ais ch 13

trust services framework

• security

• confidentiality

• privacy

• processing integrity

• availability

security

• access to the system and data is controlled and restricted to legitimate users

confidentiality

• sensitive organizational data is protected

privacy

• personal info abt trading partners, ivnestors, and employees is protected

processing integrity

• data are processed accurately, completely, in a timely manner, and only with proper authorization

availability

• system and information are available

availability TSF

• the system, products, or services are accessible and operational as committed or agreed upon

  • focuses on system uptime, reliability, and performance

  • the goal is to maintain consistent system availability to ensure users can rely on the org’s services wo unexpected interruptions

availability key objectives

• minimize risk of system downtime

  • esp if unexpected

• quick and complete recovery and resumption of normal operations

  • something happens/threat takes system down. how to resume?

minimizing downtime controls

• preventative maintenance

  • make sure servers have capacity (ex., before holidays)

• training

  • employees need to know how to prevent and respond to issues (e.g., police raining to respond to hs shooting)

• patch management and antivirus software

  • stop and apply emergency patch (e.g., oil and gas experiencing issue with open ai identifying php but then it got posted and now everyone is aware).

  • use the antivirus software

• fault tolerance

  • ability of a system to continue functioning in the event that a particular component fails

  • use of redundant components

    • extra servers

    • virtualization

    • RAID used as mirroring

• data center location and design

  • raised floor

  • fire suppression

  • air conditioning

  • uninterruptible power supply UPS

  • surge protection

  • physical access controls

data center location and designs

• raised floor

• fire suppression

• air conditioning

• uninterruptible power supply UPS

• surge protection

• physical access controls

soc1

• internal controls for financial reporting

• ex., outsourcing payroll→ get soc 1 from payroll provide to complete audit of company

fault tolerance

• ability of a system to continue functioning in the event that a particular component fails

• use of redundant components

  • extra servers

  • virtualization

  • RAID used as mirroring

• data center location and design

  • raised floor

    • 12 inch cushion

  • fire suppression

    • no sprinklers to avoid water damage though

    • Gaseous Clean Agent Systems

  • air conditioning

    • like 50 degrees

  • uninterruptible power supply UPS

    • keeps power running when power runs out (ex., hospitals and like a generator but only for the server)

  • surge protection

    • when lose power, didn’t unplug fridge, electricity came back and fried the fridge during hurricane beryl. make sure ur server doesn’t get fried.

  • physical access controls

patch management and antivirus software

• stop and apply emergency patch (e.g., oil and gas experiencing issue with open ai identifying php but then it got posted and now everyone is aware).

• use the antivirus software

backup procedures

• full

• partial

  • incremental

    • copies only items that have changed since last partial backup

    • faster (smaller amount), recovery takes longer (may have to do multiple)

  • differential backup

    • copies all changes made since last full backup

    • slower (larger amount than incremental), recovery is faster

  • archive

recovery point objective RPO

• the max amount of data that the organization is willing to have to reenter or potentially lose

• data created since last backup

• business needs to determine, this not IT. this will guide your backup plans.

  • amazon maybeee has an hour max. vs a university could go a few days.

• if ? is short/small, than u need backups more often.

• if ? is larger, then can have more time btw backups

recovery time objective RTO

• max tolerable time to restore an information system after a disaster

• how long will trxs need to be processed manually

• time after a disaster- how long does it take to restore critical functions. find the missing trxs. etc.

• if RPO and RTO are zero (like a hospital) must spend a lot $ on bakup plans.

incremental backup

• backup from last backup (regardless of type)

• wednesday problem (4 backups to recover to the last backup- sun full, mon, tues, wed)

  • longer RTO - longer to recover

differential backup

• backup since last FULL backup

• wednesday issue (2 backups to restore- sunday’s full and wednesday’s backup)

q’s to ask

• what type of media used for the backups

• how old is the media?

• has the restoration process been tested?

• where are the backups stored? (hopefully not at the same place as the primary servers or not in the restroom)

  • onsite

  • offsite

• how long are backups retained?

  • (client was wiping out the most recent backup while running a new backup).

• who has access to the backups

disaster recover plan DRP

• procedures to restore org’s IT function

• temporarily replacing the necessary computer infrastructure, such as computers, network equipment and access, telephone lines, other office equipment

  • very IT focused in comparison

  • but need both DRP and BCP

business continuity plan BCP

• how to resume all operations, not just IT

  • what if metro doesn’t work and ppl can’t come to work?

  • what if power is out?

  • focuses on the entire business, but need both DRP and BCP

reciprocal agreement

• agreements with another org that uses similar equipment to have temp access to and use of their information system resources

• e.g., houston has a hurricane, dallas will take over

cold site

• an empty building that is prewired for necessary telephone and Internet access, plus a contract with 1 or more vendors to provide all necessary computers, and other office equipment within a specified period of time

• goal is to rebuild everything within a time frame. takes longer bc need to rebuild. long RTO.

hot site

• facility that is prewired for telephone and Internet access and also contains all the needed computing and office equipment

• costs more

real-time mirroring

• maintaining 2 copies of the database at 2 separate data centers both updated in real time at the same time

• $$ to operate, but if something goes out no interruption. hospitals need this. short RTO