AFM 341 - Final

IT operations

Activities that protect organizations from threats to the confidentiality, integrity, and availability of information systems

Specific IT operations include…

• Data input/output and processing (integrity)

• Data backups (availability)

• Hardware lifecycle management (availability)

• IT service desk management (integrity & availability)

Who is responsible for IT operations?

• Help desk

• Facilities management

• Systems developers

• Information security

• Human resources

IT operation controls are spread out in…

Departments and IT sub-units

6 Physical threats to IT operations

1. Natural

2. Man-made

3. Political events

4. Public heath

5. System/technical

6. Supply systems

No More PP SS

Physical controls vs Logical controls

1. Physical: concerned with the physical protection of people, equipment and data

2. Logical: concerned with the technical (e.g. software) protection of people, equipment and data

Physical control categories (3 buckets)

1. Disaster recovery and business continuity

2. Environmental controls

3. Physical access control

Examples of physical controls

Fire suppression, back-up power, HVAC

BCP

Business Continuity Planning

What is a BCP?

A document describing how an organization will respond to an event, to ensure key activities continue with little delay/change

DRP

Disaster Recovery Plan

What is a DRP?

Document with steps to respond to a disaster by resuming critical functions, minimizing loss, and repairing/replacing data processing facilities

BCP vs. DRP

BCP → everyday issues

DRP → big and bad issues

BCP/DRP Components (only need to know 3)

1. Team Members

2. Emergency procedures

3. Alternative sites

TEA

Data centre recovery options

1. Mirror site → exact replica w/ live data

2. Hot site → everything, no data

3. Warm site → hot site without expensive equipment

4. Cold site → physical space for a data centre, no equipment

^ Most to least expensive

Primary goal of an AIS

Control the organization so it can achieve its objectives

Internal controls

1. Preventive

2. Detective

3. Corrective/responsive

IT Standards vs. IT Framework

Standard → rules that must be adhered to

Framework → guidelines to refer to

What is COBIT?

• IT framework

• Published by ISACA

• Audit (risk, governance, control)

How is COBIT structured?

• 5 domains (ABDM E), containing 40 processes

Management objectives

1. Align, Plan & Organize

2. Build, Acquire & Implement

3. Deliver, Service & Support

4. Monitor, Evaluate & Assess

Governance objectives

5. Evaluate, direct & monitor

RACI matrix

Who is…

• Responsible?

• Accountable?

• Consulted?

• Informed?

COBIT benefits

1. End to end coverage of the firm

2. Applying a single, integrated framework

3. A holistic approach

COBIT downsides

1. Complex (300+ pages)

2. Constraining

3. Costly

SOC reports

System and Organization Controls

What is an SOC report?

Reports controls of an org (how well they protect the confidentiality, integrity and information of data/info).

Timing of SOC

Type 1 (point in time)

Type 2 (period of time)

4 kinds of SOC reports

• SOC 1 → controls related to F/S (restricted)

• SOC 2 → controls related to 5 trust service principles (restricted)

• SOC 3 → controls related to 5 trust service principles (general, public use)

• SOC for cybersecurity

5 trust service principles

1. Security

2. Availability

3. Processing integrity

4. Confidentiality

5. Privacy

SAP CP

Definitions - what is risk?

1. Dictionary

2. COSO

3. ISO

Risk impedes us from meeting 4 objectives

1. Strategic

2. Operations

3. Reporting

4. Compliance

SORC

Risk management framework

1. Frame (at the centre)

2. Assess

3. Respond → pick a risk response

4. Monitor

FARM

Risk is assessed from 2 perspectives

1. Likelihood

2. Impact

** Measured from 1-5 (1 is low, 5 is high)

Types of risk

1. Inherent → risk before controls

2. Residual → risk left after controls

Different responses to risk

1. Reduce

2. Accept

3. Share

4. Avoid

RASA

Types of specific IT controls

1. Business cycle controls (BCC)

2. General computer controls (GCC)

BCC examples

1. Duty segregation and access restriction

2. System-verified three-way match

3. Automated approval thresholds

GCC examples

1. Formal policies

2. Documented plans

3. Passwords, firewalls, anti-virus, encryption

How do we document IT controls (BCC and GCC)?

1. Narratives

2. Flowcharts

What is audit?

Using evidence to test if assertions on economic actions and events align with criteria.

Types of IT audits

1. External → for financial controls (F/S)

2. 3rd party → looks at design and operation of controls for a service company

3. Internal → looks at how an information system helps an organization create value (look at risk tolerance)

6 areas of an IT audit

1. Overall Information System Security

2. Program Development and Acquisition

3. Program Modification

4. Computer Processing

5. Source Data

6. Data Files

OPP CSD

Threats and Controls → Overall Information System Security

1. Threat: Theft of hardware

2. Control: Limit physical access to computer equipment

Threats and Controls → Program Development and Acquisition

1. Threat: Unauthorized program code

2. Control: Review software license agreements

Threats and Controls → Program Modification

1. Threat: Inadvertent programming errors

2. Control: Test changes to program

Threats and Controls → Computer processing

1. Threat: Inaccuracies in reporting

2. Control: Understandable documentation

Threats and Controls → Source data

1. Threat: Inaccurate source data

2. Control: User authorization of source data input

Threats and Controls → Data files

1. Threat: Destruction of stored data from software malfunctions

2. Control: Logical access controls

When do different IT audits happen?

1. External audit → before financial audit activities

2. 3rd party audit → at a point in time or period of time

3. Internal audit → any time

Designing IT tests

1. Objective

2. Activity

3. Test