Beyond the automation gap: A survey of continuous audit for IoT security

In many new distributed systems paradigms such a cloud computing, Internet of Things (IoT), electronic banking, etc. the security of the host platforms is very critical which is managed by the platform owner. The platform administrators use security automation techniques such as those provided by Security Content Automation Protocol (SCAP) standards to ensure that the outsourced platforms are set up correctly and follow the security recommendations (governmental or industry). However, the remote platform users still have to trust the platform administrators. The third party security audits, used to shift the required user trust from the platform owner to a trusted entity, are scheduled and are not very frequent to deal with the daily reported vulnerabilities which can be exploited by the attackers. In this paper we propose a remote platform evaluation mechanism which can be used by the remote platform users themselves, or by the auditors to perform frequent platform security audits for the platform users. We analyze the existing SCAP and trusted computing (TCG) standards for our solution, identify their shortcomings, and suggest ways to integrate them. Our proposed platform security evaluation framework uses the synergy of TCG and SCAP to address the limitations of each technology when used separately.

The use of smart contracts has grown exponentially over the last few years. This is a phenomenon associated with the development of other technologies, such as the blockchain and the Internet of Things (IoT). Smart contracts run in a decentralized way on the blockchain and are self- executing. This is a source of advantages in business operations, but there are also some limitations and drawbacks. Regulatory issues are also of key importance, as the legal frameworks differ across countries. Smart contracts are likely to have an impact on external auditing, as external auditors will have to adapt their capabilities and procedures to an environment where many companies use this technology. But smart contracts may also be used to define a framework which ensures continuous audit reports and direct access of authorized stakeholders to the results of audit procedures. Conversely, internal auditing will also experiment changes, both caused by a series of new risks that will have to be adequately addressed and new tools to monitor business operations. In addition, some promising research opportunities arise, both in the IT, the Legal and the Business field.

The article examines the transformation of internal control in the context of the digitalization of business processes. Internal control is defined as a key element of the enterprise management system which ensures the achievement of strategic and tactical goals through the timely detection of deviations, prevention of abuse and increased efficiency of the use of resource. The emphasis is on its main functions: ensuring the reliability of accounting information, compliance with regulations, reducing the risks of illegal transactions, and optimising of business processes. It is argued that the lack of adequate internal control poses a threat to financial stability and stakeholder trust. The main attention is paid to digitalization, which is a strategic direction for the development of control. Ukraine’s position in international digitalisation rankings is analysed, showing dynamic growth in the fields of electronic services, IT solution integration and the use of cloud technologies. The prospects for the application of modern digital tools have been explored: Enterprise Resource Planning (hereinafter – ERP) and Governance, Risk & Compliance (hereinafter – GRC) systems, blockchain technologies, artificial intelligence (hereinafter – AI), machine learning, the Internet of Things, and big data analysis, which change the structure and functional content of control, ensuring its preventive and predictive nature. A list of domestic and foreign software products for control purposes was analysed. It is determined that digitalisation contributes to the transition to continuous auditing, operational risk monitoring and increased data transparency. At the same time, several challenges and risks associated with the implementing of new technologies have been identified, including high financial costs, staff shortages, low digital literacy levels, cyber threats, and organizational resistance to changes. The stages of internal control transformation under digitalization are presented – from diagnostics and strategy formation to technology implementation and continuous monitoring. Practical recommendations are proposed to effectively transform the internal control system in the context of digitalisation, which include: developing a digitalisation strategy for control, forming a cross-functional team, automating routine operations, introducing systems that perform continuous real-time monitoring, applying cloud technologies, strengthening cybersecurity, training staff, and creating a culture of control. It has been proven that the effective transformation of internal control contributes to its financial stability, stakeholder trust, and sustainable development in the digital economy.