Becker - ISC S2 Flashcards

IT Infrastructure

Multiple, interconnected technological components involving a combination of on-premises/outsourced hardware, software, and specialized personnel

SOC 2 Engagement

Examinations in which a third-party evaluates and reports on a service organization’s system controls as it relates to the AICPA’s five Trust Services Criteria:

1. Security

2. Availability

3. Processing Integrity

4. Confidentiality

5. Privacy

Typically involves companies that manage the IT function of other organizations as their primary business

Hardware

Includes computers, the physical components that comprise computers, computer-related equipment, and external peripheral devices

End-User Devices (EUDs)

Electronic machines, typically computers or mini-computers, that directly interact with employees or consumers at the “edge” of a network, meaning they are the point in a chain of applications or an organization’s IT architecture that interfaces with a human

Examples include company-issued laptops, desktops, tablets, and other wearables (like an Apple Watch)

Network Infrastructure

Refers to the hardware, software, layout, and topology of network resources that enables connectivity and communication between devices on a computer network

Modem

Connects a network to an internet service provider’s network, usually through a cable connection

The device that brings internet into a home or office

Receives analog signals from the internet service provider and translates those signals into digital signals

Each one has a public IP address

Routers

Manage network traffic by connecting devices to form a network

Read the source and destination fields in information packet headers to determine the most efficient path through the network for the packet to travel

Act as a link between a modem and the organization’s switches

Switches

Similar to routers in that they connect and divide devices within a computer network

Do not perform as many advanced functions as a router, such as assigning IP addresses

Gateway

A computer or device that acts as an intermediary between different networks

Transforms data from one protocol into another so that information can flow between networks

Interprets differing protocols and converts them into the appropriate format to facilitate network movement, usually between a company’s network and the internet

Protocol

A rule, or set of rules, that governs the way in which information is transmitted

The type governs the way data is transmitted based on the method used, such as the type of cable, port, or wireless transmission mechanism

Edge-Enabled Devices

Allow computing, storage, and networking functions to be closer to the devices where the data or system request originates, rather than a distant central location

Faster network response times and operability

Servers

Physical or virtual machines that coordinate the computers, programs, and data that are part of the network

Firewalls

Software applications or hardware devices that protect a person’s or a company’s network traffic by filtering it through security protocols with predefined rules

For companies, these rules may be aligned with company policies and access guidelines

Intended to prevent unauthorized access to the organization and prevent employees from downloading malicious programs or accessing restricted sites

Basic Packet-Filtering Firewalls

Work by analyzing network traffic that is transmitted in packets (data communicated) and determine whether that firewall software is configured to accept the data

Circuit-Level Gateways

Verify the source of a packet and meet rules and policies set by the security team

Application-Level Gateways

Inspect the packet itself

Network Address Translation Firewalls

Assign an internal network address to specific, approved external sources so that those sources are approved to be inside the firewall

Stateful Multilayer Inspection Firewalls

Combine packet-filtering and network address translation

Next-Gen Firewalls

Assign different firewall rules to different applications as well as users

A low-threat application has more permissive rules assigned to it while a high-security application may have a highly restrictive ruleset assigned

Topology

Refers to the physical layout equipment, or nodes, in a network, which is essential for understanding how to properly engineer the network for optimal performance

Each one has different requirements for components, such as the length/type of connecting cables, data transmission rate, and physical position of each node in the network

Bus Topology

This topology layout is either in a linear or tree form, with each node connected to a single line or cable

Data can be transmitted by any node on the system at the same time, which can cause signal interference

Cables must be terminated at each end so that signal transmission is optimally managed

Mesh Topology

This topology layout has numerous connections between nodes, with all nodes being connected fully and only some connected partially

Commonly used in wireless networks

Allows high levels of traffic and promotes network stability, but it can be costly to implement and maintain over the network’s life span

Ring Topology

This topology layout has nodes connected in a circular path

When data is transferred to a destination device, it must first go through every other device between the source and the destination first

Unidirectional paths allow data transmission to move in one direction, and multi-directional paths allow it two-way

Star Topology

This topology layout has data passing through a central hub that acts as a switch or server, and then transmits to peripheral devices that act as clients

There can be multiple hubs

This structure makes it easier to identify damaged cables

Open Systems Interconnection (OSI) Model

Helps explain how protocols work and how networking devices communicate with each other

Segregates network functions into seven different layers, with each layer responsible for a specific data exchange function

Data flows through each layer using a process called encapsulation, which adds a header or a footer to the data point received from the previous layer

Application (Layer 7)

This network function layer serves as the interface between applications that a person uses, and the network protocol needed to transmit a message

Examples include HTTP, FTP, and SMTP

Presentation (Layer 6)

This network function layer transforms data received from the application layer into a format that other devices using the OSI model can interpret, such as standard formats for videos, images, and web pages

Encryption also occurs at this layer

Common formats used include ASCII, JPEG, and MPEG

Session (Layer 5)

This network function layer allows sessions between communicating devices to be established and maintained

These allow networking devices to have dialogue with each other

Common protocols at this layer include SQL, RPC, and NFS

Transport (Layer 4)

This network function layer supports and controls the communication connections between devices

It involves setting the rules for how devices are referenced, the amount of data that can be transmitted, validating the data’s integrity, and determining whether data has been lost

Common protocols within this layer include TCP, UDP, TLS, and SSL

Network (Layer 3)

This network function layer adds routing and address headers or footers to the data, such as source and destination IP addresses so that the message reaches the correct devices

It detects errors

Common protocols include IP, IPSec, NAT, and IGMP

Data Link (Layer 2)

This network function layer is where data packets are formatted for transmission

It is determined by the hardware and networking technology, which is usually Ethernet and it adds MAC addresses, which are device identifiers that ensure correct routing

Some of the protocols used include ISDN, PPTP, L2TP, and ARP

Physical (Layer 1)

This network function layer converts the message sent from the data link layer into bits so it can be transmitted to other physical devices

It receives messages from other physical devices and converts those back from bits to a format that can be interpreted by a data link layer

Protocols used include HSSI and SONET

Network Infrastructure Architecture

Refers to the way an organization structures its network from a holistic design standpoint, considering factors such as geographical layout, physical/logical layout, and network protocols used

Local-Area Networks (LAN)

Type of network architecture design that provides network access to a limited geographic area such as a home or single-location office

Wide-Area Networks (WAN)

Type of network architecture design that provides access to a larger geographic area such as cities, regions, or countries

Connect other networks such as LANs together to provide broad coverage

Example is the internet

Software-Defined WAN (SD-WAN)

Type of network architecture design that monitors the performance of WAN connections and manages traffic to optimize connectivity

Control and management are separated from the hardware and included in a software

Virtual Private Network (VPN)

Type of network architecture design that is a virtual connection through a secure channel or tunnel that provides remote and secure access to an existing network

Commonly referred to as RDCs, or remote desktop connections

Software

Consists of the applications, procedures, or programs that provide instructions for a computer to execute

Controlled by a user interacting with the program, which in turn gives instructions to the physical computer’s operating system

Operating System (OS)

Software that orchestrates the global functioning of a group of applications, hardware, and their performance by acting as an intermediary between these resources to allow a user to execute specific tasks

Defines the parameters for managing a system’s memory, processes, records, devices, and user interface

Balances resources and allocates them in a way that allows the system to run seamlessly

Firmware

Software that is locally embedded in hardware instructs the hardware how to operate and is commonly known as this term

Operates like software but exists locally on the machine directing the function of the physical components, such as the motherboard and microprocessor

Not updated frequently, or at all

Mobile Technology

Refers to any wireless-enabled device that is connected, or has the ability to connect, to a private network or the Internet

Allows the user to conduct business and communicate in real time

Combines hardware with mobile applications and operating systems that allow connectivity to networks

Connectively is typically done with wireless technology

Can be EUDs or Non-EUDs

Internet of Things (IoT) Devices

An extension of mobile technology and typically require either a Bluetooth or an internet connection to access a larger network

The mobile range for connectivity is usually more limited than first-generation (traditional) mobile technology

Cloud Computing Model

A computing model that uses shared resources over the internet

Customers rent storage space, processing power, proprietary software, or a combination of the three on remote servers from another company

Infrastructure-as-a-Service (IaaS)

Type of cloud computing model where the CSP provides an entire virtual data center of resources, and organizations can outsource servers, storage, hardware, networking services, and networking components to third-party providers, which is generally billed on a per-use basis

Platform-as-a-Service (PaaS)

Type of cloud computing model where the CSP provides proprietary tools or solutions remotely that are used to fulfill a specific business purpose

Software-as-a-Service (SaaS)

Type of cloud computing model where the CSP provides a business application or software that organizations use to perform specific functions or processes

Customers generally purchase the service through licensing

Public

Type of cloud computing deployment model in which it is owned and managed by a CSP who makes the cloud services available to people or organizations who want to use or purchase them

Private

Type of cloud computing deployment model in which it is created for a single organization and is managed by the organization of a CSP

Hybrid

Type of cloud computing deployment model in which it is comprised of two or more clouds, with at least one being a private cloud, that remain unique cloud entities but with technology in place that facilitates the portability of data and applications between each entity

Community

Type of cloud computing deployment model in which it is shared by multiple organizations to support a common interest, such as companies banding together for regulatory compliance, a common mission, or collaboration with industry peers

Cloud Service Provider (CSP)

A third party that provides cloud computing services such as application delivery, hosting, or monitoring to customers

Cloud Controls Matrix

A framework designed for best practices regarding cloud security, data protection, and compliance in a cloud environment

Enterprise Resource Planning (ERP) Systems

Cross-functional systems that support different business functions and facilitate integration of information across departments such as accounting, customer management, finance, human resources, inventory management, manufacturing, marketing, and vendor management

Accounting Information System (AIS)

System that collects, records, and stores accounting information, and then compiles that information using accounting rules to report both financial and nonfinancial information to decision makers in an enterprise

Transaction Processing System, Financial Reporting System, Management Reporting System (TPS, FRS, MRS)

What are the three main subsystems (or modules) of an AIS?

Automation, Shared Services, Outsourcing, Offshore Operations

What are the four broad areas of process improvements that can enhance AIS performance?

Shared Services

Refer to seeking out redundant services, combining them, and then sharing those services within a group or organization

They almost always involve software that is designed to process large batches of data

Example would be having audit, tax, and consulting groups all roll into the same payroll and HR system

Robotic Process Automation (RPA)

Programs capable of extracting information from a specific user interface that can then initiate further processes based on the data extracted

LiDAR (Light Detection and Ranging)

Involves emitting laser pulses towards a target and measures the time it takes to return to the sensor

Example of how artifical intelligence and machine learning supercharged an old technology to allow it to be successful in the advancement of self-driving cars

Natural Language Processing (NLP) Software

Involves the technlology developed and used to encode, decode, and interpret human languages so that the technology can perform tasks, interact with other humans, or carry out commands on other technology devices

Needed to build a network embedded in household devices or other Internet of Things (IoT) devices

This would include parsing text documents or speeches made by executives to extract and catalog any financially relevant data

Artificial Intelligence (AI)

Umbrella term used to describe systems created to perform complex tasks that typically require human intelligence and judgment

Machine Learning (ML)

A subset of artificial intelligence involving the use of algorithms and data sets supplied for computers to learn and make decisions

Neural Networks

Form of technology that is modeled after neurons that facilitate the function of human or animal memory

Involves an input layer, output (results) layer, and hidden layer

Processing Integrity

Refers to a sytem’s ability to initiate and complete the transactions so that they are valid, accurate, completed timely, and authorized to meet a company’s objective

One of the five AICPA Trust Services Criteria

Design Deficiency

Control that is missing or an existing control that is not designed properly

Operational Deficiency

Control that does not operate as designed or is performed by a person who lacks authority or competence to perform the control effectively

Principle 11

This principle from the COSO Internal Control Framework for IT systems states that there should be general controls over technology in order to achieve organizational objectives

Principle 13

This principle from the COSO Internal Control Framework for IT systems states that organizations should acquire, create, and use quality information in order to support internal controls

Principle 14

This principle from the COSO Internal Control Framework for IT systems states that effective communication of information is necessary to support internal controls

Blockchain

A control system originally designed to govern the creation and distribution of Bitcoin

Technology developed to prevent Bitcoin from being replicated and to limit its initial creation so that there is only a finite number of Bitcoins

It resists alteration, multiparty transaction validation, and decentralized nature

Serves as a form of audit trail to verify transactions and its security

Waterfall Method

Method of change in which it is structured and sequential, focusing on completing one phase fully before moving on

Different teams of employees perform separate tasks in sequence

Agile Method

Method of change in which it is flexible and collaborative, allowing for ongoing changes and early delivery of value

Cross-functional teams work simultaneously

Availability

When business data is accessible and IT systems are operating normally, and an organization’s human capital and personnel being ready and able to perform in normal operations

Business Resiliency

The integration of system availability controls, disaster recovery plans, business continuity plans, and crisis management plans into a central set of procedures to consider whether a business can continue to operate or quickly return to operations without irreparable harm to its people, information, or assets

The overall integration of procedures implemented to keep operations running smoothly

Disaster Recovery

Consists of an entity’s plans for restoring and continuing its information technology function in the event of the destruction of not only program and data files, but also computer processing capability

Cold Site

An off-site location that has all the electrical connections and other physical requirements for data processing, but it does not have the actual equipment

Usually require one to three days to be made operational because equipment has to be acquired

Organizations normally utilize generic hardware that can be readily (and quickly) obtained from hardware vendors

Cheapest form of off-site location

Hot Site

An off-site location that is equipped to take over the company’s data processing as these locations are not only pre-wired for use but also include the necessary hardware and office equipment to perform the functions of the organization

Backup copies of essential data files and programs may also be maintained at the location or a nearby data storage facility

Most expensive

Warm Site

An off-site location that already has hardware installed but will fall short of the processing capabilities typically found in a hot site or at the actual business during normal operations due to a lack of fully operational computer and office equipment

Moderately expensive

Business Continuity Plans

Overall goal is to continue operations or restore operations in the most efficient and effective manner possible with consideration given to all aspects of the organization

Must consider the organization’s key business processes, risks that exist in those processes, the acceptable downtime for those processes, and implement mitigation and contingency plans to address risks and downtimes

Business Impact Analysis (BIA)

Identifies business units, departments, and processes that are essential to the survival of an entity as well as the organizational impact in the event of failure or disruption

Will identify how quickly essential business units and/or processes can return to full operations following a disaster and the resources required to resume business operations

Recovery Time Objective (RTO)

The maximum amount of time it should take to restore business operations to a target state following a system failure

Mean Time to Repair (MTTR)

Average length of time it takes to repair a damaged or inoperable device

Recovery Time Actual (RTA)

The actual time it takes to restore business operations to its target state after a system failure

Recovery Point Actual (RPA)

The actual point in time to which data can be recovered (e.g. recover all trading data up to two minutes prior to the incident)

Annualized Rate of Occurrence (ARO)

The expected frequency that a specific negative event will happen in one year

Single Loss Expectancy (SLE)

Represents the expected monetary loss from a single occurrence of a risk event affecting an asset

Annualized Loss Expectancy (ALE)

The expected monetary loss from a risk event over the course of one year

System Availability Controls

Activities to prevent system disruptions and loss of information and procedures to continue operations or provide quick recovery from an incident

Uninterrupted Power Supply (UPS)

A device that maintains a continuous supply of electrical power to connected equipment

Used to prevent a system from shutting down improperly during an outage

Redundant Arrays of Independent Drives (RAID)

Allow organizations to record data on multiple disk drives at one time for the purpose of data redundancy in the event one disk drive fails

Full System Backup

Type of backup that is a full copy of the entire database

Time consuming to complete but has the least time-consuming recovery process

Incremental System Backup

Type of backup that involves copying only the data items that have changed since the last backup

Restoration involves loading the last full backup and installing each subsequent backup in the proper sequence

Slowest type of backup but creation is fast

Differential System Backup

Type of backup that copies all changes made since the last full backup, containing all cumulative effects of all activity since the last full backup

Change Management

Describes the policies, procedures, and resources employed to govern change in an organization

Development Environment

Type of environment where software programmers write code to create application prototypes

Testing Environment

Type of environment where developers test and debug code to identify errors that need to be corrected

Staging Environment

Type of environment where organizations can test programs that are in their final phases of development in a production-like environment

Production Environment

Type of environment where an application is deployed and made available to end users

Baseline Configuration

Establishing a starting point for reconfigurations so that changes are deployed in a consistent and secure environment

System Component Inventory

List of items that comprise a system, including hardware, software, peripherals, and other IT assets