensitive data, such as customer
information and financial transactions, as well as ensuring the availability of online services,
which are the primary channel for sales and customer interaction.
The growing sophistication of cyberattacks requires companies to adopt robust security
practices, including regular audits and penetration tests, to ensure their systems are
protected against potential vulnerabilities. Conducting security audits on critical systems is
essential to identify weaknesses, evaluate access controls, and strengthen defenses against
internal and external attacks.
In this context, this report presents the planning of an information security audit for an
e-commerce company, focusing on two critical systems: the Inventory Management System
(IMS) and the Online Payment System (OPS). The IMS is responsible for controlling
inventory levels in real-time, ensuring that the products available on the website match the
physical stock. Meanwhile, the OPS is tasked with securely processing all financial
transactions, ensuring the integrity and confidentiality of customers' payment information.
In addition to describing the organizational structure and business plan of the company, this
work proposes a detailed timeline for the audit, based on conducting penetration tests aimed
at evaluating the security of the aforementioned systems. The tests will cover both external
and internal threats, simulating real-world cyberattack scenarios and monitoring potential
vulnerabilities in the organization’s controls and security policies.
The importance of this audit is directly tied to the company’s technological dependence to
keep its operations running, as well as the trust customers place in the security of their data.
Ultimately, the report aims to provide recommendations to mitigate identified risks, ensuring
that critical systems comply with the best information security practices and align with the
company’s strategic business plan.
2. Organizational Structure
The analyzed e-commerce company has an organizational structure tailored to the needs of
the digital market, ensuring operational efficiency and support for critical business areas.
Below is a brief description of the main departments and their responsibilities:
2.1 Executive Board
The Executive Board is responsible for the organization’s strategic decisions, defining its
long-term vision and goals. It coordinates and oversees operations, ensuring alignment
across departments to meet the company’s objectives.
2.2 Information Technology (IT) Department
The IT department manages the technological infrastructure and information security,
focusing on the development, maintenance, and protection of the company’s critical systems,
such as the e-commerce platform, the Inventory Management System (IMS), and the Online
Payment System (OPS).
2.3 Sales and Operations Department
This department manages the product catalog, monitors online sales, and coordinates the
logistics of order deliveries. It also provides customer support during the purchasing and
post-sale processes.
2.4 Marketing Department
Responsible for promoting the brand and products, it uses digital marketing campaigns and
optimizes the user experience on the website to increase traffic and sales.
2.5 Finance Department
Manages cash flow, accounting, and payments, while ensuring the secure processing of
financial transactions through the Online Payment System (OPS).
2.6 Human Resources (HR) Department
Handles personnel management, recruitment, training, and professional development, while
fostering a positive organizational culture and retaining talent.
2.7 Legal Department
Ensures the company’s legal compliance, focusing on data protection regulations (such as
LGPD) and reviewing contracts and internal policies.
3. Business Plan
The e-commerce company’s business plan focuses on providing an efficient and secure
online shopping experience, aiming to stand out in a highly competitive market. The main
strategy is based on three pillars:
3.1 Online Sales
The company operates through an e-commerce platform that offers a wide variety of
products. The focus is on ensuring intuitive navigation, a fast purchasing process, and
transaction security, maximizing customer satisfaction and encouraging repeat purchases.
3.2 Expansion through Partnerships
To expand its product portfolio and reach new markets, the company establishes strategic
partnerships with suppliers and relevant brands. This approach allows it to offer a broader
range of products without requiring significant initial investments in inventory, optimizing
costs and adding value to its offerings.
3.3 Customer Experience
Customer satisfaction is central to the company’s strategy. Investments in platform usability
and security aim to enhance the purchasing journey, from product search to payment and
delivery. The company also prioritizes efficient customer service and flexible return policies,
4. Critical Business Systems
In an e-commerce company, certain systems are essential to ensure operational continuity,
efficient customer service, and secure transactions. Two critical systems were identified as
vital for the company’s proper functioning: the Inventory Management System (IMS) and the
Online Payment System (OPS). These systems are crucial for managing the flow of goods
and ensuring that financial transactions are processed securely.
4.1 Inventory Management System (IMS)
The Inventory Management System is the backbone of the company’s logistics operations,
enabling efficient, real-time product management on the website. This system provides a
clear view of product status, ensuring that inventory levels are continuously monitored,
preventing issues such as excess or insufficient stock available for sale.
Main functionalities:
- Real-time inventory management: The system maintains an updated record of products in
stock, automatically adjusting quantities as sales occur or new goods arrive.
- Control of product inflows and outflows: With each sale or restocking, the IMS adjusts
inventory levels, ensuring the website reflects accurate information.
- Automatic updates of product availability on the website: The system syncs with the
e-commerce platform to ensure customers only see products available for purchase. If a
product runs out, the IMS automatically updates its status, avoiding customer frustration.
Importance to the business: The IMS is essential for maintaining inventory accuracy, directly
impacting operational efficiency and customer satisfaction. Without it, the company risks
losing sales or facing logistical issues, such as delivery delays.
4.2 Online Payment System (OPS)
The Online Payment System is responsible for processing all financial transactions on the
e-commerce platform. It ensures payments are handled securely and efficiently, safeguarding
customer information and ensuring transactions are completed correctly.
Main functionalities:
- Secure transaction processing: The OPS manages transactions made through various
payment methods, such as credit cards, debit cards, and bank slips, processing payments
quickly and ensuring funds are transferred accurately.
- Integration with multiple payment methods: To accommodate diverse customer preferences,
the system integrates with various payment solutions, streamlining the purchasing process
and increasing conversion rates on the website.
- Data encryption and security: To ensure customer privacy and security, the OPS uses
advanced encryption protocols. This protects sensitive data, such as credit card information,
and prevents cyberattacks during payment processing.
Importance to the business: The OPS is critical for maintaining customer trust and ensuring
sales completion. Any failure in this system could lead to revenue loss, customer complaints,
and damage to the company’s reputation. Thus, its security and reliability are of utmost
importance.
5. Systems Audit Planning
Systems auditing is a vital component of information security risk management, especially in
an e-commerce environment where sensitive data and financial transactions are constantly
processed. With the rise of cyber threats, conducting regular audits of critical systems has
become not just a best practice, but a strategic necessity.
In this context, the systems audit planning establishes the guidelines and structure needed to
conduct a comprehensive and effective evaluation of the company’s critical systems—in this
case, the Inventory Management System (IMS) and the Online Payment System (OPS). The
goal is to ensure these systems are protected against vulnerabilities that could be exploited
by attackers and comply with applicable security standards and regulations.
Effective planning involves clearly defining objectives that outline what the audit aims to
achieve. Additionally, selecting the methodology to be used will guide the execution and
analysis stages, ensuring the audit is conducted systematically and efficiently. The audit
timeline, in turn, is crucial to ensure all activities are completed within established deadlines,
allowing proper progress monitoring.
The audit not only seeks to identify flaws but also provides an opportunity to enhance system
security. The audit results are essential for informing stakeholders about potential risks and
developing an action plan to strengthen the organization’s security posture. Moreover, by
integrating audit findings with the company’s business plan, the organization can align its
information security strategies with its operational and growth goals, ensuring a more
cohesive and effective approach.
In this chapter, the audit objectives, the methodology to be applied, and the timeline for
executing the activities will be detailed, creating a clear roadmap to guide the entire audit
process. Through this structured planning, the company can ensure its critical systems are
thoroughly audited, resulting in a safer and more resilient IT environment.
5.1 Audit Objectives
The objectives of the critical systems audit are essential for directing the focus of security
evaluation activities and ensuring all relevant areas are effectively addressed. The audit aims
not only to identify issues but also to provide a detailed analysis of system security,
contributing to the continuous improvement of the organization’s security posture. The
specific objectives of the audit include:
- Vulnerability Identification: The primary objective is to identify vulnerabilities in critical
systems that could be exploited by malicious actors. This involves conducting penetration
tests and configuration analyses to uncover weaknesses in software, hardware, and
operational practices. Early detection of vulnerabilities allows the organization to take
corrective action before these weaknesses are exploited.
- Security Control Assessment: Another key objective is to evaluate the effectiveness of
implemented security controls, such as firewalls, intrusion detection systems (IDS), access
controls, and encryption. This assessment aims to verify whether these controls are
functioning as intended and are adequate to protect the organization’s assets against known
and emerging threats. The audit should also consider whether controls are regularly updated
and aligned with security best practices.
- Compliance Verification: The audit also seeks to ensure that critical systems comply with
applicable regulations, standards, and security policies. This includes compliance with the
General Data Protection Law (LGPD), industry standards such as PCI DSS (Payment Card
Industry Data Security Standard), and internal company guidelines. Non-compliance could
result in legal penalties and damage to the organization’s reputation, making this verification
a critical aspect of the audit.
- Improvement Recommendations: One of the most valuable outcomes of the audit is the
development of specific recommendations to enhance system security. This may include
suggestions for implementing new controls, improving operational practices, or updating
software. These recommendations are based on vulnerabilities and control weaknesses
identified during the audit and are crucial for strengthening the organization’s security and
reducing the risk of future incidents.
- Awareness Raising: The audit also has the potential to increase awareness of information
security among employees and stakeholders. By sharing audit results and improvement
recommendations, the organization can educate its team on the importance of cybersecurity
and foster a security culture within the company. This awareness is vital to ensure all
employees understand their role in protecting company assets and adopt appropriate
security behaviors.
- Strengthening Security Posture: Ultimately, all these objectives contribute to strengthening
the organization’s security posture. By identifying and mitigating vulnerabilities, assessing
controls, ensuring compliance, and promoting improvements, the audit not only protects
critical systems but also enhances the organization’s resilience against cyber threats. A
secure IT environment is crucial for business continuity, especially in an e-commerce sector
where customer trust is paramount.
These objectives should be continuously reviewed and adapted as the organization evolves
and faces new security challenges. The audit should be a cyclical process, with objectives
regularly reassessed to align with changes in the business environment, cyber threats, and
emerging technologies.
5.2 Methodology
The methodology adopted for auditing critical systems is a fundamental element that
determines the approach and steps to be followed throughout the process. A well-structured
methodology ensures the audit is conducted systematically, efficiently, and effectively,
maximizing the identification of vulnerabilities and the assessment of security controls. Below
are the main stages that compose the audit methodology:
- Planning and Preparation: Planning is the initial and most crucial phase of the audit, where
the scope, objectives, and necessary resources are defined. At this stage, it is essential to
identify the stakeholders who will participate in the process, including IT, information security,
operations, and management teams. Planning also involves defining a clear scope specifying
which systems and processes will be audited, as well as establishing a timeline for the
activities.
- Stakeholder Identification: Preliminary discussions with stakeholders help align
expectations and ensure the necessary support during the audit.
- Audit Scope: The scope must be detailed and comprehensive, specifying which critical
systems will be evaluated and which specific components (hardware, software, processes)
will be covered.
- Information Gathering: This phase involves collecting relevant data about the critical
systems, including their architecture, configuration, technical documentation, and operational
practices. The goal is to gain a clear understanding of the environment to be audited,
enabling a more effective analysis.
- Technical Documentation: Reviewing manuals, security policies, and data flow diagrams
provides valuable insights into how systems operate and which controls are in place.
- Interviews and Questionnaires: Conducting interviews with key employees and distributing
questionnaires can provide an overview of the audit process, identified vulnerabilities, the
effectiveness of security controls, and specific improvement recommendations.
- Report Structure: The report should be organized to facilitate understanding by
stakeholders, presenting findings in a logical and prioritized manner.
- Presentation of Results: The report delivery may be accompanied by a presentation to
stakeholders, where key findings and recommendations are discussed in detail.
- Follow-up: After delivering the report, the follow-up phase is essential to ensure
recommendations are implemented and the effectiveness of corrective actions is evaluated.
Follow-up may include additional tests to verify whether vulnerabilities have been mitigated
and whether new risks have emerged.
- Vulnerability Reassessment: Scheduled follow-up can help determine whether corrective
measures were effective or if new issues arose after the implemented fixes.
- Continuous Improvement Cycle: The audit should be viewed as part of a continuous
improvement cycle for security, where lessons learned are incorporated into future security
and audit practices.
Applying this methodology ensures that the critical systems audit is conducted
comprehensively and effectively, delivering meaningful results that contribute to the
organization’s information security. The methodology should be adaptable and updated as
needed, considering changes in the business environment, technologies, and cyber threats.
5.3 Audit Timeline
The audit timeline is a critical tool that organizes and directs activities throughout the
process, ensuring all steps are completed in a timely and efficient manner. A well-crafted
timeline not only helps set clear deadlines but also facilitates progress tracking and resource
allocation. In this section, we will address the importance of the timeline, the main stages to
be considered, and an illustrative example of an audit timeline.
Importance of the Timeline: An effective timeline is essential to ensure the audit is completed
within the stipulated timeframe, minimizing disruptions to the organization’s normal
operations. Additionally, a well-defined timeline helps:
- Manage Expectations: It allows all stakeholders, including the audit team and management,
to have a clear understanding of activity start and end dates, aligning expectations and
fostering collaboration.
- Facilitate Coordination: Audits often involve multiple teams and stakeholders, and a timeline
ensures coordination among these groups, making everyone aware of their roles and
responsibilities at each phase.
- Identify and Mitigate Risks: A timeline enables early identification of potential delays or
obstacles, allowing corrective measures to be implemented before they impact the overall
schedule.
Audit Timeline Stages: The audit timeline should include all essential stages, from initial
planning to post-report follow-up. Below are the main phases to be included in the timeline:
1. Planning and Preparation (1 week):
- Objective: Define scope, objectives, and identify stakeholders.
- Activities: Initial meetings with stakeholders, defining the audit scope, and drafting a
detailed plan.
2. Information Gathering (2 weeks):
- Objective: Collect relevant data about critical systems.
- Activities: Review documentation, conduct employee interviews, and analyze system
configurations.
3. Test Execution (2 weeks):
- Objective: Conduct penetration tests and identify vulnerabilities.
- Activities: Perform external and internal tests, use vulnerability scanning tools, and analyze
configurations.
4. Results Assessment (1 week):
- Objective: Analyze and classify identified vulnerabilities.
- Activities: Compile test data, draft a preliminary report with findings and initial
recommendations.
5. Report Preparation (1 week):
- Objective: Document audit findings and recommendations.
- Activities: Write the audit report, including all vulnerabilities and proposed improvements.
6. Follow-up and Validation (1 week):
- Objective: Monitor the implementation of recommendations.
- Activities: Review corrective actions, conduct additional tests, and validate whether
vulnerabilities have been mitigated.
Example Timeline: Below is an illustrative example of the audit timeline, highlighting the
stages mentioned and their durations:
Audit Phase
Duration
Start Date
End Date
PLanning and
Preparation
1 Week
DD/MM/YYYY
DD/MM/YYYY
Information
Gathering
2 Weeks
DD/MM/YYYY
DD/MM/YYYY
Testing
2 Weeks
DD/MM/YYYY
DD/MM/YYYY
Results
Assessment
1 Week
DD/MM/YYYY
DD/MM/YYYY
Report Preparation
1 Week
DD/MM/YYYY
DD/MM/YYYY
Follow-up and
Validation
1 Week
DD/MM/YYYY
DD/MM/YYYY
Adjustments and Flexibility: It’s important to note that the timeline should be flexible enough
to accommodate critical issues requiring more investigation time or delays in information
gathering. The audit manager must be prepared to adjust the timeline as needed,
maintaining constant communication with stakeholders.
The audit timeline not only provides a temporal framework for activities but also serves as a
strategic guide ensuring all necessary steps are systematically addressed. A well-managed
timeline is essential for the audit’s success and the effectiveness of subsequent corrective
actions.
6. Conclusion
The growing complexity and interconnectedness of e-commerce environments make
information security a critical priority for organizations operating in this sector. This report
provided a detailed examination of the audit of critical systems in an e-commerce company,
focusing on the Inventory Management System (IMS) and the Online Payment System
(OPS). The analysis highlighted the importance of a proactive approach to security,
emphasizing that preventing cyber incidents must be an ongoing and integrated effort across
all organizational levels.
Importance of the Audit: The audit of critical systems proved to be an essential tool for
identifying vulnerabilities, assessing the effectiveness of security controls, and ensuring
compliance with applicable standards and regulations. Through information gathering, test
execution, and result evaluation, the audit not only identified security gaps but also offered a
clear roadmap for improvements. The proposed recommendations aim to strengthen the
organization’s security posture and ensure that company assets and customers’ sensitive
information are protected against cyber threats.
Integration with the Business Plan: It is crucial that information security aligns with the
organization’s business plan. As e-commerce continues to grow and evolve, security
strategies must keep pace with this evolution, ensuring the organization not only minimizes
risks but also seizes growth opportunities. Security should not be seen as an obstacle but as
an enabler that fosters customer trust and brand reputation.
Future Challenges: However, the journey toward information security is not without
challenges. The cyber threat landscape is constantly evolving, with new attacks and
techniques emerging at an alarming rate. Therefore, the organization must maintain an
ongoing commitment to updating its security practices, fostering a culture of awareness and
responsibility throughout the company. This includes not only conducting regular audits but
also providing frequent employee training, updating systems, and adopting new technologies
to enhance security.
Final Recommendations: In conclusion, it is recommended that the organization implement
the following actions as part of its ongoing security strategy:
- Conduct periodic security audits to ensure all critical systems are regularly reviewed and
assessed.
- Establish an information security awareness and training program for all employees,
focusing on day-to-day security practices.
- Maintain continuous monitoring of critical systems to quickly detect and respond to
emerging threats.
- Evaluate and update security controls based on new threats, technologies, and changes in
the business environment.
- Continuously document and review security policies and procedures to ensure their
effectiveness and compliance with regulations.
By adopting a proactive and integrated approach to information security, the organization will
be better equipped to face the challenges of the digital environment, protect its assets, and
ensure customer trust, paving the way for success and growth in the competitive
e-commerce market.
7. References
ISO 27701: understand the importance of the standard for Personal Data Protection and
Privacy. Available at:
https://seqinfo.com.br/2023/05/04/iso-27701-norma-para-protecao-de-dados-pess
oais-e-privacidade/. Accessed on: October 10, 2024.
What is the purpose and how does a systems audit work? Available at:
https://bloq.synchro.com.br/para-que-serve-e-como-funciona-a-auditoria-de-sistem as/.
Accessed on: October 14, 2024.
Everything you need to know to create your business plan. Available at:
https://sebrae.com.br/sites/PortalSebrae/artigos/como-elaborar-um-plano-de-nego
cio.37d2438af1c92410VgnVCM100000b272010aRCRD. Accessed on: October 14, 2024.
How an online payment system can [incomplete in original]. Accessed on: [incomplete in
original].
Organizational structure: understand what it is and learn about the main types! Available at:
https://www.pontotel.com.br/estrutura-organizacional/. Accessed on: October 10, 2024.
Critical Systems. Available at: https://www.devmedia.com.br/sistemas-críticos/18952.
Accessed on: October 10, 2024.