Cisa Ebook New
Cisa Ebook New
Introduction to CISA
• Describe CISA
• Demonstrate your understanding of the ISACA organization
!✔ ISACA has developed COBIT 5, RISK IT, and Val IT, which it continually updates.
History of CISA
Introduced in 1978
• Approved by the United States Defense Department as part of its assurance framework
In 2011, there
was a change in
curriculum: six
domains to five
domains
Current CISA Syllabus
The CISA syllabus (2019) is divided into five domains. The exam has 150 multiple choice questions. The duration of the exam is four hours.
Beginning June 2019, ISACA is offering continuous testing, with a 365-day exam eligibility period to take your exam. Following is a summary
of the CISA domains:
Exam
Domain Topic
Weightage
Domain 1 Information Systems Auditing Process 21%
Total 100%
Value of CISA
Exam duration Four hours to answer 150 multiple-choice questions covering five practice areas
Pass requirements A candidate must receive a score of 450 or higher to pass the exam
!✔ ISACA uses and reports scores on a common scale from 200 to 800.
Thank You
Plan an audit to determine whether information systems are protected, controlled, and provide
value to the organization
Conduct an audit in accordance with IS audit standards and a risk‐based IS audit strategy
Conduct an audit follow‐up to evaluate whether risks have been sufficiently addressed
Provide consulting services and guidance to the organization in order to improve the quality and
control of information systems
Identify opportunities for process improvement in the organization's IT policies and practices
Part A: Planning
Part A: Planning
• Business processes
• Types of controls
ISACA is the global pioneer of IS Assurance and Audit guidelines, Tools and Techniques, Standards, and Code of
Professional Ethics.
ISACA IS
Audit and
Assurance
Guidelines
ISACA IS Audit ISACA IS
and Assurance Audit and
Tools and Assurance
Techniques Standards
Framework
The CISA Exam will test your understanding of the application of Standards and Guidelines.
Categories of Standards and Guidelines
Performance Reporting
General
Support the implementation and encourage Perform their duties with due diligence and Serve in the interest of stakeholders in a lawful
compliance with appropriate standards, professional care in accordance with professional and honest manner while maintaining high
procedures, and controls for information systems. standards and best practices standards of conduct and character and not
engage in acts discreditable to the profession.
Maintain the privacy and confidentiality of Maintain competency in their respective fields Inform appropriate parties about the results of
information obtained in the course of their duties and agree to undertake only those activities that
unless disclosure is required by a legal authority. work performed, revealing all significant facts
they reasonably expect to complete with known to them
Such information shall not be used for personal professional competence.
benefit or released to inappropriate parties.
Failure to comply with the code of professional ethics can result in an investigation into a
member’s and/or certification holder's conduct and, ultimately, in disciplinary measures.
ISACA IT Audit and Assurance Standards Framework Objective
The objectives of IS audit and assurance standards are to inform:
IS auditors
of the bare minimum level of
performance required to meet the
professional responsibilities set in
the Professional Code of Ethics
The management
of the profession’s requirement
regarding the work of audit
The CISA certification practitioners
holders
that failure to meet these
standards results in a review of
their conduct by the ISACA board
of directors, which may ultimately
result in a disciplinary action
ISACA IS Audit and Assurance Guidelines
• ISACA IS Audit and Assurance guidelines provide additional information on how to comply with
the ISACA Information Technology Assurance and Audit Standards.
• The IS Auditor should use professional judgment and be able to justify any differences.
• Guideline documents are identified by a prefix G, followed by the number, for example, “G10.”
There are 42 categories of guidelines.
ISACA IS Audit Guidelines
Using the Work of Other
Audit Sampling Irregularities and Illegal Acts Computer Forensics Configuration Management
Auditors
System Development Life Business Continuity Plan (BCP) Return on Security Investment
Audit Charter Application Systems Review Cycle (SDLC) Review Review from IT Perspective (ROSI)
White
papers IS Audit
and
Assurance
programs
IS Audit and
Tools and techniques are Assurance
IS Audit and listed under www.isaca.org/itaf tools and
Assurance tools and techniques COBIT 5
techniques provide family of
additional guidance to products
IS audit and assurance
professionals. Reference
books
ISACA IS Audit and Assurance Tools and Techniques
A business process is an inter-related set of cross-functional activities or events that result in the delivery of a
specific product or service to a customer.
An IS auditor must understand and evaluate the business processes they are auditing.
An Internal audit function must be independent and report to the audit committee or to the board of directors.
Audit Charter
Audit charters are high-level documents that define the purpose, authority, and responsibility of the internal audit activity.
Explanation
IS auditing involves assessment of IS-related controls and understanding the control objectives
Identifying key controls that help achieve a well-controlled environment, according to standards
Audit Planning
• Audit planning is the first step of the audit process.
• Establishing priorities
The result of a well researched and completed audit plan is an audit program.
Fundamental Business Processes: Transaction Examples
Examples
Mobile
banking
ATM
transactions
• Consider using the work of other experts when there are constraints which would impair work performance
or potential gains in the quality of engagement.
• Assess and approve the adequacy of the other experts’ professional qualifications, competencies, relevant
experience, resources, independence, and quality‐control processes prior to the engagement.
• Assess, review, and evaluate the work of other experts as part of the engagement, and document the
conclusion on the extent of use and reliance on their work.
Risk Assessment and Risk Analysis
Part A: Planning 1.2
Business Processes
Relationship between Standards, Guidelines, Tools and Techniques
Standards
They are mandatory.
Tools and Techniques
They provide examples of
steps that the auditor may
follow in audits.
Guidelines
They provide assistance on
how Information Systems
Auditor (ISA) can
implement standards in
audits.
ISA must use professional judgment while applying the guidelines, tools, and techniques.
Legal and regulatory requirements may sometimes be more stringent than the standards.
The ISA should ensure compliance with the stringent legal or regulatory requirements.
Types of Controls
Control Principles
Explanation
Internal Controls are an enterprise’s internal processes implemented to achieve specific objectives while
minimizing risk.
They are the policies, procedures, practices, and structures incorporated by an organization to reduce risk.
They provide reasonable assurance to management that business objectives will be achieved and undesirable
events will be prevented, detected, and corrected.
Examples of
Objectives
What can be Internal Controls consider two things What can be evaded?
achieved?
Preventive
Controls
Corrective
Controls
Detective
Controls
Classification of Internal Controls
Detective
Controls
Classification of Internal Controls
Preventive
Controls
• Controls to detect and report intentional and unintentional errors after they occur
Preventive • Report incidence of errors, attacks, and omissions as they occur
Controls • Examples:
o Logs
o Error messages
o Hash totals
o Rechecking of calculations
o Scrutiny of reports
Corrective o Code review
Controls o Internal audit function
o Logical and physical access logging, such as application audit trails, database
security logging, server room access control, and door logging to know details of
the person and time.
Detective
Controls
General Controls
General controls are the policies and procedures involving all areas of an organization, including IT
infrastructure and support services.
They enable IT functioning for the achievement of corporate goals such as:
• Controls over data center and networks
• Access control
• Segregation of duties
• SDLC and Change Management
• Physical security
General Controls
IS control objectives
are high-level
objectives that
management may
use for effective
control of IT
processes
Intended to reasonably assure that
enterprise objectives will be achieved
while undesired events are detected,
corrected, or prevented
IS Control Objectives
Confidentiality
Overarching
principles of IS
controls
Compliance Availability
Manner of implementation
IS Control Objectives: Examples
Ensure integrity of the sensitive
and critical application systems
Ensure database
confidentiality, integrity, Ensure that inputs are
and availability validated
IS Control Objectives: Examples
Ensure integrity of the sensitive
and critical application systems
Database administration
Types of Controls
Enterprise Architecture
It determines if IT is
An Enterprise
It determines how aligned with
Architecture (EA) is a
an organization can enterprise
conceptual blueprint
most effectively objectives and
that defines the
achieve its current delivers value to
structure and
and future business, keeping in
operations of an
objectives. view the complexity
organization.
of an organization.
Source: http://searchcio.techtarget.com/definition/enterprise-architecture
Zachman FrameworkTM
The second is
identification,
definition,
representation,
specification,
configuration, and
instantiation
Zachman FrameworkTM for Enterprise Architecture
It is a schema with an intersection between two
historical classifications.
Second
classification is
First classification derived from
includes reification, the
fundamentals of transformation of
communication of an abstract idea
the primitive into an
interrogatives. instantiation,
initially postulated
by ancient Greek
philosophers.
It includes:
• What
• How It includes:
• When • Identification
• Who • Definition
• Where • Representation
• Why • Specification
• Configuration
• Instantiation
(Source: https://www.zachman.com/about-the-zachman-framework)
Zachman FrameworkTM for Enterprise Architecture
It is a two-dimensional framework that combines six basic interrogatives (What, How, Where, Who, When, and Why).
The framework intersects with different perspectives: Executives, Business Managers, System Architects, Engineers,
and Technicians.
It enables holistic understanding of the enterprise by looking at the organization from various viewpoints.
Sherwood Applied Business Security Architecture
(SABSA)
The primary
characteristic of the
SABSA model is that Ongoing “manage
everything must be and measure”
derived from an analysis phases of the
of the business lifecycle
requirements for
security
Provides a chain of
traceability through the
various layers: Risk-driven enterprise
contextual, conceptual, information security
logical, physical, architectures
component and
operational
SOMF
Service-oriented
Devised by
modeling
Michael Bell
framework
Modeling business
Used with a
and software
number of
systems to specify
architectural
service orientation
approaches
Identification of key enterprise risks requires understanding of the organization, its environment, and control
objectives
Ri
sk
Control
Risk
Probability that
Inherent a material Detection
Risk error exists Risk
Probability of an which will not
error existing be prevented Probability
that might be that the
or detected on Overall
material a timely basis Information
Systems
Audit Risk
assuming by the system
compensating of internal Auditor (ISA)
controls do not controls used Summation of
exist. It inadequate all audit risk
• exists checks and groups for
irrespective surmises that each control
of an audit material objective
• is contributed errors are
by the nature absent, when
of a business in fact, they
are present
Gap Analysis
Usage gap
Gap Analysis
Product
gap
Assurance Definitions
• Target of evaluation (TOE): This is the information security deliverable, the object for which assurances are
made.
• Assurance activities: These activities depend on the method of assessment. Various methods of assessment
• Security target (ST): This is the set of security specifications and requirements used to evaluate the target of
evaluation.
• Security protection profile (SPP): Similar to a security target, this profile is much broader in scope. Unlike an
ST, an SPP does not apply to any one particular deliverable but represents the security needs of a given
Contro
l
Evidence Risk
Risk Assessment and Risk Analysis
Explanation
Overall audit plan should focus on business risks related to use of IT.
Auditor to use risk-analysis techniques to establish critical area to focus on in the audit scope (focus to be on
high-risk areas).
Limited audit resources require this kind of focus in drawing the audit plan.
The main
areas of
coverage
Loss
• Productivity
• Resources utilized (for adverse
events)
• Replacement of damaged and
defective assets
• Legal and regulatory costs
• Loss of competitive advantage Value
• Reputational loss
• Criticality (impact on
smooth functioning)
• Cost
Threat agents
• Sensitivity
• Access
• Misuse
• Disclosure
• Unauthorized modification
Risk Analysis
From the Information System audit’s view, risk analysis aids in the following:
● It helps the auditor identify threats and Identify
Business Identify
risks within the IS environment. Objectives information
(BO) assets
● It assists in planning the audit by supporting
the BOs
evaluating controls in place.
● The helps an auditor be in a position to
know the audit objective.
Perform
● Decision making is easier as a risk-based Periodic Risk Perform Risk
Assessment (RA)
methodology is used. Reevaluation [Threat
–Vulnerability
(BO/RA/RM/RT) –Impact]
Perform Risk
Treatment (RT) Perform Risk
[Treat significant Management
risks not (RM) [Map
mitigated by Risks with
existing controls] controls in
place]
Calculating Risk
Exposure Factor The Exposure Factor (EF) is the percentage of value an asset lost due to an incident
Single Loss Expectancy The Single Loss Expectancy (SLE) is the cost of a single loss. SLE is the Asset Value (AV) times the Exposure Factor (EF)
Annual Rate of Occurrence The Annual Rate of Occurrence (ARO) is the number of losses you suffer per year
Annualized Loss Expectancy The Annualized Loss Expectancy (ALE) is your yearly cost due to a risk. It is calculated by multiplying the Single Loss
Expectancy (SLE) times the Annual Rate of Occurrence (ARO)
Calculating Risk
Risk Formulas
A report or Might be
The risk-based audit approach is based on a concept in which information undetected
determination of areas that should be audited is based on might contain through the
the perceived level of risk. an error that is audit period
material
Residual Risk – This represents management’s risk appetite.
Normally, controls would be implemented to mitigate risk to
acceptable levels (i.e. residual risk).
Risk-based Auditing
Risk Assessment
Risk Assessment Risk Evaluation
Risk Assessment
Risk Assessment Risk Treatment
Risk Assessment
Risk Assessment Risk Treatment
Risk Treatment
• Different methods are employed to perform risk assessments. Examples: Scoring System Method and Judgmental
Method
Knowledge of various types of audits (e.g., internal, external, financial) and methods
for assessing and placing reliance on the work of other auditors or control entities.
Types of Audits
Explanation
Internal External
● Pre-audits ● Compliance
● Compliance audits ● Regulatory
● Post incident ● General
● Often targeted
Specific Domain
Specific Domain Audits
Network Systems
Database Systems
Web or E-commerce
Systems
Reliance on Other Auditors
• Sampling Methodology
• Data Analytics
Audit objectives are the specific goals that the audit process must accomplish.
The whole auditing process can generally be divided into the following three different phases:
Gather report
Draft report Issue report Follow-up
requirements
Audit Program
• An Audit Work Program represents the audit plan and strategy. It has audit procedures, scope and
objectives.
• The Audit Work Program:
• Is a guide for documenting various audit steps performed and the types and extent of evidential matters
reviewed;
• Provides a trail of the process used; and
• Provides accountability for performance.
• IS Audit Process Steps:
• Plan – assess risks, develop audit program: objectives, procedures (Guidance 5)
• Obtain and evaluate evidence – strengths and weaknesses of controls
• Prepare and present report – draft and final report
• Follow-up – corrective actions taken by management (Guidance 35)
Audit Methodology
Scope
It is a documented approach
for performing the audit in a Audit
continuous and recurring Audit
Methodology objectives
manner to achieve the Components
Audit Methodology planned audit objectives.
refers to standard
audit procedures to be
used to achieve the
planned audit Work
objectives. programs
Audit Working Papers
•
Audit Project Management
Part B: Execution 1.6
Fraud investigations or legal proceedings require the integrity of the evidence be maintained throughout its
life cycle (called chain of custody in forensic evidence).
Legal requirements include law, regulation and/or contractual agreements placed on Audit (or IS Audit) or the
Auditee. Management and audit personnel in an organization should be aware of external requirements for
computer system practices and controls, and how data is processed, transmitted and stored. There is a need to
comply with different laws raising legal requirements that impact on audit objectives and audit scope.
Main Areas of Coverage
Sarbanes-Oxl
2
ey
Public companies 3
must keep
electronic records
for 5 years
PCI-DSS (Payment
Card Industry-Data
Security Standards)
Cryptography Standards
ISO/IEC
7064 Data processing – Check character systems Published 2003
ISO/IEC
9797 Message authentication codes (MACs) 2 parts published 1999 2002, under revision, 3rd part is upcoming
ISO/IEC
9798 Entity authentication | 6 parts published 1997 2005
ISO/IEC
10116
Modes of operation for an n-bit block cipher algorithm | Published 2006
ISO/IEC
10118
Hash-functions | 4 parts published 1998 2004 (2006), under revision
A type of
structured report Used to track
used as a execution of
performance activities
management tool
Internal
Process
Innovation/
Learning
Sampling Methodology
Sampling Methodology
Knowledge Statement 1.8
Compliance testing involves gathering evidence to test the enterprise’s compliance with control procedures.
Substantive testing is evidence gathered to evaluate the integrity of individual transactions, data, or other
information.
Presence of adequate internal controls (established through compliance testing) minimizes the number of
substantive tests that have to be done.
Conversely, weaknesses in internal controls will increase the need or number of substantive tests.
Sampling is done when it is not logical to test or verify all transactions by the consideration of the time and cost
needed. (i.e. the population which consists of all items in the area being examined).
Sampling Methodologies
Sampling is done, when verifying all The sample drawn must be a correct
transactions or events (population) representation of the population,
in the audit scope is not feasible. since all the conclusions are drawn
from the sample.
Non-statis
Statistical tical
Sampling Sampling
● This can be used to infer population ● This cannot be used to not infer
characteristics from the sample and is population characteristics from the
the preferred method. sample and is not a preferred method
of sampling.
General Approaches to Sampling
Non-statis
Statistical tical
Sampling Sampling
Attribute Variable
sampling sampling
Fixed Sample-Size
Attribute / Stop-or-go Discovery
Frequency-Estimat Sampling Sampling
e Sampling
• Adopted when
• Aim is to • Adopted when errors are
determine the the auditor expected to be a
rate of expects less rare occurrence
occurrence: How number of errors • Aim is to
many, how often? • Sample size is discover:
• Example: small and can be o fraud
Approval kept to minimum o bypassing rules
signature on user by manipulation
account creation (by splitting a
forms large order value
into several
smaller ones to
avoid having to
obtain approval
of a higher
authority)
Variable Sampling
Stratified Mean Unstratified Difference
Per Unit Mean Per Estimation
Unit
Stratified sampling produces a higher confidence level for the same sample size, or may result in a lower sample size
for the same confidence level, while other attributes are kept equal.
Sampling Terms
(Applicable to both attribute and variable sampling)
• The probability that the sample is representative of the • The opposite of the confidence coefficient, the risk that the
population, in relation to the characteristic observed, sample is not representative of the population
expressed as a percentage • If the confidence coefficient is 95%, the level of risk is 5%
• 95% confidence coefficient implies 95% chance that the
sample is representative of the population
• Depending on assessment of the effectiveness of
internal controls, the ISA will vary the sample size
• The greater the confidence level the ISA desires, the
larger will be the sample size
Sampling Terms
(Applicable to both attribute and variable sampling)
• The range of difference between the sample and • A measure of the variance or spread of values around the
population acceptable to the ISA mean
• This is expressed in percentage for attribute sampling
and as a numerical value for variable sampling
• The higher the precision level, the lower the sample size
and vice versa
Sampling Terms
• (Applicable to both attribute and variable sampling)
Information gathered through inquiry, observation, interview, analysis using CAATs (Computer Assisted
Auditing Techniques) such as, ACL, IDEA among others
Electronic media may be used to retain audit evidence to support audit findings
Retention policies should meet requirements for such evidence to support audit findings
Main Areas of Coverage
1 2 3 4 5
Evidence
Is the information the Must directly relate to Is key to the audit Is mandatory under Should be appropriately
Information Systems the objectives of review process standard “S6 organized and
Auditor (ISA) gathers while Performance of Audit documented to support
performing an IS audit to Work” the findings and
meet the audit objectives conclusion(s)
by supporting the audit
findings
Reliability of Evidence
Determinants for the reliability of evidence include:
Independence Qualification
of the provider of the individual
of the providing the
evidence information/
evidence
Given an audit scenario in the exam, a candidate should be able to determine which type of
evidence gathering technique would be best.
Evidence Characteristics and Types
• The confidence level of evidence is based on its value; audit evidence is considered
• Sufficient if it is complete, adequate, convincing, and would lead another ISA to form the same
conclusions
• Useful if it assists ISAs in meeting their audit objectives
• Reliable if in the auditor’s opinion, it is valid, factual, objective and supportable
• Relevant if it pertains to the audit objectives and has a logical relationship to the findings and
conclusions it is used to support
Techniques for Gathering Evidence
Observing processes
Interviewing
and employee Re-performance Walkthroughs
appropriate personnel
performance
Audit Documentation
Information gathered through inquiry, observation, interview, analysis using CAATs (Computer Assisted
Auditing Techniques) such as, ACL, IDEA among others
Electronic media may be used to retain audit evidence to support audit findings
Retention policies should meet requirements for such evidence to support audit findings
Computer Assisted Audit Techniques (CAATs)
• Automated tools and techniques used for gathering and analyzing data from computer systems to meet a
predetermined audit objective.
Examples
CAATs
of CAATs
Types of CAATs:
Collate and analyze diverse data. Provide means of analyzing Enable the ISA to work
• GAS (Generalized Audit
Information systems employ data to achieve audit objectives independently, eliminating
Software)
diverse hardware, software, continuous assistance from the
• Utility software
databases, data structures, and IT function
• Industry-specific audit
formats for audit evidence
software
• Fourth-generation languages
like SQL
• Expert systems
• Neural networks
• Application software tracing
• Mapping
Types of CAATs
Generalized • Standard, off-the-shelf software which can read data from diverse database platforms,
Audit flat files, and ASCII formats
Software • ISA can utilize the in-built functions of the software
(GAS) • Functions of GAS include:
o File access and reorganization
o Sampling
o Filtration
Utility o Statistical analysis
o Stratification and frequency analysis
Software o Report generation
o Duplicate checking
o Recomputation
• Limitations of GAS include:
o Not suitable for concurrent auditing
Industry-specific o Can only conduct post-event audit
Audit Software o Limited capabilities to verify processing logic
Types of CAATs
Generalized
Audit
Software
(GAS)
Utility • Is a part of a suite of programs like: copy, sort programs, report generators, disk search
Software utility, and fourth-generation languages, like SQL (structured query language).
Industry-specific
Audit Software
Types of CAATs
Generalized
Audit
Software
(GAS)
Utility
Software
• While GAS is generic in nature, audit software specific to some industries like financial
services, insurance, and health care is also available.
Industry-specific • They include built-in queries to perform audit functions in specific industries, say check
Audit Software kiting in banking.
• Constructing similar queries in GAS would need more effort and skills.
Types of CAATs
• This is a type of artificial intelligence and incorporates a knowledge base that contains
Expert
the knowledge of human experts in the concerned domain.
System • The inference engine in the expert system compares the data presented against the
knowledge base to draw conclusions.
• Expert systems can be used for:
o Risk analysis
o Evaluation of internal controls and assessing if provisions on doubtful debts are
Neural adequate
Networks
Continuous
Online Audit
Types of CAATs
Expert
System
Continuous
Online Audit
Types of CAATs
Expert
System
Neural
Networks
Communication needs to be effective and clear to improve the quality of the audit and maximize results.
When an argument ensues between the auditor and the auditee during the final IS audit findings report
presentation over the accuracy of the findings in the report, it makes the audit process counterintuitive and
quickly dilutes the audit process and its value.
Audit findings reported to stakeholders need to have appropriate buy-in from the auditees for the audit
process to be successful and value adding.
Communication and negotiation skills are required throughout the audit activity.
Recommend implementation
Ensure recommendations are Ensure facts presented in the dates for agreed-on
realistic and cost-effective report are accurate recommendations
● Executive summary Easy to read, concise report that presents the summary of the entire report
Before communicating the results of an audit to senior management, the IS audit should discuss the findings with
management staff of the audited entity. This is to ensure an agreement is reached for both the findings and the
corrective action to be taken.
The CISA candidate should become familiar with the ISACA S7 Reporting and S8 Follow-up Activities standard.
Communication Skills
• An IS auditor should conduct a follow-up program to determine whether the management has
implemented the agreed-on corrective actions.
Auditing standards are the minimum parameters to be taken into account when performing an audit.
An IS auditor has to understand the impact of the IS environment on traditional auditing practices and
techniques to ensure the audit objective is achieved.
Control Self Assessment (CSA) is a process in which an IS auditor can act in the role of a facilitator to business
process owners to help them define and assess appropriate controls (taking into consideration the risk
appetite of the organization).
Process owners are best placed to define appropriate controls due to their process knowledge.
IS auditors help process owners understand the need for controls based on business risk.
Main Areas of Coverage
The main areas covered under this knowledge statement are as follows:
Evaluation of
Control Self
Audit audit strengths
Audit Assessment
Audit objectives
methodology and weakness
programs (CSA)
Control Objectives for Information and Related Technology (COBIT provides guidance on development of a CSA
COBIT
The following table compares the traditional audit approach with CSA:
Auditors and other specialists Staff at all levels and in all functions are the
primary control analysts
Domain One Exam Quick Pointers
9.
10.
11.
12.
13.
14.
Knowledge
Check
QUIZ
An audit charter should _____.
1
An audit charter should summarize the responsibility, authority, and scope of an audit department.
QUIZ
An audit report prepared by the information systems auditor should be
2 corroborated by _____.
An IS auditor should have statements from IS Management to ensure that they are in agreement with the
findings as well the corrective action to be taken.
An IS auditor reviews the previous audit plan implemented for a client and finds that it was
QUIZ
designed to review the company network and e-mail systems, but not the e-commerce Web
3 server. The IT manager indicates that the preferred focus for audit is the newly implemented
ERP application. How should the auditor respond?
a. Determine the highest-risk systems and plan the audit based on the results
d. Audit the e-commerce server since it was not audited last year
An IS auditor reviews the previous audit plan implemented for a client and finds that it was
QUIZ
designed to review the company network and e-mail systems, but not the e-commerce Web
3 server. The IT manager indicates that the preferred focus for audit is the newly implemented
ERP application. How should the auditor respond?
a. Determine the highest-risk systems and plan the audit based on the results
d. Audit the e-commerce server since it was not audited last year
The best course of action is to conduct a risk assessment and design the audit plan to cover the areas of
highest risk. The IS auditor should not rely on the prior-year audit plan since it may not have been
designed to reflect a risk-based approach.
QUIZ When testing program change requests, an IS auditor found that the population
of changes was too small to provide a reasonable level of assurance. What is
4 the most appropriate action for the IS auditor to take?
If a sample size objective cannot be met with the given data, the IS auditor would not be able to provide
assurance regarding the testing objective. In this instance, the IS auditor should develop (with audit
management approval) an alternate testing procedure.
QUIZ
The main advantage derived from an enterprise employing control
5 self-assessment (CSA) process is that it:
Control Self Assessment is based on the review of high-risk areas that will need a more thorough review at
a later date or either an immediate attention.
Case Study
Case Study 1
The IS auditor has been asked to perform a pre-audit review to assess the company’s readiness for a regulatory
compliance audit. The regulatory requirements include management taking an active role in IT management including
managerial review and testing of IT controls.
The areas to assess in the upcoming regulatory compliance audit include physical controls, logical controls, end-user
computing, and change management. The IS Auditor has only two weeks to complete the pre-audit review. Previous
audits found no issues with physical controls or end-user computing but did find issues with logical controls and change
management.
Previous issues found include inadequate password management and not all changes where reviewed by a change
approval board.
QUIZ
Which of the following would be the most important item for the IS auditor to
1 check first?
a. Password management
b. Change approval
c. Patch management
d. Physical security
QUIZ
Which of the following would be the most important item for the IS auditor to
1 check first?
a. Password management
b. Change approval
c. Patch management
d. Physical security
Password management and change approval were both identified as issues in previous audits. However,
password management is a more critical issue, and it is less time consuming to check. It may not be
possible to review change management within the time allotted.
QUIZ
If time permits, should the IS auditor review physical controls and end-user
2 computing, even though there were no problems noted in previous audits?
Simply because there have not been issues in the past does not mean an area should not be reviewed
during an audit. If time permits, every area that will be addressed in the regulatory compliance audit
should be reviewed.
Case Study 2
An IS auditor has been tasked to audit a financial application used by a bank to process loan applications. The application
can be accessed via a Web interface from anywhere in the world. The company maintains the Web server internally (that
is. it is not outsourced) as well as the back end database. The auditor has limited time and may not be able to do a
complete audit.
QUIZ
Which of the following tools would be most helpful in this audit?
1
Since the application is accessed via the Web, the most critical item to audit is the Web interface. This is
where most security issues would be helpful in an audit.
QUIZ
In this scenario, what is the order of importance of items checked?
2
The Web server is the most important as it is the publically facing interface most vulnerable to attack. The
database is protected by the firewall, so the next item to check is the firewall. VPN connections need not be
checked, as there is no VPN used in this scenario.
Key Takeaways
Plan an audit to determine whether information systems are protected, controlled, and provide
value to the organization
Conduct an audit in accordance with IS audit standards and a risk‐based IS audit strategy
Conduct an audit follow‐up to evaluate whether risks have been sufficiently addressed
Provide consulting services and guidance to the organization in order to improve the quality and
control of information systems
Identify opportunities for process improvement in the organization's IT policies and practices
This concludes “Process of Auditing
Information Systems.”
Evaluate the IT strategy for alignment with the organization’s strategies and objectives
Evaluate the organization’s IT policies and practices for compliance with regulatory and legal requirements
Evaluate IT resource and portfolio management for alignment with the organization’s strategies and objectives
Evaluate whether IT supplier selection, service, and contract management processes align with business
requirements
Conduct periodic review of information systems and enterprise architecture
Evaluate the information security program to determine its effectiveness and alignment with the
organization’s strategies and objectives
Evaluate potential opportunities and threats associated with emerging technologies, regulations, and
industry practices
Part A: IT Governance
IT Governance
• IT-related frameworks
• Organizational structure
• Enterprise architecture
• Maturity models
• Laws, regulations, and industry standards affecting the
organization
IT Governance and IT Strategy
IT Governance and IT Strategy
• Explanation
To assure the stakeholders that IT deployment is aligned with the business vision, mission, and
objectives, the top management may implement an IT governance framework.
Essential elements of IT governance include Strategic Alignment, Value Delivery, Risk Management, Resource
Management, and Performance Measurement.
Main Areas of Coverage
The main areas covered are:
Governance of enterprise IT
Standards Policies
IT Governance Guidelines
Corporate Governance
At a high level, corporate governance has been defined as “the system by
which business corporations are directed and controlled.”
It is a set of It also provides the Good corporate Corporate governance Many government
responsibilities and structure through governance should frameworks are regulations require
practices used by an which the objectives provide proper increasingly being senior management to
organization’s of the company are incentives for the used by governments sign off on the
management to set, the means of board and to curb inaccurate adequacy of internal
provide strategic attaining those management to financial reporting and controls and include
direction, in order to objectives, and pursue objectives that foster greater an assessment of the
ensure that goals are monitoring are in the interests of transparency and organization’s internal
achievable, risk is performance. the company and its accountability. controls.
properly addressed, shareholders, and
and organizational should facilitate
resources are properly effective monitoring.
utilized.
Corporate Governance
Corporate
Governance
Boards of directors are responsible for the governance of the
“Governance is the companies.
combination of processes
and structures implemented Shareholders appoint the directors and auditors and ensure that the
by the board in order to governance structure is in place.
inform, direct, manage and
monitor the activities of the It also presupposes fair treatment of all stakeholders, monitors their
organization toward the performance and takes adequate measures to ensure compliance with
achievement of its laws, regulations, policy and contractual obligations.
objectives.” – Institute of
Internal Auditors Responsibilities of the board include setting the company’s strategic aims,
providing leadership to put them into effect, supervising management of
the business and reporting to shareholders on their stewardship. – Cadbury
Committee Report on Corporate Governance
The board’s actions are subject to laws, regulations and the shareholders in
general meeting.
Objectives of Corporate Governance
Internal Assurance
Audit Services
• Provide an independent and objective
“Internal audit is an independent, assessment, based on evidence of the
objective assurance and consulting governance, risk management and control
activity, designed to add value and to processes in the organization.
improve an organization's operations. • Assure testing before release.
It helps an organization accomplish its • Information systems audit falls under this
objectives, by bringing a systematic, category.
disciplined approach to evaluate and
improve the effectiveness of risk Consulting
management, control, and Services
Audit governance processes.”
- Institute of Internal Auditors • These are advisory in nature and intended to
add value and improve the governance, risk
management, and control processes of an
organization, without internal audit assuming
management responsibility.
• Here, an internal auditor is engaged in providing
advice on controls in a new project or function.
External • Examples:
Audit o Training
o Advice
It is an examination of accuracy of
financial statements by an
independent external auditor.
IT Governance
IT Governance
IT governance is effective only when done within a formal framework.
An auditor must begin with the IT strategy and then follow policies,
procedures, framework, and practices which must be reviewed periodically
whenever the environment, business, or regulatory requirement changes.
IT Governance
IT Governance Internal Audit must analyze IT from a strategic perspective, before moving
on to the granular level of individual processes and applications.
The compliance and regulatory requirements must be met and the risk of
IT governance is a
these not being met must be measured. All the risks should be known and
subset of corporate discussed openly along with the efficacy of controls.
governance
Executive management must be aware of the risks in the organization and
closely monitor the processes and personnel to manage them. They should
check if the residual risk is within the risk appetite of the organization.
Finally, the value added by IT to the organization must be measured and the
costs incurred on it must be optimized.
Objectives of IT Governance
IT governance is a
subset of corporate Ensuring that the investments in IT yield expected returns to business
governance
Governance of an enterprise IT integrates and institutionalizes good practices to ascertain the enterprise IT supports the business
objectives.
Factors leading to the The need to meet regulatory requirements for IT (SOX, Basel
importance of enterprise II, and HIPAA.)
IT governance
The selection of service providers, and management of
service outsourcing and acquisition
Corporate
Governance
Information security governance requires strategic direction and impetus. It requires commitment, resources, and assigning
responsibility for information security management. It also requires means for the board to determine whether its intent has
been met.
Approving policy Appropriate Reporting and Members of the board This can be accomplished
monitoring and trend analysis need to be aware of by periodically providing
metrics the organization’s the board with high-level
information assets results of comprehensive
and their criticality to risk assessments and
the ongoing business Business Impact Analysis
operations (BIA), and business
dependency assessments
of information resources
GEIT (Governance of Enterprise IT)
An IS strategy articulates the enterprise’s long-term intention to use Information Systems to improve
its business processes based on business requirements.
Principles, policies, and frameworks refer to the communication mechanisms that convey the direction and instructions of
governing bodies and management, which include:
Adapting
policies to the
enterprise
Information environment
security
principles
Policy life
cycle
Information
security
Principles, policies
policies, and
framework
model
ISO Standards
ISO 27001 (ISMS requirements and implementation) This defines the main standard applicable for certification of ISMSs.
ISO 27002 (code of security practices) A code of best practices in ISMS; includes more than 5000 detailed controls.
ISO 27003 (implementation guidance) Guidelines to implement ISO 27000 series standards.
ISO 27004 (security management metrics and measurement) Information security management measurement and metrics.
ISO 27005 (information security risk management) Guidelines relating to the risk management aspects of ISO 27001.
ISO 38500
It is a high-level framework for effective IT governance.
Responsibilit Strateg
y y
Acquisitio
n
Includes
Performanc
e
Conformanc
Human
e
behavior
PCI Frameworks
1
Install and maintain a
firewall configuration to
protect cardholder data
3 Protect stored cardholder
data
5 Use and regularly update
the anti-virus software
4
Encrypt transmission of
10 12
Track and monitor access to Establish high-level security
Control Measures
network resources and principles and procedures
8 Assign a unique ID to
persons with computer
access
Explanation
IT strategies, policies, standards, and procedures should be consistent with business requirements.
Policies
Purpose Scope
Scope
COBIT 5 for
All policies should Information Security
contain these basic describes these Validity
components: attributes of each
policy:
Policies are high-level documents that They are the guiding principles that set the
specify the thinking and philosophy of an tone for the organization as a whole.
organization.
Policies
In addition to high-level corporate policies, Policies should be clear and concise, which
individual units and departments may have would clearly define the expectations for
their own policies, which should be the employees. In short, they are what the
consistent with the high-level ones. organization expects.
Procedures, Standards, and Guidelines
Procedures
Procedures are step-by-step Procedures are expected to change
instructions of how something more often than polices, in order to
should be done in order to keep pace with the changes in the
accomplish the objectives set out environment and regulatory
in the policies. requirements.
Guidelines
Guidelines
Professional judgment should be used Auditor should be prepared to justify
while applying guidelines in the any departure from them.
organization.
Organizational Structure
Roles and Responsibilities
Explanation
Responsibilities of major functions should be outlined and documented to ensure proper segregation of duties.
Main Areas of Coverage
In CISA Exam, the IS Auditor must be aware of these globally recognized concepts.
However, knowledge of specific legislation and regulations will not be tested.
Roles and Responsibilities: BODs
It is unreasonable to
The tone of top expect lower-level Penalties for
Executive
management must personnel to abide by non-compliance must
management should
be conducive to security measures if be defined,
endorse security
effective security the senior communicated, and
requirements.
governance. management do not enforced.
follow them.
Roles and Responsibilities: Senior Management
Chief
Executive Steering Information
Management Committee Security
Officer (CISO)
Explanation
Zachman
AF-EAF CAFEA NAF
Framework
Sherwood
Applied
Business AFIoT UADF
Security
Architecture
IoT (Internet of Things)
Wearable
devices
Smart
The IoT is the internetworking of street
physical devices like vehicles and lighting
buildings, referred to as “smart” or Growth of IoT
”connected” devices that are in various
IoT has applications in a
embedded with electronics, verticals
variety of devices, such as Security,
software, sensors, and networking Connected Cameras,
heart-monitoring implants,
capability, enabling these devices to homes
automobiles with built-in Lighting
collect and exchange data.
sensors, devices to
monitor the environment,
Cars
food, pathogens.
Infotainment,
Navigation
IoT (Internet of Things)
Encryption
Authentication (implementing
(IoT devices do encryption requires Updates (pushing
not incorporate substantial updates to such
strong processing and large numbers of
authentication memory resources, devices is difficult)
mechanisms) which IoT devices
are low on)
AF-EAF
Definition of
Defines It also
basic
relationships provides a
architectural
among various blueprint for
building blocks,
IoT verticals data
and their ability
abstraction
to be integrated
into multi-tiered
systems
CAFEA
Sector
Levels of Scope
Capability-oriented
Operation-oriented
Service-oriented
Technical-oriented
Program-oriented
Enterprise Risk Management
Enterprise Risk Management
Explanation
1 ERM definitions
2 ERM domains
3 ERM standards
ERM Definition
“Enterprise risk management is a process, effected by an entity’s board of directors, management, and other personnel, applied
in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage
risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”
Source: http://www.coso.org/documents/coso_erm_executivesummary.pdf
ERM Objectives
Following are the objectives of ERM:
Strategic Operations
ERM
Objectives
Compliance Reporting
ERM Perspectives
Following are the perspectives of ERM:
Enterprise Division
ERM
Perspectives
Process Unit
COSO's ERM Integrated Framework
Following is the COSO’s Enterprise Risk Management integrated framework:
COSO’s
Enterprise Risk
Management:
Integrated
Framework
Information and
Monitoring
Communication
ISO 31000
Standards
Sometimes ISO/IEC 31010:2009 Risk Management: Risk
Established in relating to risk
called ISO Assessment Techniques
November management
31000:2009
2009
How to deal
with risk
Maturity and process improvement models help enterprises evaluate the current state of internal controls in
comparison to the desired state.
CMM
Following are the various levels of Capability Maturity Model (CMM):
Level 3 Well-defined
The IDEAL model is an organizational improvement model developed by the Software Engineering Institute (SEI) at the Carnegie
Mellon University that serves as a roadmap for initiating, planning, and implementing improvement actions.
It is useful in planning and implementing effective process improvement programs for CMMI and similar initiatives.
• Initiating
• Diagnosing
• Establishing
The IDEAL model is • Acting
named for the five • Learning
phases it describes:
Laws, Regulations, and Industry Standards Affecting the Organization
Laws, Regulations, and Industry Standards Affecting the Organization
Explanation
• Passed in 1978
• Implemented by the Fed Reserve Board Regulation E
• Limits to customer liability on loss or theft of card
• EFT errors
Laws and Standards
• Canadian law
• It governs how private sector organizations collect, use, and disclose personal information
• The law gives different rights to individuals
Laws and Standards
• Directive 95/46/EC
• Regulates the processing of personal data within the European Union
• Governs the use of personal data
• Requires organizations to be transparent
Laws and Standards
• Enacted on July 30, 2002 (nine months after the discovery of Enron problems)
• Applicable to “Issuers” as defined in the SEC Act of 1934 (approximately 15,000 public companies)
o Companies required to file periodic reports with the SEC
o Companies with more than 1 million dollars in total assets and at least 500 shareholders
o Companies who have registered securities with the SEC
o Creates the Public Company Accounting Oversight Board, or PCAOB funded by accounting firms and
registrants
Laws and Standards
• The Payment Card Industry Data Security Standard (PCI DSS) was jointly created in 2004 by four major credit-card
companies: Visa, MasterCard, Discover, and American Express
• PCI data security requirements apply to all merchants and service providers who store, process, or transmit any
cardholder data
PCI: Card Holder Data
Sensitive
Card Holder Data
Authentication Data
Steering
Strategies
Committee
Development
Outsourcing
Policies
Strategy
ACTIONS MEASUREMENTS
COBIT Control Objective PO4.3: IT Steering Committee is present within the process. Define the IT Processes, Organization,
and Relationships
Control Practices
Part B: IT Management
Part B: IT Management
• IT Resource Management
Prioritization
Main Areas of Coverage
S trategic Alliances
B usiness Priorities
A llocate Investments
M onitor
Value Drivers
Planning
Costs
IT planning IT costs
support and optimization
optimization
Resources
Priorities
Risk Drivers
Following are the common Risk Drivers:
Insufficient
Insufficient
capabilities and Skills
resources
skills
Infrastructure
Insufficient
Fragmented
resources to
and/or inefficient
achieve desired Resources
infrastructure
goals
Priorities
VAL IT Framework
Risk IT Framework
Principles of Risk IT
Accountability must
IT Risk always aligns IT risk should be IT risk management IT risk management be enforced and
aligned with IT risks should be must be a defined to set the
with business should be driven by
enterprise risk openly and fairly continuous process right tone and
objectives cost-benefit analysis
management communicated and be a part of confirm to
daily activities well-defined
tolerance levels
IT Investment and Allocation Practices
Enterprises have limited resources in the form of people and money, which can be allocated to IT investments. These
investments provide financial benefits such as cost reduction, and non-financial benefits such as improved customer
satisfaction.
Information Technology value is determined by the relationship between what the organization pays and what it receives.
Risk-profile analysis
Continuous Diversification of
improvement projects
The methods
to implement
IT Portfolio
Management
are
Financial management is a critical element of all business functions, in which the user-pays scheme (a form of chargeback) can
improve application monitoring of IS expenses and available resources.
IS Budget
Financial Management Practices
Managing contracts
Managing relationships
Monitoring processes
1 3
Capabilities Business
stability
2
Reviewing Contractual Commitments
The IS auditor should be familiar with the Request for Proposal (RFP) process and know what needs to be reviewed.
Contract
acceptance
Contract
Contract bidding maintenance
process
Software contracts
reviewed by an IS
auditor include
Development of Contract
contract compliance
requirements
and service
levels
Value Drivers
Penalties or incentives
SLAs
for SLA
Establish
supplier
contract
management
Right to audit responsibilities Monitoring and reporting
against SLAs
Specific techniques
Tools
Performance Optimization
•Performance optimization is the process of improving the productivity of information systems to the highest possible level
without additional investment in the IT infrastructure.
•Performance optimization is driven by key performance indicators (KPIs) based on the business operations/processes,
strategic IT solutions, and corporate strategic objectives.
Operating procedures
Optimization Approaches
DMADV is used to
DMAIC is used to develop a new
improve an process, without
existing process. any yardstick for
improvement.
Define Define
Measure Measure
Analyze Analyze
Control Verify
Improve Design
DRIVE
Expansion of DRIVE
D efine
R eview
I dentify
V erify
E xecute
Methods
Following are the various methods for Process Improvement:
CEDAC
Brainstorming
Pareto
Analysis
Methods
CEDAC
In this method, problem is written at the end of the horizontal line drawn on a sheet of paper,
which resembles the spine of a fish.
On either side of
the spine, lines are The causes and the
drawn and labelled effects of the
with the major problem are written
factors involved along the fish
like task, people, bones.
location.
Pareto Analysis
The Pareto principle is widely used in quality control and can be applied to the following scenarios:
80% of
20% of your
20% of defects complaints
workforce
cause 80% of stem from 20%
produces 80%
the problem of your
of the results
products
Monitoring and Reporting IT Performance
IT governance progress must be measured and monitored with effective tools such as balanced scorecards
(BSCs) and key performance indicators (KPIs)
The results provide a clear indication of the capabilities of organization to meet its objectives
Customer/
Financial The IT balanced user
performance scorecard (BSC) is a satisfaction
process management
evaluation technique
that can be applied to
the IT governance
process to assess IT
functions and
processes.
Business User
Contribution Satisfaction
The scorecard
measures
Innovation Operational
Excellence
IT Balanced Scorecard
The scorecard illustrates the relationship between financial, internal business processes, the customer, and learning and
growth in determining a balanced score.
KPI
Quantitative measurement
Investigating variances
of the results
IT Quality Assurance and Quality Management
Quality Management and Quality Assurance
Explanation
Quality Assurance
Quality Management
Main Areas of Coverage
Quality Assurance
Quality Management
Quality Assurance
1 2 3
ISO 17025 +
ISO 9000 +
Standards
ISO 17025 -
• General requirements for the competence of testing and calibration
laboratories
• Scope
• Normative references
• Terms and definitions
• Management requirements
• Technical requirements
ISO 9000 +
Standards
ISO 17025 +
ISO 9000 -
• Customer focus
• Leadership
• Involvement of people
• System approach to management
• Continual improvement
• Factual approach to decision-making
• Mutually beneficial supplier relationships
Quality Management
Quality Management include:
uality
planning
uality
control
uality
assurance
uality
improvement
Quality Management Standards
Process System of
performance interrelated
indicators indicators
Process
perspective
Quality Economic Learning
indicators and
indicators growth
SMART
Expansion of SMART
S Specific
M Measurable
A Achievable/Acceptable
R Realistic/Relevant
T Time-specific/Trackable
Quality Management
8 principles of
ISO QMS
The IS auditor should determine whether BIA and BCP are suitably aligned
BIA drives the focus of BCP/disaster recovery plan (DRP) efforts of the organization and helps balance the costs
to be incurred with corresponding benefits to the organization
Main Areas of Coverage
Business Impact
Analysis
Business Impact Analysis is a component of Business Continuity Planning (BCP), which identifies events
that could impact the continuity of operations and assesses the impact of these events.
Key
business End-users
processes
Questionnaires,
interviews, and
Roles Senior brainstorming
involved management sessions
Business Impact Analysis: Points to Consider
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are discussed here.
The diagram shows the relationship between Disruption costs and Recovery costs.
The two should be balanced to attain an optimum protection level of key information assets, that is, to obtain an optimal RPO
and RTO.
Disruption Cost vs. Recovery Costs
If the business continuity strategy aims at a longer recovery time, it will be less expensive than a more stringent requirement,
and more susceptible to downtime costs spiraling out of control.
The IS Auditor needs to understand the life cycle of BCP/DRP plan development and maintenance and the types of
BCP tests, factors to consider when choosing the appropriate test scope, methods for observing recovery tests and
analyzing test results.
Main Areas of Coverage
IS Business Continuity
Planning
Business Continuity Planning
Process
Business Continuity Policy
Business Continuity Planning
Incident Management
Development of Business
Continuity Plans
Other Issues in Plan
Development
Components of a Business
Continuity Plan
Plan Testing
Components of an Effective BCP
Continuity of Incidence
support plan response plan
Continuity of Disaster
operations recovery plan
plan
The components of a Business
Continuity Plan depend on the
Business Occupant
organization size and requirements.
resumption It may include: emergency
plan plan
Components to be Agreed
Staff required/responsible
Data and systems
for recovery tasks
1 2 3 4 5
Testing the developed Specifications such as Testing of plan by Documentation of Analysis of the results
plans to determine if objective and scope post-test, paper test, test results, which obtained against
they work and of the test, test preparedness test, include document specifications set in
identify areas that execution, and and full operational observations, time, amount, count,
need improvement pretest test problems, and and accuracy
resolutions to
facilitate recovery in a
real disaster
Business Continuity Plan Test Execution
BCP tests can be executed by conducting pre-test, actual test, and post-test.
Pre-test: The set of actions necessary to set the stage for the actual test. This ranges from placing tables
in the proper operations recovery area to transporting and installing backup telephone equipment.
Actual test: This is the stage for real action of the business continuity test.
• Actual operational activities are executed to test specific objectives of the BCP.
• This is the real action of the business continuity test
• Actual operational activities are executed to test the specific objectives of the BCP
• This is the actual test of preparedness to respond to an emergency.
Business Continuity Plan: Test
There are five levels of testing.
Level 5 Cutover
Level 4 Parallel
Level 3 Simulation
Level 2 Walkthrough
Data and systems owners are accountable for maintaining appropriate security measures over information asset.
Business unit management is responsible for implementing cost effective controls in an automated system.
Proper segregation of duties prohibits a system analyst from performing quality assurance functions (it is difficult for us to poke holes in our own work).
a. a leading-edge technology
c. a low-cost philosophy
a. a leading-edge technology
c. a low-cost philosophy
The IS department should have long- and short-range plans that are consistent with the organization's
plans to attain its goals.
QUIZ
An organization needs to better understand whether one of its key business
2 processes is effective. What action should the organization consider?
c.
c.
The long term viability of a vendor is essential to derive maximum value for the organization. It is more
likely a financially sound vendor would be in business for a long period of time.
QUIZ An organization having a number of offices across a wide geographical area has
developed a disaster recovery plan. Using actual resources, which of the
4 following is the MOST cost-effective test of the disaster recovery plan?
a. Cutover test
b. Walk through
c.
d. Regression test
QUIZ An organization having a number of offices across a wide geographical area has
developed a disaster recovery plan. Using actual resources, which of the
4 following is the MOST cost-effective test of the disaster recovery plan?
a. Cutover test
b. Walk through
c.
d. Regression test
A cut over test, literally causes the primary systems to go offline, to ensure that backup systems and
processes function.
QUIZ
Which of the following is the MOST important action in recovering from a
5 cyber-attack?
The most important key step in recovering from cyber attacks is the execution of a business continuity plan
to quickly and cost-effectively recover critical systems, processes and data.
Case Study
Case Study 1
An IS auditor has been asked to audit a financial services company. The primary goal is to evaluate the alignment of
business strategic objectives with the IT objectives. While collecting data, the IS auditor finds the documentation for the
business strategic objectives is a brief list in a PowerPoint presentation. And there are items in the IT strategic plan
specifically designed to support specific business goals that are not in the budget. Some IT projects do not correlate to
any business objective. Finally, he discovers the communication between the IT management and the executive staff is
not effective.
QUIZ
Which of the following is a big concern for the auditor?
1
These are clearly defined items that have been determined to be necessary to support strategic goals, but
are not budgeted for. Answer option A would be the next most serious issue as it wastes financial
resources on unnecessary projects. Option C and D are both concerns, but not as critical as B.
QUIZ
Which is the most important reason that the abbreviated business strategic
2 goals would be a concern?
While options C and D are both possible, those are primarily outside the scope of an IS audit. Option B is
measureable and definable, and should be noted in the audit.
Case Study 2
An IS auditor is tasked with the review of a hotel chain’s outsourcing agreements. The company
outsources management of its Website, Web servers, and reservation application (including the
backend database) to a third-party. This business relationship has existed for 3 years, and is working
well. So far, there have been no significant outages and no security breaches.
QUIZ
Which of the following is the least important in an IS audit review?
1
b. The SLA
b. The SLA
There are no outages or breaches in the past three years. Hence, there should be few minor incidents.
QUIZ
Why should you closely review the SLA, even though the company reports show
2 satisfaction with the service?
Simply because the company has been satisfied so far, does not mean the SLA is adequate or complete. It
is likely that there will eventually be a breach or outage, and it is important to confirm that the SLA is
adequate.
Key Takeaways
Evaluate the IT strategy for alignment with the organization’s strategies and objectives
Evaluate the organization’s IT policies and practices for compliance with regulatory and legal requirements
Evaluate IT resource and portfolio management for alignment with the organization’s strategies and objectives
Evaluate whether IT supplier selection, service, and contract management processes align with business
requirements
Conduct periodic review of information systems and enterprise architecture
Evaluate the information security program to determine its effectiveness and alignment with the
organization’s strategies and objectives
Evaluate potential opportunities and threats associated with emerging technologies, regulations, and
industry practices
This concludes ‘Governance and Management of IT.’
The next domain is ‘IS Acquisition, Development, and Implementation.’
Certified Information Systems Auditor (CISA®)
Information Systems Acquisition, Development, and Implementation
Evaluate whether the business case for the proposed changes in information systems
meet the business objectives
Illustrate the readiness of information systems for implementation and migration into production
Evaluate change, configuration, release, and patch management policies and practices
Part A: Information Systems Acquisition and Development
Part A: Information Systems Acquisition and Development
Organizations need proper processes and methodologies to create and change application systems and infrastructure
components. This is called information systems lifecycle management. Information systems lifecycle management encompasses:
Retire Information
Acquisition Plan Acquisition Use and Maintenance
System
Project Governance and Management
Project Organizational Forms
Pu
e
re
nc
ue
Pro
Infl
jec
t
Matrix
Project Organizational Forms
Pure Project Organization Project managers have complete responsibility of the project
Main Objectives
Sub Objectives
Project Breakdown
Project Communication
On initiating a project management process, communication may be achieved in a number of ways depending on its size and
complexity. Project Communication types are as follows:
Team
Member
Team
Manager
Member
Manager
Manager
Team Team
Member Member
Project Culture
Closing
Controlling
Executing
Planning
Initiating
Elements of Project
Projects have three key intertwining elements called Deliverables, Duration, and Budget (these should have positive
correlation).
Software Size Estimation methods are used to determine the relative physical size of the application software to be
developed. These methods are:
Software Size Estimation
One of the methods of software size estimation is Function Point Analysis (FPA):
FPA is an indirect measure of the size of an information system (software size) based on number and complexity of inputs, outputs,
files, external interfaces, and queries.
Complexity adjustments (rating factors) are used based on analysis of reliability, criticality, complexity, reusability, changeability and
portability.
Software Cost Estimation
Software Cost estimation is a consequence of software size estimation and involves estimation of programs at each phase. Some of
the components to consider when using these techniques include:
Budgets and Schedules
In the Critical path methodology (CPM), a project can be represented as a network where activities are shown as branches
connected at nodes immediately preceding and immediately following activities.
Program Evaluation Review Technique (PERT)
Program evaluation review technique (PERT) is used for planning and control, estimation of time and resources required, and
detailed scheduling (timing and sequence).
Gantt Charts
The controlling activities of a project includes management of scope, resource usage, and risk. New requirements should be
documented and, if approved, allocated the appropriate resources.
To manage scope, the deliverables breakdown is accompanied by proper documentation in a component management database
(CMDB).
Changes to scope will always lead to changes in activities impacting deadline and budget. Therefore these need to be handled
formally in a Change Management Process.
Project Controlling
Resource usage is the process by which the project budget is being spent.
It checks if actual spending is in line with planned spending. Resource usage must be
measured and reported.
Every budget and project plan presupposes a certain "productivity" of resources and
delivers the expected quality of the outcome/deliverable.
Earned Value Analysis (EVA) technique can be used to check this. It involves comparing
the following continuously:
Closing a Project
A project should be finite and at some point be closed with the new or modified system handed over to the users and/or system
support staff.
The project manager’s skill set should be commensurate with the project at hand.
To manage all the relevant parameters of a large project, project management practices, tools and control
frameworks are required.
Projects need to be managed on hard (Example: Budget and technical requirements), soft (Example: Personal
relationships, and departmental politics), and environmental factors.
Effective and efficient deployment of project resources is enhanced by having adequate project governance
mechanisms.
The more complex the project, the more elaborate the governance structures and mechanisms.
Use of vendors can speed up a project and potentially reduce total costs
However, use of vendors adds risks, especially if the vendor is single or sole source provider
Proper vendor management can reduce/ prevent problems caused by picking a vendor that is unable to achieve
the required solution or timescale and by ensuring that contracts address business needs and do not expose
the business to unnecessary risk
Main Areas of Coverage
Hardware Acquisition
Selection of a computer hardware and software environment frequently requires the preparation of specifications for
distribution to hardware/software (HW/SW) vendors and criteria for evaluating vendor proposals.
The specifications are sometimes presented to vendors in the form of an invitation to tender (ITT), also known as a request for
proposal (RFP).
Hardware Acquisition
Centralized or
Distributed,
decentralized,
Information processing requirements
…
…
…
…
Adaptability requirements
Hardware requirements
Organizational descriptions indicating
Constraints
whether the computer facilities are
System software applications
…
…
…
…
Conversion requirements
Support requirements
Manned or
Outsourced
lights-out
Hardware Acquisition
When purchasing or acquiring hardware and software from a vendor, consider the following:
Analysis of the vendor's capability to provide maintenance and support (including training)
Preparation of a formal written report summarizing the analysis for each of the alternatives
and justifying the selection based on benefits and cost
System Software Acquisition
When selecting new system software, the business and technical issues considered include:
Security
When selecting new system software, the business and technical issues considered include:
The requirements for a Request for proposal (RFP) are given in the following table:
Request for Proposal Process (contd.)
The requirements for a Request for proposal (RFP) are given in the following table:
Project Success
•
Legal
User and Financial
Regulatory
Satisfaction ROI
Compliance
Productivity Cost- Benefit
Risk Management
•
Risks are the possible negative events or conditions that would disrupt relevant aspects of the project.
Risks are the possible negative events or conditions that would disrupt relevant aspects of the project.
Review and
Assess and evaluate risk
Identify risks Manage risks Monitor risks
evaluate risks management
process
Business Case and Feasibility Analysis
Benefits Realization Practices
•
This should estimate all costs and benefits throughout the life of a new system.
Main Areas of Coverage
Business Realization
Benefits Realization
Techniques
Benefits Realization
Benefits realization is the process by which an organization evaluates technology solutions to business problems.
Cost
Quality
Reliability
Dependability
Benefits Realization Technique
Part of an IS audit is understanding how the audit target develops software and systems.
Traditional SDLC Phases: Waterfall Model
Feasibility
Requirements
Design
Development
Implement
Maintain
Disadvantages of Traditional SDLC
Changing Unclear
Fast Pace
Requirements Specifications
Agile Software Development Life Cycle
Start Next
Plan Design Development Evaluate
Iteration
Rapid Application Development (RAD)
• • •
• • •
Object-Oriented Systems Development
Object-Oriented Systems Development contrasts from traditional approaches that treat data and procedures separately. Data and
procedures are grouped into an entity called an “object”:
Objects are organized into an aggregation hierarchy, with descriptions which show how services are used. Object classes
may inherit attributes and services from other object (parent) classes. Major advantages of this method are as follows:
Data-Oriented System Development involves representing software requirements by focusing on data structure rather than data flow.
It considers data
independently from the
processes that transform
data.
Data-oriented development
complements traditional
development strategies.
Requirements Analysis in System Development Life Cycle (SDLC)
Requirements Analysis involves identifying and specifying requirements of the system chosen.
Decisions on Requirement Analysis are made on:
01 02 03 04 05 06
Key Outputs of Requirements Analysis
• •
•
o Signatures on source documents •
o Logical access controls
o Workstation identification—restricting input to o Total number of records
specific terminals or staff o Total amount
o Authentication of source documents o Total number of documents: Each document should
hold a unique number that enables tracking
o Hash totals: This is the total of non-numeric field such
as account numbers, customer ID, phone numbers, and
dates. This ensures the integrity of the data and that
non-numeric fields have not been changed
o Error correction procedures
o Logs
o Reconciliation
o Source document controls and procedures
Processing Procedures and Controls
• Calculations • Review
• Process • Handling
• Totals • Reporting
• Algorithms
Processing Controls
• Processing controls ensure that the application is processing data accurately.
• •
• o Manual recalculation
o Edit check
o Programmed controls
o Limit check
o Sequence check o Reconciliation of file totals
o Exception reports
o Limit check
o Range check
o Validity check
o Reasonableness check
o Check digit
o Completeness check
o Duplicate check
Output Controls
• Output controls ensure that output is well formatted and delivered in a consistent and secure manner.
• Some of the examples of output controls are:
Proper risk management is required in order to minimize the consequences and the likelihood that the project
fails to achieve its goals.
Risk management is a continuous process, not a one-time activity, since risk profiles will change over time.
Part B: Information Systems Implementation
Part B: Information Systems Implementation
• Post-implementation review
Testing Methodologies
Testing Methodologies and Practices Related to ISs
•
Organizations employ a methodology to reduce development time and improve maintainability of the
resulting code base.
Controls appropriate to one form of development may not apply to other forms.
SDLC: Testing
SDLC: Testing
o Quality assurance (technical aspects): focuses on documented specifications and technology employed.
o User acceptance (functional aspects): assesses if the system is production ready and satisfies all requirements.
SDLC: Testing Terminology
Documentation
Testing complete Users Trained
Complete
Configuration and Release Management
Release Management
•
Configuration and release management provide systematic, consistent, and unambiguous control on
attributes of IT components comprising the system
Changes to IT systems must be carefully assessed, planned, tested, approved, documented, and
communicated to minimize any undesirable consequences to the business processes
Main Areas of Coverage
IS Configuration
Maintenance management
Change
Management
Change Management Process Overview
Confirm
Authorize Implement and
Document
Change Management Process Overview
Emergency Changes
Change Management Process Overview
Change Control
Documented Review
Requests
System Migration, Infrastructure Deployment, and Data Conversion
System Migration and Infrastructure Deployment
•
The consistency Security of data Any loss of A record should A rollback plan
of data should be being converted confidentiality and be maintained for must be defined, in
maintained should be integrity must be the data exported case the
throughout the maintained. prevented. from legacy conversion fails
process of data system into the despite all the care
being ported new one, which taken.
from legacy to enables
the target system. verification of
completeness and
accuracy of data.
Data Migration Steps
2
Identify who is
responsible for
1 verifying the
Check if accuracy is conversion and
to be maintained at signing off
100% or some
Identify the data to margin of
be converted and difference is
the method to do permissible
that
Migration Issues
Possible Rollback
Review
Implementation
Change Approval
Board (CAB)
Formal RFC
Change Request
Cutover or Changeover Methods
• Once a new system has been tested and is ready to go live (also called cutover and
changeover), users and activities need to be shifted from legacy to the new
application.
• This can be done in several ways:
Parallel
Changeover
Phased
Changeover
Abrupt
Cutover
Cutover or Changeover Methods
• Old and new systems are run in parallel for some time, until stakeholders and
Parallel users gain confidence in the new system.
Changeover • This gives users access to both systems for a while, which ensures that the
operations are not disrupted, even if unexpected problems occur.
• This is the safest method of changeover, since it provides sufficient time to identify
and correct any flaws or errors in the new system.
• The drawback of this method is that the users are required to run both the systems
during the overlap period which leads to a temporary increase in their workload.
Phased
Changeover
Abrupt
Cutover
Cutover or Changeover Methods
Parallel
Changeover
• Switchover from old system to new one is done in a phased manner or stages.
• Some of the modules of new application are implemented initially and then
Phased gradually extended until the old system is entirely shut down.
Changeover • A unique challenge in this approach is that the users will have to perform different
tasks on two different systems in the initial phase, and will thus have to be
conversant with both.
Abrupt
Cutover
Cutover or Changeover Methods
Parallel
Changeover
Phased
Changeover
• Old system is shut down on the pre planned date and time, and the new system is
activated.
• New system must be thoroughly tested and a fallback plan should be designed,
before the cutover is attempted.
Abrupt
• Out of all the methods, this method is most likely to cause disruption if the new
Cutover
system does not perform, since the comfort of some or all modules of old system
running in parallel is absent.
Enterprise Architecture
•
You must understand the architecture and architectural models in order to understand the organization.
Value Drivers
User
Satisfaction
Compliance
Functionality
Cost Effective
Security
Risk Drivers
Post-implementation review is typically carried out in several weeks or months after project completion, when
the major benefits and shortcomings of the solution implemented will be realized
Projects should be formally closed to: provide accurate information on project results, improve future projects,
and allow an orderly release of project resources
The closure process should: determine whether project objectives were met or excused, and identify lessons
learned to avoid mistakes and encourage repetition of good practices
Main Area of Coverage
Post
implementation
Review
Post-Implementation Review
Post-implementation review verifies whether the system was designed and developed properly and proper controls
were built into the system.
Post-implementation review verifies whether the system was designed and developed properly and proper controls
were built into the system.
• Reviewing the development process
o Were the chosen methodologies followed?
o Was appropriate Program management used?
• Can be done internally by the Program development team and selected end-users
Knowledge
Check
QUIZ
The phases and deliverables of a system development life cycle (SDLC) project
1 should be determined:
b. After early planning has been completed, but before work has begun
d. Only after risks and exposures have been identified and the IS auditor has
recommended appropriate controls
QUIZ
The phases and deliverables of a system development life cycle (SDLC) project
1 should be determined:
b. After early planning has been completed, but before work has begun
d. Only after risks and exposures have been identified and the IS auditor has
recommended appropriate controls
Explanation: It is extremely important that the project be planned properly and that the specific phases
and deliverables be identified during the early stages of the project.
QUIZ
By evaluating application development projects against the capability maturity
2 model (CMM), an IS auditor should be able to verify that:
a. Operating system (OS) being used is compatible with the existing hardware
platform.
a. Operating system (OS) being used is compatible with the existing hardware
platform.
Explanation: In reviewing the proposed application the auditor should ensure that the products are
compatible with the current or planned OS.
QUIZ
Which of the following is an advantage of prototyping?
4
d. It ensures that functions or extras are not added to the intended system.
QUIZ
Which of the following is an advantage of prototyping?
4
d. It ensures that functions or extras are not added to the intended system.
Explanation: Prototype systems can provide significant time and cost savings; however, they also have
several disadvantages. They often have poor internal controls, change control becomes much more
complicated, and it often leads to functions or extras being added to the system that were not originally
intended.
Case Study
Case Study 1
•
QUIZ
Which of the following should be the auditor’s greatest concern?
1
a. The VPN
b. The database
d. The firewall
QUIZ
Which of the following should be the auditor’s greatest concern?
1
a. The VPN
b. The database
d. The firewall
Explanation: The scenario does not indicate how the wireless is secured, and wireless is always vulnerable
to attack attempts. The other items should also be audited, but the wireless connection must be the most
critical concern.
QUIZ
Why would the database be an issue?
2
Explanation: Collocation of credit card data is not allowed with PCI standards. Furthermore, the various
databases all have points of entry to them that could be used to exploit the credit card related data.
Case Study 2
•
QUIZ The tech company supporting the firm has suggested a complete overhaul of security
including high end firewalls, intrusion detection systems, anti-virus, quarterly
1 penetration tests, and a variety of other security measures. What should be the
auditor’s opinion of this recommendation?
c. The plan is good, provided the tech firm does not profit from it
c. The plan is good, provided the tech firm does not profit from it
Explanation: It is easy to wish for every security innovation available. But budget constraints and return on
investment are always considerations. For this small network, less expensive measures like password
management could deliver significant security gains.
QUIZ
Apart from the items listed, what would be the most important item for the
2 company to consider?
b. Adding a DMZ
c. Implementing an IDS
b. Adding a DMZ
c. Implementing an IDS
Explanation: Updates and patches are free, and provide a significant security benefit. Failure to update
and patch can also lead to serious vulnerabilities. While the other measures might be useful, they are not
as critical as updates, and options B and C may be cost prohibitive for a small company.
Key Takeaways
Evaluate whether the business case for the proposed changes in information systems
meet the business objectives
Illustrate the readiness of information systems for implementation and migration into production
Evaluate change, configuration, release, and patch management policies and practices
This concludes ‘IS Acquisition, Development, and
Implementation.’
The next domain is ‘Information Systems Operations and Business
Resilience.’
Certified Information Systems Auditor (CISA®)
Information Systems Operations and Business Resilience
Evaluate change, configuration, release, and patch management policies and practices
Evaluate end-user computing to determine whether the processes are effectively controlled
• IT asset management
• System interfaces
• End-user computing
• Data governance
Part A: Information Systems Operations
• Database management
Overview
• Information systems operations, maintenance, and support practices are important to provide assurance
to users and management that the expected level of service will be delivered.
• Service level expectations are derived from the organization’s business objectives. IT service delivery
includes IS operations, IT services and management and the groups responsible for supporting them.
Common Technology Components
Technology Concepts
•
The IS auditor must be familiar with the functionality of information system hardware and network
components.
This includes understanding the importance of the physical part of IS/IT solutions that support the
organizational objectives and goals and key control and risks involving system software.
Although the CISA exam does not test technical knowledge of the working of individual components, an
understanding of the risks associated with and possible control functions of each component is expected.
Main Areas of Coverage
Network
Backbones Protocols
Segments
Hardware Risks
Malicious
Data Loss
Code
Physical Data
Theft Corruption
Business Process Risk Interference with RFID results in interference with business processes.
Business Intelligence Risk Competitors can gain information from RFID and use it to harm the business.
RFID can compromise personally identifiable information, wherein tagged items can be traced to an
Privacy risk
individual.
Management
Operational Technical
Hardware Monitoring Practices
Hardware monitoring
practices include the
following
Hardware Auditing
Auditing of
hardware covers:
Involves
Multiple processes are protected from each other; Example, writing into each other’s memory
Access Control Software developed for the computer must be compatible with its operating system.
Access to data
Updates/Changes to data
02 Data communication software is used to transmit data from one point to another. It is also used for conversion:
Codes – ASCII, EBCDIC, Unicode. Communication software components include:
Bus Ring
Topology Topology
Star Mesh
Topology Topology
Network Topology and Its types
• •
•
• •
•
•
• •
• •
• •
•
•
•
Types of Networks
PAN PAN
Types
Distributed of Local
Networks
WAN LAN
Area
MAN CAN
WLAN
Security
• It requires endpoint devices to provide only the • It requires both devices to share a symmetric
SSID. key, which is used to encrypt and decrypt the
• All transmissions between AP and endpoint data transmitted between them.
devices are in cleartext and can be intercepted. • This method provides better security than the
• No encryption or decryption is involved here. OSA.
Wi-Fi Protected Access (WPA & WPA2)
WPA
• IEEE 802.11i was developed
Limitations of WEP to overcome the
weaknesses of WEP
• Symmetric key used in many A protocol.
implementations may not be • It utilizes the Temporal Key
changed. Integrity Protocol (TKIP),
• In most cases, same key is which uses a different key
used by all devices in for each frame.
network. B
• The initialization vector is
static, which leads to an WPA2
inadequate degree of
randomness in the • It employs AES algorithm
encryption. for encryption, which
• Packet integrity is not provides a higher level of
C security.
adequately assured.
Virtual Private Networks
A VPN extends the corporate network securely via encrypted packets sent out via virtual connections
over the public Internet to distant offices, homeworkers, salespeople, and business partners. VPN
allows the following:
VPN Types
IT Asset Management
Asset Management and Software Licensing
•
Software licensing should be subject to controls to ensure that the number of copies in circulation within an
organization does not exceed the number purchased.
Main Area of Coverage
Monitoring Use of
Resources in
Software Licensing
Software Licensing Issues
Individual
Site
Organizational
Digital Rights Management
Digital Rights Management (DRM) refers to access control technologies that can be used by hardware manufacturers,
publishers, and copyright holders to impose limitations on the usage of digital content and devices.
The digital revolution that DRM removes usage DRM can also refer to Some companies that
has empowered control from the person in restrictions associated make use of DRM are
consumers to use digital possession of digital with specific instances of Sony, Apple Inc.,
content in new and content and puts it in the digital works or devices. Microsoft, BBC among
innovative ways has also hands of a computer others.
made it nearly impossible program.
for copyright holders to
control the distribution of
their property.
Job Scheduling and Production Process Automation
Job Scheduling
•
Reliance on operators is
reduced
Sets up daily work Job
schedules Scheduling Advantages
Software Job dependencies are
defined so that if a job
fails, subsequent jobs
relying on its output will
not be processed
Automatically determines
which jobs to be
Records of all job
submitted for processing
successes and failures
are maintained
System Interfaces
Control Techniques for Interface Integrity
•
System interfaces including middleware, application program interfaces (APIs), and other similar software
present special risks because they may not be subject to the same security and control rigor that is found in
large-scale application systems.
Management should ensure that systems are properly tested and approved, modifications are adequately
authorized and implemented, and appropriate version control procedures are followed.
System Interfaces
System Interfaces enable disparate systems to communicate and transfer data to each other by using
standard interfaces, data formats, and communication protocols.
Well-designed and well-developed system interfaces enable reliable physical and logical connection of
different systems.
An incorrectly functioning interface could affect the confidentiality, integrity, or availability of data which
can potentially affect business objectives or invoke legal compliance liability.
An IS auditor must understand and evaluate the controls used to protect system interfaces and data
transfers which could include encryption for confidentiality, hashing or data conciliation for integrity, audit
trails for non-repudiation, etc.
End-User Computing
End User Computing
•
End-user activities are still one of the biggest vulnerabilities in security; therefore, they must be examined as
part of any IS Audit.
End User Issues
Introducing rogue
Leaving systems
Password control Bypassing security Failure to follow devices and Password Re-use
unsecure
for convenience policies software
Risks and Controls for End User Computing
•
Behavior
Policies
Security Software
Data Governance
Data Quality
•
Database Structure
Application
Processes
Data Quality Areas: Operational
Business Processes
Business Rules
Validation
Data Quality Areas: Governance
Data Roles
Data Responsibilities
Monitoring
System Performance Management
Capacity Planning and Related Monitoring Tools and Techniques
•
Capacity planning ensures that the current and future capacity and performance aspects of business
requirements are anticipated in advance, assessed and, where necessary, provided in a cost-effective manner.
Capacity of information systems must be monitored on a continuous basis to meet business needs and should
be planned using projections of expected demands. Capacity includes the size and speed of the processor;
internal system memory; and storage and communications media.
Main Areas of Coverage
Capacity Management
This involves planning and monitoring computing and network resources to ensure efficiency and
effectiveness. It requires expansion/reduction in line with business growth/reduction and takes
into account present business and future expansions.
An incident is any event that causes temporary disruption to the business. A problem may develop when such
incidents are unresolved.
Problem and Incident Management Practices
Initial Response
Follow-up
Problem Management
History of Incidents
Source of Incidents
Service level management ensures that IT services meet customer’s expectations and that service level
agreements (SLAs) are continuously maintained and improved as needed.
SLAs are generally separate documents from the contracts with external vendors. SLAs may also be created
internally to assure the key process owners of the level of service that the IT organization has agreed to
provide.
Service Level Management Practices
Response Responses
Availability
IT Service Management (ITSM) comprises processes and procedures for efficient and effective delivery of IT services relative to
business expectations. ITSM comprises IT support services and IT delivery services.
• •
•
•
• •
•
In a nutshell, the service assured in SLA must be supported and backed up by OLA.
Service Management Practices
•
It is essential to know the latest approaches in contracting strategies, processes and contract management
practices.
Outsourcing IT can help reduce costs and/or complement an enterprise’s own expertise but may introduce
additional risks.
IT Service Management
Three important factors you need to be concerned with include the following:
IT performance monitoring of critical processes and assets should be conducted on a continuous basis to
ensure reliable IT services that meet SLAs and achieve defined business objectives.
Performance monitoring processes must be established with supporting tools and techniques and, although
the CISA exam does not test knowledge of specific tools, the IS auditor should be aware of the importance of
monitoring and of basic techniques which may be employed.
Data management capabilities are enabled by system software components that enact and support the definition, storage,
sharing, and processing of user data and deal with file management capabilities.
One record is
Sequential processed after
User and system data are another
File organization usually partitioned into
manageable units called
data files. Examples of data Records are
file organizations include addressed
Direct Random individually based on
Access a key, not related to
the data. (e.g. a
record)
Database Controls are necessary to ensure integrity and availability. Database controls include:
• Definition standards and compliance
• Backup and recovery
• Access control over data items and tables
• Concurrency controls
• Controls to ensure accuracy, completeness, and consistency of data and relationships
• Use of checkpoints
• Database reorganization
• Database restructuring procedures
• Database performance monitoring tools/procedures
• Minimize non-system access
Database Controls and Database Reviews
• System resiliency
A Business Impact Analysis (BIA) drives the focus of the BCP efforts of an organization and helps balance costs
to be incurred with the corresponding benefits to the organization. A good understanding of the BIA concept is
essential for the IS auditor to audit the effectiveness and efficiency of a BCP.
BIA
Identify
Identify Likelihood Identify Impact
Vulnerabilities
Identify Criticalities
It is a key input in determining the RTO and RPO, which are the systems
that support mission critical business functions.
RTO and RPO are critical factors in determining the DR solutions that an
organization chooses for its applications.
BIA
BIA (Business Impact The smaller the RTO and RPO windows, the more robust and resilient should
Analysis) is a process that be the systems to restore a minimum acceptable level of service.
identifies mission critical
functions. It also identifies
the impact that disruption of The choice of different recovery solutions like mirroring, hot site, warm site
these functions will have on etc., depends on the RTO and RPO objectives.
business continuity.
Defining and installing resilient systems for a smaller RTO and RPO involves
greater expenditure.
RTO and RPO
RTO RPO
• RTO stands for Recovery Time • RPO stands for Recovery Point
Objective. Objective.
• It is the maximum period within • It is the maximum amount of data
which a business function or process that an organization can afford to
must be restored to an acceptable lose, in the event of a disaster.
level (in case of full restoration is not • Any loss of data beyond the RPO
possible) to preclude unacceptable may threaten the continuity of a
consequences for the business. business.
• It means that any delay beyond RTO in
restoring an agreed and acceptable
level of service will have grave
repercussions for the continuity of the
business.
Business Impact Analysis Related to Business Continuity Planning
•
The IS auditor should determine whether BIA and BCP are suitably aligned
BIA drives the focus of BCP/disaster recovery plan (DRP) efforts of the organization and helps balance the costs
to be incurred with corresponding benefits to the organization
Main Areas of Coverage
Business Impact
Analysis
Business Impact Analysis is a component of Business Continuity Planning (BCP), which identifies events
that could impact the continuity of operations and assesses the impact of these events.
Key
business End-users
processes
Questionnaires,
Understanding Activities involved in IT Approvals interviews, and Approaches of BIA
the personnel
organization
BIA: required in BIA: brainstorming are:
sessions
Roles Senior
involved management
Business Impact Analysis: Points to Consider
It is important to analyze the following questions before the business impact analysis.
• What are the organization’s business processes?
• What are the critical information resources related to the critical business processes?
• What is the critical recovery time for information resources to resume business processing before
significant or unacceptable losses?
Business Impact Analysis: RTO and RPO
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are discussed here.
The diagram shows the relationship between Disruption costs and Recovery costs.
The two should be balanced to attain an optimum protection level of key information assets, that is, to obtain an optimal RPO
and RTO.
Disruption Cost vs. Recovery Costs
If the business continuity strategy aims at a longer recovery time, it will be less expensive than a more stringent requirement,
and more susceptible to downtime costs spiraling out of control.
System resiliency tools and techniques are important to ensure uninterrupted service.
Main Area of Coverage
System resiliency
tools and
techniques
Resiliency
RAID SITES
Resiliency
BACKUP SPARES
Redundant Array of Inexpensive or Independent Disks (RAID)
• It protects data against disk failure.
• It provides redundancy, fault tolerance, and performance improvement by combining several physical disks into a logical
disk.
• Main features of RAID are:
• It implies dividing data into blocks • It implies that the same data is • This feature is used to provide
and writing these blocks to stored on more than one disk so fault tolerance, enabling data to be
different disks. that no disk turns out to be a reconstructed from its parallel disk
• It improves performance, since single point of failure. or parity, in case of failure.
both read and write operations • In case one disk fails, data can still • Checksums are used to detect any
are carried on in parallel on two or be accessed from the other disk. loss or mutilation in transit, since
more disks. data can be lost or unintentionally
modified while in transit.
RAID Levels
The primary levels of RAID are:
Disk
Striping
Disk Striping
Disk
with dual
0 Mirroring
parity
6 1
RAID
5 3
Disk Striping 4 Disk Striping
with with
distributed dedicated
parity parity
Disk Striping
with
dedicated
parity
RAID Levels: 0,1, and 3 RAID 0
6 1 RAID 1
• Data is written onto two disks.
RAID • This level offers redundancy: If one disk fails, the
data is available on another disk.
• It does not incorporate striping or parity.
5 3 • It does not offer fault tolerance or improved
performance.
4 • Since the same data is written to two disks,
effective storage space is reduced by 50%.
RAID 3
RAID 5 RAID
• In this level, data and parity are striped across
three or more disks. 5 3
• If one disk fails, the lost data can be
reconstructed again, using the data and parity in 10
other disks. RAID 10
• Some implementations allow hot swapping, the
• This level is also referred to as RAID 1+0, as it
ability to replace faulty drive, without shutting
essentially combines the two.
down the server.
• It requires at least 4 drives to function.
• Thus, the system remains operational, even if
• Blocks are mirrored (redundancy) and striped
one disk fails.
(performance), which gives it the name, “stripe of
• This offers both improved performance (striping)
mirrors”.
and redundancy (parity is distributed on all
• It is most suitable for highly utilized databases,
disks).
where many read and write operations have to
• This is the most common RAID level.
be performed.
• It is expensive, since it requires twice as many
disks as other RAID levels.
Sites and Spares
Mobile
Site
An IS auditor should understand the relationship between backup/recovery plans and business process
requirements; it’s essential that critical data be available in the event of data loss or contamination.
Data must be backed up, available at a location that is not likely to be impacted by a disaster at the primary
site, and protected (i.e. physically secure and encrypted if necessary).
An organization should have documented policies, processes, procedures, and standards that clearly explain
data backup and recovery.
Data Backup, Storage, Maintenance, Retention, and Restoration
Recovery Time
Objective
Recovery Point
Objective
Backup
There three types of backup:
• In this type, the data is fully • This type of backup makes a copy • This type backs up all the files,
backed up, and the archive bit is of all the files, that have changed subsequent to the last full or
set to zero. since the last full backup. incremental backup.
• The advantage of this type of • It does not change the archive bit • It sets the archive bit to zero.
backup is that the restoration is value. • It is the fastest method of creating
quick. • It consumes less time, as a backup, among others.
• However, since entire data is compared to the full backup. • However, restoration is the
backed up, the process of backing • However, restoration takes more slowest, as several backups are
up is slow. time, since full as well as, required.
differential backup is required.
Backups
Other Backups
Electronic
WORM
Vaulting
•
Main Areas of Coverage
IS Business Continuity
Planning
Business Continuity Planning
Process
Business Continuity Policy
Business Continuity Planning
Incident Management
Development of Business
Continuity Plans
Other Issues in Plan
Development
Components of a Business
Continuity Plan
Plan Testing
Components of an Effective BCP
Continuity of Incidence
support plan response plan
Continuity of Disaster
operations recovery plan
plan
The components of a Business
Continuity Plan depend on the
Business Occupant
organization size and requirements.
resumption It may include: emergency
plan plan
Components to be Agreed
Staff required/responsible
Data and systems
for recovery tasks
Testing the developed Specifications such as Testing of plan by Documentation of Analysis of the results
plans to determine if objective and scope post-test, paper test, test results, which obtained against
they work and of the test, test preparedness test, include document specifications set in
identify areas that execution, and and full operational observations, time, amount, count,
need improvement pretest test problems, and and accuracy
resolutions to
facilitate recovery in a
real disaster
Business Continuity Plan Test Execution
BCP tests can be executed by conducting pre-test, actual test, and post-test.
• Pre-test: The set of actions necessary to set the stage for the actual test. This ranges from placing tables
in the proper operations recovery area to transporting and installing backup telephone equipment.
• Actual test: This is the stage for real action of the business continuity test.
o Actual operational activities are executed to test specific objectives of the BCP.
o This is the real action of the business continuity test
o Actual operational activities are executed to test the specific objectives of the BCP
o This is the actual test of preparedness to respond to an emergency.
Business Continuity Plan: Test
Level 5 Cutover
Level 4 Parallel
Level 3 Simulation
Level 2 Walkthrough
An IS auditor should understand the concepts behind the decision to declare a disaster and invoke a BCP/DRP
and should understand the impact of the decision on an organization, remembering that invocation of the
BCP/DRP can, in itself, be a disruption.
Implementing DRP/BCP
The IS Auditor needs to understand the various testing methods for DRP/BCP.
Business Continuity Plan: Test
Document Review
Walkthrough
Parallel
Cutover
DRP BCP Standards
Plan
Repeat Do
Act Check
Pre-project activities
Laws, regulations, and contracts all impact disaster recovery planning (DRP). Insurance policies also impact
DRP.
Regulatory, Legal, Contractual, and Insurance Issues
Insurance
Laws
DRP
Regulations
Contracts
Knowledge
Check
QUIZ
An IS auditor examining the configuration of an operating system to verify the
1 controls should review the:
a. Transaction logs
b. Authorization tables
c. Parameter settings
d. Routing tables
QUIZ
An IS auditor examining the configuration of an operating system to verify the
1 controls should review the:
a. Transaction logs
b. Authorization tables
c. Parameter settings
d. Routing tables
Explanation: Parameters allow a standard piece of software to be customized for diverse environments
and are important in determining how a system runs. The parameter settings should be appropriate to an
organization's workload and control environment.
QUIZ
The database administrator (DBA) suggests that database (DB) efficiency can be
2 improved by denormalizing some tables. This would result in:
a. Loss of confidentiality
b. Increased redundancy
c. Unauthorized accesses
d. Application malfunctions
QUIZ
The database administrator (DBA) suggests that database (DB) efficiency can be
2 improved by denormalizing some tables. This would result in:
a. Loss of confidentiality
b. Increased redundancy
c. Unauthorized accesses
d. Application malfunctions
Explanation: Authorizing all changes effectively prevents a potential change that may affect system
availability. Authorization is generally based on successful testing and is put into production after
acceptance by a business user.
QUIZ An organization having a number of offices across a wide geographical area has
developed a disaster recovery plan. Using actual resources, which of the
4 following is the MOST cost-effective test of the disaster recovery plan?
b. Preparedness test
c. Paper test
d. Regression test
QUIZ An organization having a number of offices across a wide geographical area has
developed a disaster recovery plan. Using actual resources, which of the
4 following is the MOST cost-effective test of the disaster recovery plan?
b. Preparedness test
c. Paper test
d. Regression test
A preparedness test is performed by each local office to test the adequacy of the preparedness for disaster
recovery.
QUIZ
Which of the following is the MOST important action in recovering from a
5 cyber-attack?
The most important key step in recovering from cyber attacks is the execution of a business continuity plan
to quickly and cost-effectively recover critical systems, processes and data.
IS Operations, Maintenance, and Service Management
Case Study
Case Study 1
•
QUIZ
Which of the following would be the most important external item to audit?
1
It is not sufficient that there is a lock. It needs to be determined who has access to that room and how such
access is monitored and controlled.
Case Study 2
•
QUIZ
When auditing which of the following is the most critical element of the SLA to
1 examine?
a. Exception reports
b. Response time
d. Staff training
QUIZ
When auditing which of the following is the most critical element of the SLA to
1 examine?
a. Exception reports
b. Response time
d. Staff training
Exception reports detail any exception to the SLA. This is the best way to determine if the SLA is being met.
Prior to evaluating if the current SLA is adequate, it is important to note if it is even being adhered to.
QUIZ
What is the importance of a right to audit clause?
2
A is clearly wrong. Right to audits are very rarely with no-notice and a right to audit does not force
conformity to standards, it simply allows the company to confirm adherence or deviation from security
standards.
Key Takeaways
Evaluate change, configuration, release, and patch management policies and practices
Evaluate end-user computing to determine whether the processes are effectively controlled
Conduct audit in accordance with IS audit standards and a risk‐based IS audit strategy
Evaluate the organization's information security and privacy policies and practices
Evaluate data classification practices for alignment with the organization’s policies and
applicable external requirements
Evaluate policies and practices related to asset lifecycle management
Evaluate the information security program to determine its effectiveness and alignment with
the organization’s strategies and objectives
Perform technical security testing to identify potential threats and vulnerabilities
Evaluate potential opportunities and threats associated with emerging technologies, regulations,
and industry practices
Part A: Information Asset Security and Control
Part A: Information Asset Security and Control
• Privacy principles
• Data classification
Part A: Information Asset Security and Control
• Virtualized environments
An information asset is a component related to provision of accurate data or information for decision-making purposes by an
entity. It is considered to hold value to that particular organization and should, therefore, be protected by ensuring Confidentiality,
Integrity, and Availability (CIA).
Many external factors impact audits—most important are laws and regulations that affect cyber security.
COBIT Control ME3.1 – Identification of External Legal, Regulatory, and Contractual Compliance Requirements.
Information Security and External Parties
1 2 3
Federal
Cyber Electronic Information
Security Act Fund Security
2015 Transfer Act Management
Act
Maintaining the privacy of confidential data is critical to IS. Therefore, any audit must verify that privacy
principles are applied and maintained.
Privacy Management Issues and Role of IS Auditors
? How
!
?
Why Who
Exception
Destruction
? Who
Control Disclosure
Focus and extent of privacy impact assessment may depend on changes in technology, processes, or people as shown below:
Physical Access and Environmental Controls
Physical Controls
•
Physical security weaknesses can result in financial loss, legal repercussions, loss of credibility, or loss of
competitive edge.
Thus, information assets must be protected against physical attacks, such as vandalism and theft, through
controls that restrict access to sensitive areas containing computer equipment or confidential data files.
Such controls usually employ the use of access door locks that require the use of a password, key, token, or
biometric authentication of the person attempting entry.
Physical Controls
• •
•
•
•
•
•
• •
• •
•
•
•
•
•
•
•
•
•
•
Physical Access Exposures
Doors—1 uses pin, the other swipe card Short Hall The Facility
Identity and Access Management
Logical Access Control
•
Logical access controls are used to manage and protect information assets.
Controls enact and substantiate policies and procedures designed by management to protect information
assets.
Controls exist at both the operating system level and the application level, so it is important to understand
logical access controls as they apply to systems that may reside on multiple operating system platforms and
involve more than one application system or authentication point.
Access
1 2 3 4
• It is a process by which a subject claims a particular identify, typically by providing user account name or number.
• It forms the first part of the credentials.
Identification, Authentication, Authorization and Accountability (IAAA)
Logical access control may be divided into the following stages:
1 2 3 4
• At this stage, the subject provides the second part of credentials such as a password, biometric reading, PIN, or
cryptographic key.
• If both parts of the credential set supplied match the values stored by the system (those provided when the user account
was set up), the subject is considered to have been authenticated.
• However, the subject’s rights or privileges (namely, what they can accomplish on the system) depend on the next stage –
authorization.
Identification, Authentication, Authorization and Accountability (IAAA)
Logical access control may be divided into the following stages:
1 2 3 4
• When the subject desires to perform an action or access a resource, the system needs to consult an access matrix to
determine whether the subject has the privileges/rights to carry the resource to perform the action.
• Depending on the role of the subjects, they may or may not be permitted to access the resource.
• For example, not all subjects may have access to sensitive data or a resource such as a printer.
Identification, Authentication, Authorization and Accountability (IAAA)
Logical access control may be divided into the following stages:
1 2 3 4
• Although users have been identified, authenticated, and authorized to use a resource, they need to be accountable for their
actions.
• This is accomplished by recording the actions of the subjects, typically done by logging their actions on the system.
• To establish accountability of the subjects for their action, it is necessary to ensure that each subject is uniquely identified by
a unique user account.
• It is also necessary to log critical (though not necessarily all) actions of the subjects on the system.
Authentication
o Password – individual
authentication • May involve an internal list of
valid login-IDs and a
corresponding set of access rules
for each login-ID
Access Control Matrix
Access Control
Matrix
Capability Access
Biometrics
Fingerprint
Handprint
Retina
Iris
False Acceptance
False Rejection
Crossover Error-Rate
Data Leakage
•
Data leakage is the risk that sensitive information may be inadvertently made public.
It occurs in different ways such as job postings that list the specific software and network devices with which
applicants should have experience in to system administrators posting questions on technical web sites that
include posting with the specific details on the firewall or database versions they are running and the IP
addresses they are trying to connect.
Risks and Controls Associated Data Leakage
Security needs to be aligned with business objectives to provide reasonable reduction in risk.
Information Security Management (ISM)
Resiliency Cryptographic
Data at rest
Hash
Backups
Data at transit
HMAC
Redundancy
Validation
Information Security Management (ISM)
The key elements in ISM are:
Senior Management
An IS Auditor must know how network security controls function. This includes firewalls, IDS, and
honeypots.
Stateful Packet
Packet Filter Application
Inspection
Types of Firewalls
• A firewall is a device used as a barrier between a trusted network (typically the intranet) and an
untrusted network (like the internet).
• It works by enforcing rules to control incoming and outgoing traffic.
• It may also be used to prevent one network segment from accessing another.
• For example, access to critical segments of the network may be restricted.
• The three types of firewalls are as follows:
Packet-filtering
Firewall
Stateful Inspection
Firewall
Proxy Firewall
Types of Firewalls
Proxy Firewall
Types of Firewalls
Packet-filtering
Firewall
Proxy Firewall
Types of Firewalls
Packet-filtering
Firewall
Stateful Inspection
Firewall
• A proxy firewall is also known as a “dual-homed host” as it has two network interfaces,
one with an internal IP address and another with an external IP address.
Proxy Firewall • It acts as a middleman intercepting both incoming and outgoing traffic before
forwarding it with a different IP address.
• Thus, it masks the internal network from the internet.
Types of Firewalls
Packet-filtering
Firewall
Anomaly Based
Signature Based
Combined
Intrusion Detection System
• While firewalls allow or deny certain types of packets based on rules, an IDS or Intrusion Detection System is designed to
detect suspicious traffic and raise an alert.
• IDS may be of the following types:
Host-based IDS
(HIDS)
• Every known attack has a • This is behavioral-based and works on • This combines both
signature that is fed into the basis of statistical anomalies, signature-based and
the IDS. rather than known signatures. anomaly- or
• This is used to detect an • The IDS is initially put in “learning behavioral-based IDS.
attack. mode,” during which it samples the • This is flexible and can
• Limitation of IDS is that environment and formulates a profile. detect attacks based on
only known attacks can • All the traffic is compared with the known signatures as
be detected. profile built up by IDS and any well as unknown
• Unknown or new attacks, anomaly triggers an alert. This is likely attacks.
whose signatures have to generate false positives.
not been fed into the • The longer the system is put in
system, are not detected. learning mode, the more accurate the
profile is likely to be.
Honey Pots and Honey Nets
Fake System
• Security information and event management. These are products that have Security Information
Management combined with Security Event Management. Usually combining things such as:
o Log management: Aggregating and monitoring logs
o Alerting
o Dashboards: Management consoles
o Compliance: Monitoring and reporting
SIEM
Looking at each of the logs individually does not produce a holistic picture of
suspicious events and threats. Nor is it feasible to scrutinize these logs
manually. Moreover, log formats differ widely for different systems.
The objective of SIEM is to pool the logs from various sources and use
automated tools to correlate and analyze them.
SIEM stands for Security
Incident and Event
Management In addition to storing logs from various sources centrally, SIEM analyzes
them in near real time so that suitable counter measures can be taken.
FIREWALL IDS
SPI PASSIVE
APPLICATION
HONEYPOT PROXY
Protocols
IPSec CHAP
SSL/TLS KERBEROS
SESAME
VPN AUTHENTICATION
SSS/TLS Process
Step 2: Server Hello (cipher settings, SSL version, X. 509 cert., etc.)
Client Machine Step 6: Server has session key and finishes handshake
Server
Kerberos Process
Step 2: AS directs
TGS to create TGT
Step 3: TGT is sent back to user; encrypted with
symmetric key known only to KDC
TGS
Ticket Granting Service
Application of
the OSI Model in
Network
Architectures
Open Systems Interconnection Model
Defines a 7-layer
hierarchical architecture
Objective is to provide: that logically partitions
functions required to
support system-to-system
communication
A Application All
P Presentation People
S Session Seem
T Transport To
N Network Need
P Physical Processing
OSI Model: Mnemonics
Lets reverse the layers to form another mnemonic:
P Physical Please
D Data Link Do
N Network Not
T Transport Throw
S Session Sausage
P Presentation Pizza
A Application Away
OSI Layers
Transport
Network
Data Link
Physical
OSI Layers
Application
Data Link
Physical
OSI Layers
Application
Presentation
Data Link
Physical
OSI Layers
Application
Presentation
Session
Physical
OSI Layers
Application
Presentation
Session
Application
Presentation
Session
Transport
• This layer converts data into appropriate formats
for LAN and WAN.
Network
• Bridges and switches operate at the Data Link
Layer.
• Network technologies have different signaling
Data Link and encoding patterns and interpret electricity
voltages differently.
• MAC addresses are physical addresses and are
Physical not routable. They cannot go beyond the
physical segment of the network.
OSI Layers
Application
Presentation
Session
Transport
Network
• This layer is responsible for converting bits into
voltages for transmission over the network.
Data Link • Specifications include voltage levels, voltage
changes, physical connectors for electrical and
optical data transmission.
Physical • Repeaters and hubs operate at the Physical
Layer.
Data Classification
Data Classification Standards
•
Information assets have varying degrees of sensitivity and criticality in meeting business objectives. Data is
classified and protected according to the set degree.
An important first step to data classification is discovery, inventory, and risk assessment. Once this is
accomplished, data classification can be put into use.
Data Classification Standards and Supporting Procedures
Confidential
Sensitive
Public
Inventory and Classification of Information Assets
•
Inventory and Classification of Information Assets
•
Classification of Information Assets
Critical
Significant
Moderate
Low
Classifying Data
Military Civilian
Secret Private
Confidential Sensitive
Store, Retrieve, Transport, and Dispose of Confidential Information
•
Confidential information assets are vulnerable during storage, retrieval and transport and must be disposed of
properly.
Handling Confidential Information
Data banks
Need procedures
to prevent access Disposal of media previously used to hold confidential information
to, or loss of, Controls required
sensitive for Management of equipment sent for offsite maintenance
information and Public agencies and organizations concerned with sensitive, critical
software or confidential information
Storage records
Destruction of Confidential Data
Physical Destruction
Document Destruction
Data Encryption and Encryption-Related Techniques
Encryption
•
One of the best ways to protect the confidentiality of information is through the use of encryption
•
•
•
•
•
• •
•
•
•
•
• •
•
Symmetric vs. Asymmetric Encryption
• •
• •
•
•
Symmetric vs. Asymmetric Keys compared
Symmetric keys are faster and stronger than asymmetric Asymmetric keys are slower and weaker than symmetric
keys of comparable length. keys of comparable length.
The keys have to be shared confidentially. Common means Since two different keys are used and the public key is
of communication, like email, cannot be employed. known to all, the question of sharing the key does not arise.
It requires no other infrastructure to support them. It requires PKI (public key infrastructure) to support them.
Symmetric Ciphers
RSA DH ECC
Let’s say Alex wishes to send a message to Bob. It would On receiving the digital envelope, Bob would obtain the
be quicker and more efficient to use symmetric symmetric key by decrypting the encrypted key with his
encryption rather than asymmetric encryption (digital private key (which only he has). Once he has obtained the
signatures) if Alex could convey the symmetric key to Bob symmetric key, he would decrypt the encrypted message.
without the risk of compromise. There is no chance of compromise as an attacker cannot
obtain the value of the symmetric key without Bob’s private
key.
Instead, Alex could encrypt the message with a symmetric key and then
encrypt the symmetric key with Bob’s public key (asymmetric
encryption) and send both the encrypted message (which has been
encrypted with a symmetric key) and the encrypted (with Bob’s public
key) symmetric key to Bob. These together constitute a digital envelope.
Network Infrastructure Security: Encryption
● Both share the same key ● Two separate keys: a public and a private key
● Much faster ● Typically slower
● As secure with a smaller key ● Examples:
● Examples: RSA, ElGamal Encryption, ECC
DES, IDEA, RC5, AES, Serpent, GOST, Blowfish
Hardware, System Software, and DBMS
•
Hardware issues
User
Login Management
Authentication
Configuration
Patch
Inherent OS Security Management
Hardening
Hardware
Access
Rogue Devices
Database Activity Monitoring
It is monitoring and
analyzing database activity
that operates
independently of the
database management
system (DBMS) and does
not rely on any form of
Database activity
native (DBMS-resident)
monitoring and prevention
auditing or native logs
Database Activity (DAMP) is an extension to
such as trace or
Monitoring DAM that goes beyond
transaction logs. DAM is
monitoring and alerting to
typically performed
also block unauthorized
continuously and in
activities.
real-time.
Public Key Infrastructure (PKI)
PKI and Digital Signatures
•
Encryption is the process of converting a plaintext message into a secure coded form of text called cipher
text, which cannot be understood without converting it back via decryption (the reverse process) to
plaintext. PKI involves the distribution of asymmetric keys.
Digital Signatures
Public Key Infrastructure (PKI) is a framework a trusted party uses to issue, maintain, and revoke public key certificates.
• PKI (Public Key Infrastructure) uses asymmetric key pairs and combines software, encryption, and
services to provide a means of protecting security of business communication and transactions.
• PKCS (Public Key Cryptography Standards) was put in place by RSA to ensure uniform Certificate
management throughout the Internet.
• CRL (Certificate Revocation List) is a list of certificates issued by a CA that are no longer valid. CRLs
are distributed in two main ways: PUSH model: CA automatically sends the CRL out a regular
intervals and Pull model: The CRL is downloaded from the CA by those who want to see it to verify
a certificate. End user is responsible.
X.509 Certificates
Version
Serial number
All of these communication technologies can be a definite improvement for corporate communications, but
they also have risks.
Peer-to-peer Computing
In Peer-to-peer Computing there is no specific server is required to connect. The connection is between two peers.
The risk involved are:
Copyright Data
Malware
Issues Leakage
Social Networking Sites
It offers advantages
Cloud computing
over in-house
services are usually
computing resources in
delivered on virtual
terms of hardware
machines. This
acquisition; installation
enables the service
of software, power, and
provider to optimize
environmental controls;
the hardware
considerable
resources by running
expenditure; etc.
multiple operating
However, it also comes
systems and
with associated risks,
applications on each
which have to
server.
considered.
Cloud Computing
The following are the popular models of cloud computing services:
Virtualization provides an organization with a significant opportunity to increase efficiency and decrease
costs of its IT operations.
Virtualization
•Virtualization is a means by which a single hardware device or server can host multiple operating system environments, which
in turn provide a platform for multiple applications. This facilitates an efficient use of hardware resources.
•A virtual machine or guest is a virtual instance of an operating system that operates in an environment provided by the host.
•Computer resources such as RAM, processor time, and storage are emulated through the host environment.
•Guest systems do not interact directly with these resources but through a layer called hypervisor in the host environment.
Guest
Misconfiguration Rootkits operating
of the Host systems
access
Virtual Machine
Cloud
Virtual Machines
Virtual Machine (VM)
• It is an operating system
Virtualization that is implemented in a
virtual environment.
• It enables a single hardware A • It is also referred to as a
device, like a server, to , operating in the
support multiple operating environment of the .
systems, each of which can,
in turn, support a different
application B Hypervisor
• By enabling multiple
operating systems to • To implement a virtual environment,
function from a single a hypervisor is installed on the top of
server, virtualization the hardware.
enhances server • It provides a layer of abstraction
optimization. between the host environment and
the guest operating systems.
C • The host environment emulates
computer resources (like memory,
processor, storage, etc.) to each VM.
• The hypervisor interacts with the
underlying hardware to create
multiple instances of virtual
machines, each of which can support
an operating system and application.
Types of Virtualization
Virtual storage
Hypervisor The virtual servers are hosted on one
The hypervisor mechanism is the or more actual/physical servers. The
process that provides the virtual hard drive space and RAM of those
servers with access to resources. physical servers are partitioned for the
various virtual servers’ usage.
Voice Communications Security
•
The increasing complexity and convergence of voice and data communications introduces additional risks
that must be taken into account by the IS auditor.
Voice-over IP
Controls for securing VoIP are security mechanisms such as those deployed in data networks (e.g., firewalls,
encryption) to emulate the security level currently used by PSTN network users.
Private Branch Exchange (PBX)
PBX is a sophisticated computer-based phone system from the early 1920s. Originally analog, it is now
digital. The principal purpose was to save the cost of providing each person with a line. Attributes include:
Non-blocking
Digital phones for
Multiple telephone Switching calls configuration that Operator console
both voice and
lines within PBX allows or switchboard
data
simultaneous calls
Private Branch Exchange (PBX)
1 Theft of Service
2 Denial of Service
3 Information Disclosure
Mobile, Wireless, and Internet of Things (IoT) Devices
Mobile, Wireless, and IoT devices
•
Portable and wireless devices present a new threat to an organization's information assets and must be
properly controlled.
Internet of Things (IoT) are nonstandard computing devices that connect wirelessly to a network and have
the ability to transmit data.
Controls and Risks Associated with the Use of Mobile and Wireless Devices
Information
Device Theft Malware
Compromise
Laptop Security
1 Limit Access
2 Minimum Requirements
3 Sheep dip
Risks Associated with IoT Devices
Security depends on the participation of all members of an organization. Therefore, ensuring that the entire
staff is aware of security issues is important. This is something that should be checked in an IS audit.
Awareness and Education
Fraud is a significant threat to any organization. There are always new scams being used by criminals. IS audits
should review the IS controls regarding fraud.
Email Fraud
Virus/Worm
Trojan Horse
Logic Bomb
Spyware
Malware
• A logic bomb is a malware that is • This is a malware that covertly • It generates advertisements based
triggered when a certain condition collects sensitive information on the user’s browsing habits.
occurs, such as a particular date or about victims, such as their • It is not malicious in nature but
time. browsing habits. has implications relating to privacy
• It can be used to install malware, and security.
change system settings, log
keystrokes, etc.
General Attacks
Denial of Service
Cross-Site Scripting
Web Attacks
These tools permit identification of real-time risks to an information processing environment and corrective
actions taken to mitigate these risks.
Security Testing Techniques
Vulnerability Scanners
Patch management
Discovery /
Planning Attack Reporting
Reconnaissance
Discovery /
Planning Attack Reporting
Reconnaissance
• Internet footprinting
• OS detection
• Network mapping
• WHOIS lookups
• Domain name searches
• Social engineering
• Dumpster diving
Pen Testing Phases
Discovery /
Planning Attack Reporting
Reconnaissance
• Injection attacks
• OS exploits
• Network exploits
• Privilege escalation
• Internet service exploits
Pen Testing Phases
Discovery /
Planning Attack Reporting
Reconnaissance
The ability to detect a security breach is critical for IS. Therefore, detection tools and techniques are an
important part of any IS audit.
Virus Detection Tools and Control Techniques
File Hash
IDS
Tripwire
Log Review
Server Log
Firewall Log
Router Log
Incident Response Management
Incident Response Management
•
Incident response management enables organizations to detect incidents promptly and respond appropriately.
This allows them to mitigate the damage and reduce the delays and costs that come with disruptions.
IS auditor should validate the incident response plan and ensure that the CSIRT is capable to handle and
prevent security incidents.
Incident Response Management Phases
Planning and
Detection Initiation Recording Evaluation
preparation
Post-incident
Closure Reporting Lessons learned
review
Evidence Collection and Forensics
Forensics
•
Incident response can lead to at least a basic forensic examination. It is also the case that the first responders
to computer crimes are often IT personnel. For this reason, forensic procedures are important to IS and to IS
Audits.
Forensics Process
Preparation Collection
Reporting Analysis
Evidence Preservation Techniques
a. Security administrator
c. Management
a. Security administrator
c. Management
Explanation: The server and system security should be defined to allow only authorized staff members
access to information about the staff whose records they handle on a day-to-day basis.
QUIZ
An organization is proposing the installation of a single sign-on facility, giving access to all
3 systems. The organization should be aware that _____.
Explanation: If a password is disclosed when single sign-on is enabled, there is a risk that unauthorized
access to all systems will be possible. User access rights should remain unchanged by a single sign-on, as
additional security parameters are not implemented necessarily.
QUIZ
When installing an intrusion detection system (IDS), which of the following is MOST
4 important?
Explanation: Proper location of an IDS in the network is the most important decision during installation. A
poorly located IDS could leave key areas of the network unprotected.
Protection of Information Assets
Case Study
Case Study
An IS auditor is auditing a medical billing company. The company services over 100 clinics consisting of over 1200 doctors
and 100,000 patients. The company stores medical billing data in a server cluster. That cluster is located in a secure
building that includes physical security measures such as camera surveillance, biometric entry to the building and the
server room, and round-the-clock security guards. The databases are patched and updated regularly. The network access
to the data servers is protected by a firewall/DMZ combination and an IDS is run. Users who access the databases need a
password and digital signature.
QUIZ
The auditor wants to confirm the security of the cryptography used with the
1 digital signatures. Which of the following is the most important to check?
a. PCI
b. Sarbanes-Oxley
c. FISMA
d. HIPAA
QUIZ
When considering the data on servers, which law or regulation would be the
2 most important to review?
a. PCI
b. Sarbanes-Oxley
c. FISMA
d. HIPAA
HIPAA specifically addresses privacy and security of health care records. PCI is applicable to credit card
data, Sarbanes Oxley to electronic records and publically traded companies, and FISMA relates to security
standards for US Federal agencies.
Key Takeaways
You are now able to:
Conduct audit in accordance with IS audit standards and a risk‐based IS audit strategy
Evaluate the organization's information security and privacy policies and practices
Evaluate data classification practices for alignment with the organization’s policies and
applicable external requirements
Evaluate policies and practices related to asset lifecycle management
Evaluate the information security program to determine its effectiveness and alignment with
the organization’s strategies and objectives
Perform technical security testing to identify potential threats and vulnerabilities
Evaluate potential opportunities and threats associated with emerging technologies, regulations,
and industry practices
THANK YOU