IT Security System Audits Ch.5

Control recommendations

Consider controls to reduce the level of risk to an acceptable level.

Risk determination

Consider the likelihood, magnitude of impact, and adequacy of controls as an equation of risk.

System characterization

Identify and understand the systems and their operating environment.

Vulnerability identification

Identify flaws or weaknesses that can be triggered or exploited, which might result in a breach.

Threat identification

Identify potential methods or situations that could exploit a weakness.

Medium

Some history of the threat, and the threat might occur

threat actions

methods that may be utilized to carry out an attack.

Preventive controls

stop a particular threat in the first place

audit objective

the goal of the audit

threat identification

the identification of all possible threats

scope creep

the plans or goals expand beyond what was originally intended.

An IT audit doesn't just assess adherence to the security policy; it also uncovers situations in which the policy needs to be refined

true

Before an evaluation of controls can begin, the auditor must first identify the critical controls. To do so, the auditor must consider the audit scope and objective along with the risk assessment. Documentation and any preliminary interviews also help to identify the requirements.

true

Combined with Risk IT and another framework, Val IT, COBIT 5 provides a framework of controls to minimize as well as manage risk.

true

Defining scope requires consideration of the personnel, systems, and records relevant to the objective.

true

Depending on the risk, the frequency of audits varies

true

Documentation related to business structure, configuration, and even previous audits should be gathered and reviewed prior to an audit

true

During integrated audits, financial controls are the focus

true

Privacy audits go beyond traditional IT audits in that the entire information lifecycle process needs to be considered.

true

Project management requires the management of three competing needs to achieve the project objectives. Known as the triple constraint, these include scope, cost, and time.

true

The risk assessment will influence the critical requirements for an IT audit

true

Two major factors contributing to interrelation of security and privacy are regulatory issues and the rapid growth and widespread use of the Web

true

Threat classifications

• Adversarial • Accidental • Structural • Environmental

reactive or corrective control

can lessen the effects of a threat

The audit plan should be prepared only after a ____ __________ is complete.

risk assessment

audit frequency

the rate of occurrence for audits

baseline

the system in a known good state, with the applied minimum controls relative to the accepted risk.

A privacy audit should consider what privacy laws apply to the organization. Auditors should consider who has responsibility for , privacy within the organization, and the policies and procedures specific to privacy should be examined.

true

An alternative approach is to analyze impact and likelihood quantitatively. Such matrixes might use percentage values or a numerical count instead of defining what is high versus medium.

true

An audit is a project

true

An example of an IT risk framework compatible with ERM is ISACA's Risk IT.

true

An organization's written policies are among the most important documents for an auditor. They provide a guideline from which to check the environment for gaps.

true

Antivirus software is a common control that spans all three controls. It can prevent a system from getting a virus in the first place. It can detect if a virus is on the system. Finally, it can react and correct the situation by removing or quarantining the virus.

true

Assessing IT security is largely about ensuring that adequate controls are in place.

true

Auditing IT infrastructure for compliance incorporates the evaluation of various types of controls.

true

Auditors should be familiar with the Project Management Institute (PMI), which has created a standard named A Guide to the Project Management Body of Knowledge (PMBOK). This guide provides a well-known and applied framework for managing successful projects.

true

Audits can occur on an annual basis or every two or three years, depending on regulatory requirements and the determined risk.

true

Baselines provide a solid and simple method from which to audit a system. Comparing a system against a baseline can help identify nonexistent controls that should be applied as well as controls that have been removed or disabled.

true

Ways to identify vulnerabilities

• Vulnerability lists and databases published by industry organizations • Security advisories • Software and security analysis using automated tools

Privacy audits address the following three concerns:

• What type of personal information is processed and stored? • Where is it stored? • How is it managed?

Project characteristics

A project is temporary A project is unique and produces unique results A project is progressively elaborated

vulnerability

A weakness

Control analysis

Analyze controls to reduce the likelihood of a threat successfully exploiting a vulnerability

Impact analysis

Determine the impact of a successful attack on a vulnerability by a threat. Consider the mission of a system, data criticality, and data sensitivity

Likelihood determination

Determine the likelihood of an attack by considering the motivation and capability of the threat source along with the nature of the vulnerability in relation to the current controls.

Results documentation

Document for management the observations on threats and vulnerabilities as well as risks overall and recommended controls.

Guidance for privacy audits established by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA).

Generally Accepted Privacy Principles (GAPP)

Low

No previous history of the threat, and the threat is not likely to occur

High

Substantial history of the threat, and the threat is likely to occur

NIST 800- 30, "Risk Management Guide for Information Technology Systems," 9 step risk assessment process

System characterization Threat identification Vulnerability identification Control analysis Likelihood determination Impact analysis Risk determination Control recommendations Results documentation

Technical controls

These include controls that are performed by the IT systems. Examples include the following: • Identification and authorization • Logical access control • Audit trails • Cryptography

chief privacy officer (CPO)

a senior-level position responsible for the overall management of an organization's privacy program

ISACA definition of privacy within the context of information systems

adherence to trust and obligation in relation to any information relating to an identified or identifiable individual (data subject). Management is responsible to comply with privacy in accordance with its privacy policy or applicable privacy laws and regulations.

General controls

also known as infrastructure controls. These types of controls apply broadly to all system components across an organization

threat

any activity that represents a possible danger

Application controls

apply to individual application systems.

Risk IT provides a comprehensive framework not just for assessing risk, but also for

governance and response

detective control

identifies that a threat is present.

vulnerability analysis

identifying vulnerabilities that can be exploited by the previously identified threats

Application control types

include various transaction controls, such as input, processing, and output controls.

high-level classification of controls for IT systems

includes general and application controls.

audit scope

includes the area or areas to be reviewed as well as the time period.

Reducing operational surprises and losses

This enhances the organization's ability to identify potential events or threats and react appropriately.

Identifying and managing multiple and cross-enterprise risks

This helps the organization to consider related risks from across the organization and provides a unified response across the varying risks.

Aligning risk appetite and strategy

This helps the organization to manage the uncertainty with consideration of the goals of the organization.

Seizing opportunities

This helps the organization to recognize events from which new opportunities can be pursued.

Improving deployment of capital

This improves how organizations divide their financial resources to enhance performance and profitability.

Enhancing risk response decisions

This improves the organization's ability to make decisions about how to better manage risk.

Operational controls

These include controls that are implemented by people rather than systems. These controls are often interrelated with both management and technical controls. Examples include the following: • Personnel and user issues • Contingency and disaster planning • Incident response and handling • Awareness, training, and education • Computer support and operations • Physical and environmental security

Management controls

These include controls typically governed by management as part of the overall security program. Examples include the following: • Security policy • Security program management • Risk management • Security and planning in the system development life cycle • Assurance

Effective risk management starts with identifying the IT assets and their value. Next, organizations need to identify the threats and vulnerabilities to these assets. . Next, organizations need to identify the likelihood each threat will exploit a vulnerability. Finally, organizations need to consider the impact of the risk. Risks should then be prioritized. This enables organizations to give attention to the most severe.

true

For the audit to be effective, the scope must consider the objectives of the audit.

true

General knowledge about the business can be gained by gathering information on business and reporting cycles, key business processes, and key personnel to interview.

true

How well an organization adheres to its own policy when combined with an assessment risk helps to identify any gaps

true

IT audits also are known for not following a predefined frequency, but instead using a continuous risk-assessment process. This is more appropriate given the fast-paced change in technology as well as the threats and vulnerabilities related to IT.

true

IT organizations today are concerned with controls relating to both security and privacy.

true

In addition to providing guidelines for information security risk management, this ISO standard also supports the concepts within ISO/IEC 27001.

true

Managing and understanding risk is a key operating component of any organization

true

Projects require someone to manage them. This position is often given the title of project manager. Large projects and even audits might have a dedicated project manager. Other times, the person managing the project might be the project expert.

true

Risk management provides a method for dealing with the uncertainty. This includes identifying which ones to accept and which ones to control.

true

Strategic objectives of an organization reveal details about the organization in the future and how this will affect its information systems. In addition, information about the operational objectives for internal control provides relevant information with regard to the current state of the organization.

true

The scope, objectives, goals, and frequency of audits are based on a risk assessment.

true

The threats that are more difficult to identify are those that pertain specifically to the organization

true

Threats are matched with existing vulnerabilities to further understand the risk.

true

Three IT security controls covered by the National Institute of Standards and Technology (NIST) include management, operational, and technical controls

true

Time is another consideration dependent upon the objective. The depth and breadth of an audit usually determines the time frame required to meet the objectives.

true

Understanding control classifications provides auditors with a foundation to identify and assess critical controls.

true

When defining the scope, the auditor should consider the controls and processes across the seven domains of IT infrastructure. This includes relevant resources such as the following: • Data • Applications • Technology • Facilities • Personnel

true

audits specific to IT processes may focus on governance and software development.

true

due to recent legislation regarding the need to protect personally identifiable information, audits specific to privacy are more commonplace than before.

true

information security policies are living documents.

true

infrastructure audits are conducted for compliance

true

matrixes and other mechanisms are useful for qualitatively understanding risk.

true

risk management needs to be a key part of organizations and any audit.

true

scope and objective are closely related.

true

further documentation that may be needed for an audit

• Administrative documentation • System documentation • Procedural documentation • Network architecture diagrams • Vendor support access documents and agreements

enterprise risk management (ERM) components

• Aligning risk appetite and strategy • Enhancing risk response decisions • Reducing operational surprises and losses • Identifying and managing multiple and cross-enterprise risks • Seizing opportunities • Improving deployment of capital

information the auditor needs before performing an audit

• An understanding of the organization and what its business requirements and goals are • Knowledge of how the security program is currently in place • Industry best practices for the type of organization and systems

restrictions that an organization may place on an auditor

• Not providing enough resources • Limiting the time frame • Preventing the discovery of audit evidence • Restricting audit procedures • Withholding relevant historical records or information about past incidents

risk determination functions

• The likelihood of a threat to exploit a given vulnerability • The impact on the organization if that threat against the vulnerability is achieved • The sufficiency of controls to either eliminate or reduce the risk