|CH 8: Authentication: Process of verifying the identity of the person or device attempting to access the | |system. The objective is to ensure that only legitimate users can access the system. Three different | |credentials are PINs(password), ID badge, or biometrics.
Authorization: Process of restricting access of | |authenticated users to specific portions of the system and limiting what actions they are permitted to | |perform. Access control matrix: shows that access controls of each user or device in your company to see | |who have what privileges.Best Practice of Passwords: Must have at least 8 characters in length, must have| |multiple character types (upper-lower case, numbers, and special characters), Randomness (not be words | |found in dictionary), and changed frequently (every 30 for sensitive of 90 for most users). Physical | |Access Controls: Only have one unlocked door during business hours (none after hours), safe lock all | |devices (computers, phones, and PDA devices), and physical access controls must be cost-effective. Access | |to the wiring used in the org’s LANs needs to be restricted in order to prevent wiretapping.Firewall: | |behind the border router (connects an orgs information system to the internet), and is either a | |special-purpose hardware device or software running on a general-purpose computer.
The demiliarized is a | |seperate network that permits controlled access from the internet to selected resources, such as the | |organizarion’s e-commerce Web server. Intrusion Prevention System: Monitors patterns in the traffic flow, | |rather than only inspecting individual packets, to identify and automatically block attacks.Examining | |pattern traffic is often the only way to identify undesirable activity. Intrusion Detection System | |consists of a set of sensors and a central monitoring unit that create logs of network traffic that was | |permitted to pass the firewall and then analyze those logs for signs of attempted or successful | |intrusions.
The difference between the two is that the IPS only produces a warning alert when it detects a| |suspicious pattern of network traffic, whereas the IDS not only issues an alert but also automatically | |takes steps to stop a suspected attack.Preventive controls that deter problems before they arise. | |Effective preventive controls include hiring qualified accounting personnel; appropriately segregating | |employee duties; and effectively controlling physical access to assets, facilities, and information | |Detective controls enhance security by monitoring the effectiveness of preventive controls and detecting | |incidents in which preventive controls have been successfully circumvented. Corrective are procedures that| |correct problems that have occurred.Social Engineering: Attackers will often try to use the information | |obtained during their initial reconnaissance to trick an unsuspecting employee into granting them access. | | | | | |CH 9: Encryption: The process of transforming normal content, called plaintext, into unreadable gibberish,| |called ciphertext.
This is a type of preventive control. Public key to encryption is widely distributed | |and available to everyone. Decryption reverses this process, transforming ciphertext back into plaintext. | |Hashing: The process that takes plaintext of any length and transform it into a short code called a hash.
| |Digital Signatures: A hash of a document or file that is encrypted using the document creator’s private | |key. This provides proof about two important issues: 1. That a copy of a document or file has not been | |altered 2.Who created the original version of a digital document or file.
Digital certificate: An | |electronic document that contains an entity’s public key and certifies the identity of the owner of that | |particular public key. It is issued by certificate authority. Thus, digital certificates function like the| |digital equivalent of a driver’s license or passport. It can also be the very sign logo on certain website| |to show that this is a trusted site.
Virtual Private Networks: Encrypting information while it transverses| |the Internet creates a VPN.It provides the functionality of a privately owned secure network without the | |associated costs of leased telephone lines, satellites, and other communication equipment. Private | |communication channels, often referred to as tunnels, which are accessible only to those parties | |possessing that appropriate encryption and decryption keys. | | | |CH 10: Field Check determines whether the characters in a field are of the proper type. Sign Check | |determines whether the data in a field have the appropriate arithmetic sign.Limit Check tests a numerical| |amount against a fixed value.
Range Check tests whether a numerical amount falls between predetermined | |whether all required data items have been entered. A Completeness Check on each input record determines | |whether all required data items have been entered. Validity Check compares the ID code or account number | |in transaction data with similar data in the master file to verify that the account exists. Reasonableness| |Test determines the correctness of the logical relationship between two data items.
Batch Totals | |summarizes important values for a batch of input records. The following are three commonly used batch | |totals: 1. Financial totals sums a field that contains monetary values, such as the total dollar amount of | |all sales for a batch of sales transactions 2. Hash total sums a nonfinancial numeric field, such as the | |total of the quantity ordered field in a batch of sales transactions 3.
Record count is the number of | |records in a batch. Processing Controls: 1.File Labels ensure correct and most current file is being | |updated 2. Batch Total Recalculation compares calculated batch total after processing to input totals | |3. Cross-Footing and Zero Balance Tests compute totals using multiple methods to ensure the same results | |4. Concurrent Update locks records or fields when they are being updated so multiple users are not updating| |at the same time.
Output Controls: 1. Management Review verifies reasonableness, completeness, and if | |routed to intended individual 2.Reconciliation: All transactions and other system updates should be | |reconciled to control reports, file status/update reports, or other control mechanisms. In additions, | |general ledger accounts should be reconciled to subsidiary account totals on a regular basis. Also, | |database totals should periodically be reconciled with data maintained outside the system. (Match employee| |files in payroll to that in the HR department to see if any fake names were created.
3.Data Transmission | |Controls: Check sums is a hash of file transmitted, comparison made of hash before and after transmission. | |Parity checking is a bit added to each character transmitted, the characters can then be verified for | |accuracy. Data Backup Procedures: 1. Incremental Backup involves copying only the data items that have | |changed since the last partial backup.
This produces a set of incremental backup files, each containing | |the results of one day’s transactions 2. Differential Backup copies all changes made since the last full | |backup.Thus, each new differential backup file contains the cumulative effects of all activity since the | |last full backup. Daily differential backups take longer than incremental backups. Disaster Recovery Plan | |outlines the procedures to restore an organization’s IT functions in the event that its data center is | |destroyed by a natural disaster or act of terrorism.
Cold site is the first option, which is an empty | |building that is prewired for necessary telephone and internet access, plus a contract with one or more | |vendors to provide all necessary equipment with a specified period of time.Hot site is the second option,| |which is a facility that is not only prewired for telephone and Internet access but also contains all the | |computing and office equipment the org needs to perform its essential business activities. (shorter RTO | |time that cold site) Business Continuity Plan specifies how to resume not only IT operations, but all | |business processes, including relocation to new offices and hiring temp replacements, in the event that a | |major calamity destroys not only an org’s data center but also its main headquarters.Having a DRP and BCP| |can mean the difference between sustaining a major catastrophe and going out of business.
Cloud computing | |typically utilizes banks of redundant servers in multiple locations, thereby reducing the risk that a | |single catastrophe could result in system downtime and the loss of all data. However if the public cloud | |goes out of business, it will be difficult to retrieve any information. Change control is the formal | |process used to ensure that modifications to hardware, software or processes do not reduce system | |reliability. |CH 7: Internal Control: The process implemented to prove reasonable assurance that the following control | |objectives are achieved: 1. Safeguard assets: prevent or detect their unauthorized acquisition, use, or | |disposition.
2. Maintain records in sufficient detail to report company assets accurately and fairly | |3. Provide accurate and reliable information 4. prepare financial reports in accordance with established | |criteria 5. Promote and improve operational efficiency 6. Encourage adherence to prescribed managerial | |policies 7.
Comply with applicable laws and regulations. Internal controls perform three important | |functions: 1. Preventive controls (most important) defer problems before they arise. Examples include | |hiring qualified personnel, segregating employee duties, and controlling physical access to assets and | |information 2. Detective controls discover problems that are not prevented.
Examples include duplicate | |checking of calculations and preparing bank reconciliations and monthly trial balances 3.Corrective | |controls identify and correct problems as well as correct and recover from the resulting errors. Examples | |include maintaining backup copies of files, correcting data entry errors, and resubmitting transactions | |for subsequent processing. Segregation of duties: No one employee should be given too much responsibility | |1. Authorization:Approving transactions and decisions 2. Recording:Preparaing source documents; entering | |data into online systems; maintaining journals, ledgers, files or databases; and preparing reconciliations| |and performance reports 3.
Custody:Handling cash, tools, inventory, or fixed assets; receiving incoming | |customer checks; writing checks. SOX 2002:Designed to prevent financial statement fraud, make financial | |reports more transparent, protect investors, strengthen internal controls, and punish executives who | |perpetrate fraud 1. Created PCAOB to control the auditing profession 2. New Auditing Rules: Partners must | |rotate periodically and prohibits auditors from performing certain nonaudit services, such as information | |systems design and implementation 3.New Roles for Audit Committee: Must be part of board of directors and | |be independent, one member must be a financial expert and oversees external auditors .
The audit committee| |is responsible for financial reporting, regulatory compliance, internal control, and hiring and overseeing| |internal and external auditors4. New Rules for Management: Financial statements and disclosures are fairly | |presented, were reviewed by management, and are not misleading; the auditors were told about all material | |internal control weak-ness and fraud 5.New Internal Control Requirements: Management is responsible for | |establishing and maintaining an adequate internal control system. COBIT: consolidates control standards | |from 36 different sources into a single framework that allows 1. Management to benchmark security and | |control practices of IT environments 2.
Users to be assured that adequate IT security and control exist | |3. Auditors to substantiate their internal control opinions and to advise on IT security and control | |matters. COBIT Framework addresses: 1. Business objectives 2. IT resources 3. IT processes.
COSO - authority | |on internal controls and is incorporated into policies, rules, and regulations used to control business | |activities. Five components of the IC framework: 1. Control environment 2. Control activities 3. Risk | |assessment 4. Information and communication 5.
Monitoring. COSO Enterprise Risk Management: second control | |framework developed by COSO. It is the process the board of directors and management use to set strategy, | |identify events that may affect the entity, assess and manage risk, and provide reasonable assurance that | |the company achieves its objectives and goals. | | |CH 11: Auditing: The systematic process of obtaining and evaluating evidence regarding assertions about | |economic actions and events in order to determine how well they correspond with established criteria.
| |Internal auditing is an independent, objective assurance and consulting activity designed to add value and| |improve organizational effectiveness and efficiency, including assisting in the design and implementation | |of an AIS.Audit Process: 1. Audit Planning 2. Collection of Audit Evidence 3.
Evaluation of Audit Evidence | |4. Communication of Audit Results. Audit Plan: Why, when, how and whom. Work targeted to area with greatest| |risk: Inherent is the chance of risk in the absence of controls Control: is the risk a misstatement will | |not be caught by the internal control system Detection is the chance that a misstatement will not by | |caught by auditors or their procedures.
Collections of Audit Evidence: Review of documentation to | |understand how a particular process or internal control sytem is supposed to function; Physical | |examination of the quality and/or condition of tangible assets, such as equipment and inventory; Vouching | |for validity of a transaction by exmaining supporting document; Analytical review of relationships and | |trends among information to detect items that should be further investigated Evaluation of Audit Evidence:| |Does evidence support favorable or unfavorable conclusion?It is material (How significant is the impact | |of the evidence)? Reasonable Assurance (some risk remains that the audit conclusion is incorrect) | |Communication of Audit Conclusion: Written report summarizing audit finding and recommendations to | |management, the audit committee, the board of directors and other appropriate parties. Types of Audits: | |1. Financial examines the reliability and integrity of financial transactions, accounting records, and | |financial statements 2.Information System reviews the controls of an AIS to access compliance with | |internal control policies and procedures and effectiveness in safeguarding assets 3. Operational is | |concerned with economical and efficient use of resources and the accomplishments of established goals and | |objectives 4. Compliance determines whether entities are complying with applicable laws, regulations, | |policies and procedures.
Risk-based Audit: 1. Determine the threats (fraud and errors) facing the company. |Accidental or intentional abuse and damage to which the system is exposed 2. Identify the control | |procedures that prevent, detect, or correct the threats. These are all the controls that management has | |put into place and that auditors should review and test, to minimize the threats 3. Evaluate control | |procedures using two ways, a system review (are control procedures in place) and tests of controls (are | |existing controls working) 4.
Evaluate control weaknesses to determine their effect on the nature, timing | |or extent of auditing procedures. The minimum number of samples to be selected for IT control is only 1. | |CAATS(audit software) uses auditor-supplied specifications to generate a program that performs audit | |functions, thereby automating or simplying the audit process | | | |SA 2: Physical access controls- 1.Alternate power sources 2. Flood Management 3. Data backup 4.
Fences are | |physical barrier to deter casual trespassers5. Human Guards to watch doors etc. 6. Physical Locks 7.
Fire | |Suppression systems 8. Biometrics 9. Location of assets 10. Man traps 11. Alarm systems 12. Steel cages | |around wiring system to prevent wiretapping Logical Access Controls – 1.
firewall or screening router that | |makes pass/block decisions based upon the type of traffic, origin, and destination 2. n application that | |first authenticates a user by requiring a user ID and password before permitting the user to access the | |application 3. Authentication, Authorization | | | |Preventive Controls: Training, user access controls (authentication and authorization), physical access | |controls (locks, guards, etc. ), Network access controls (firewalls, intrusion prevention systems, etc. ), | |Device and software hardening controls (configuration options).
Detective Controls: Log analysis, | |intrusion detection system, security testing and audits, and managerial reports. Corrective Controls: | |Computer incident response teams (CIRT), Chief information security officer (CISO), and patch management. | | | | | | | | | | |
