CA Inter EIS (Chapter-3)
CA Inter EIS (Chapter-3)
Data
Information
Processed form of data. Organization collects data from both internal &
external sources & after processing, it becomes information.
System
INFORMATION SYSTEM
Meaning
Mechanism which takes input (data), processes it & converts into output
(information) & has a feedback mechanism to control the entire operation.
Function
- Input
- Processing
- Output
- Feedback & Control
Components / Resources
- People
- Hardware Computer
- Software System
- Data
- Network
1. People
2. Computer System
Hardware
- Input Devices
- Processing Devices
- Storage Devices
- Output Devices
Software
a. Operating System
b. Application Software
3. Data
• Database
• DBMS
• Database Models
4. Network
COMPONENT - HARDWARE
Tangible portion of computer system which can be seen touched & have
weight.
Input Device
Processing Device
Memory where data & programs are stored temporary basis or permanent
basis.
Types
- Internal Memory
a. Processor Registers
b. Cache Memory
- Primary Main Memory
a. RAM
b. ROM
- Secondary Memory
- Virtual Memory
• Output Devices
Devices through which computer system responds & shows the result of
task given to computer for executions. Like printer, monitor, speaker,
projector etc. Output can be:
- Textual Output
- Graphical Output
- Tactile Output
- Audio Output
- Video Output
(b) Primary/ Main Memory - Memory which are directly & quickly accessed by
CPU.
• Random Access Memory (RAM) - Volatile & stores data, file, program &
software currently used by computer.
• Read Only Memory (ROM) - Non-volatile & storing basic codes &
instructions for initial booting of computer.
(c) Secondary Memory - Non-volatile high capacity memory that stored data &
program on permanent basis. It is slow & cheaper memory. Like CD, DVD, Pen
Drive, Hard Disk etc.
Meaning
Application Software
Software that performs the task beyond the running of the computer itself.
Through it, user can perform multiple tasks. Examples:
- MS Office
- Accounting Software
- ERP Software
- CBS Software
Operating System Software
Introduction
Organization generates & collects huge quantity of different types of data like
production related data, HR related data, Marketing Related Data etc. These
data are stored in Databases.
Database
- Meaning
Organized collection of related data where all data stored are related to
each other. Hence to manage unrelated data, separate databases are
created.
- DBMS
DBMS
• Operations Performed
- Adding new file
- Deleting existing file
- Inserting data in existing file
- Modifying data in existing file
- Deleting data from existing file
- Retrieving data from existing file
• Data Evolution Hierarchy
- Database
- Files
- Record
- Field
- Character/Byte
- Bits
• Types
- Enterprise Level
Oracle Database
DB2
SQL etc.
- Personal Usages
Microsoft Access
Open Office Base
• Models
- Hierarchical
- Network
- Relational
- Object Oriented
• Advantages
- Permits data sharing
- User friendly
- Improved security
- Minimizes data redundancy
- Achieving program/data independence
- Faster application development
• Disadvantage
- Cost
- Security
DATABASE MODEL
Meaning
It determines the logical structure database & manner in which data can be
stored, organized & retrieved.
- Network
It views all records in set where each set is composed of one owner
record & one or more-member record. Here a record can be a member
of more than one set at the same time. This model implements many to
one & many to many relationships also, Here data search is fast.
- Relational
- Object Oriented
All data are modeled & created as objects where each object is an
independently functioning unit. Objects are organized by grouping them in
class & sub-class. This model is mainly used to store complex data like
images, audio, video etc.
• Meaning
- Telecommunication Refers to exchange of data & information over the
computer network.
- Computer Network refers to collection of computers, server & other
networking devices (router, switch etc.) connected to each other.
• Types
- Connection Oriented - First connection is established then data are
exchanged. Like circuit switching.
- Connection Less - No prior connection is established & data to be
exchanged contains the complete information (IP Address) of the
sender & recipient. E.g. pocket switching
• Terms Used
- Routing - Process of determining how to communicate data from
source to destination.
- Bandwidth - Quantity of data that can be transmitted in a given time
like second. E.g. MBPS, GBPS etc.
- Resilience - Ability of the computer network to recover from any kind
of error like connection failure, data loss etc.
- Contention - Situation where there arises some conflict for some
common resource in a network.
• Benefits
- Distributed nature of information
- Resource sharing
- User communication
- Computational power
- Reliability
- Asset safeguarding
- Data integrity
- System effectiveness
- System efficiency
• Need
- Organizational cost of data loss
- Cost of incorrect decision making
- Cost of computer abuse
- High cost of computer error
- Maintenance of privacy
- Value of hardware, software
• Tools
1. Today organization produces data on real- time basis & hence there is a
need of continuous auditing tools. It enables auditors to significantly
reduce or eliminate the time between occurrence of event & its auditing.
2. Types of Tools
Snapshot
Audit Hooks
There are codes which are embedded in the application that enables
auditors to flag transactions which he thinks are suspicious are report
such transactions to the auditor.
1. Objectives of Controls
2. Nature of IS Resources
3. Audit Function
• Preventive Controls
- Employing Qualified Personnel
- Segregation of Duties (SOD)
- Access Control
- Authorization of transactions
- Validation of transactions
- Edit Checks in applications
- Firewalls, Antivirus Software
- Login ID, Password
• Detective Controls
- Internal audit system
- Intrusion Detection system
- Budgeting & Maintaing actual expenditure against budgets
- Bank Reconciliation system
- Check points in production system
- Rechecking of calculations
- Echo control in telecommunication
- Hash Totals
• Corrective Controls
- Business continuity plan (BCP)
- Contingency planning
- Backup procedures
- Rerun procedures
- Variance Analysis
- Submitting connective journal entries after discovering errors
• Environmental Controls
- Fire / Explosion Damage
- Power Spike / Electrical Exposure
- Water Damage
- Pollution Damage & Others
• Physical Access/Security Controls
- Lock on Doors
Cipher Locks
Bolting Door Locks
Electronic Door Locks
- Physical Identification Medium
Plastic Cards
Personal Identification Number
Identification Badge
- Logging on Facilities
Manual Logging
Electronic Logging
- Other Means
Video Camera
Security Guard
Controlled Visitor Access
Bonded Personnel
Dead Man Doors
Non-Exposure of Sensitive Facilities
Controlled Single Entry Point
Computer Technical Lock
Control of Out of Hours of Employees
Perimeter Fencing
Secured Distributor Carts
Alarm System
• Logical Access Controls
o Data Diddling
o Bomb/Logic Bombs
o Christmas card
o Worms
o Rounding Down
o Salami Technique
o Trap Doors/Back Doors
o Spoofing
2. Asynchronous Attacks
o Data Leakage
o Wire Tapping
o Piggy Backing
o Subversive Attacks
- User Responsibilities
- Privilege Management
- User password Management
- Review of user access rights
C. User Registration
- Password use
- Unattended User Equipment
• Managerial Controls
- Planning
- Organizing
- Leading
- Controlling
- Planning
- Control
- Design
- Coding
- Testing
- Operation & Maintenance
- Computer Operations
- Network Operations
- Data Preparation & Entry
- File Library
- Documentation & Program Library
- Help Desk/Technical Support
- Management of Outsourced Operations
A. Boundary Controls
- Cryptography
- Password
- Personal Identification Number
- Identification card
- Biometric Devices
B. Input Controls
C. Communication Controls
D. Output Controls
E. Database Controls
(i) Update Controls
- Standing Data
- Run to Run Control Totals
- Print Suspense Account Entries
- Existence/Recovery Controls
F. Processing Controls
- Processor Controls
- Real Memory Controls
- Virtual Memory Controls
- Data Processing Controls
Managerial Controls: Controls over managerial functions to ensure that
the development, implementation, operation and maintenance of
information system should be in the planned and controlled manner
Managerial Controls: Controls to ensure that data remains, complete,
accurate and valid during its input, processing, storage, communication
etc.
• Environmental Controls
- Power Conditioning
- Back-up power
- HVAC
- Water Detection
- Fire detection
- Cleanliness
• Physical Access Controls
A. Boundary Controls
Maintains chronology of events from the time data entered till it is deemed
valid & passed for processing.
C. Database Controls
D. Processing Controls
Maintains chronology of events from the time data received from input or
communication system to data dispatched to database, communication or
output system.
E. Communication Controls
F. Output Controls
• Meaning
Also known as separation of duties, it ensures single individuals do not
possess excess privileges that may result in unauthorized activities like
manipulation of sensitive data or fraud.
• SOD Controls
- Transaction Authorization
- Split custody of high-value assets
- Workflow
- Periodic reviews
• Mitigating SOD Issue
- Reduce access privileges
- Introduce a new mitigating control
- Increased logging requirements
- Improved exception reporting
- Reconciliations of data sets
- External reviews
AUDIT TRAIL
Logs that can be designed to record activity at the system, application, and user
level. When properly implemented, audit trails act as an important detective
control.
- Accounting Audit Trail shows the source & nature of data and processes
that update database.
- Operations Audit Trail maintains a record of resource consumption within
system.
• Need
- Fulfill statutory requirements
- Detect causes & consequences of error
- Answer queries
- Overall system monitoring
• Objectives
- Detecting Unauthorized Access
- Reconstructing Events
- Personal Accountability
• Generating Audit Logs
- Owner
- Executive management
- Manager
- User
- Recruiting
- Compensation base lining
- Career advancement
A. Executive Management
- CTO
- CSO
- CISC
- CPO
B. Software Development
- Systems Architect
- Systems Analyst
- Software Developers
- Software Tester
C. Data Management
- Database Architect
- Database Administrator
- Database Analyst
D. General Operations
- Operators Manager
- Operators Analyst
- Control Analyst
- Systems Operator
- Data Entry
- Media Librarian
E. Service Desk
- Help Desk Analyst
- Technical Support Analysts
F. Network Management
- Network Architect
- Network Engineer
- Network Administrator
- Telecom Engineer
G. Security Operations
- Security Architect
- Security Engineer
- Security Analyst
- User Account Management
- Security Auditor
H. System Management
- Systems Architect
- Systems Engineer
- Storage Engineer
- Systems Administrator