Chapter 2: IT governance

Corporate Governance

Set of relationships among company management, board, shareholders and stakeholders

-Provides structure and framework

Enterprise Governance and IT

Implies a system in which all stakeholders, board, senior management internal customers provide input into the IT decision making process

-helps to ensure IT aligns with the business objectives

-Responsibility of BOD and upper management

Corporate Governance

Set of relationships among company management, board, shareholders and stakeholders

-Provides structure and framework

Enterprise Governance and IT

Implies a system in which all stakeholders, board, senior management internal customers provide input into the IT decision making process

-helps to ensure IT aligns with the business objectives

-Responsibility of BOD and upper management

COBIT framework

Overarching framework for governance over management of enterprise and IT

Governance: ensures stakeholder needs, conditions, and options are considered for objectives and decision making

Developed by ISACA

Effective Information Security Governance

Senior management ensures there is fair representation of the enterprise

BOD and CEOs are accountable for information security governance

Strategic Planning

Long term planning an organization wants to take in leveraging IT

Business Intelligence

Broad field of IT that encompasses the collection and analysis of information to assist in decision making

Data Architecture

To deliver effective BI, need to design and implement data architecture

Presentation/desktop layer

where end users directly deal with information

Core data warehouse

Where all of the data of interest to an organization are captured and organized to assist in reporting analysis

Data mart layer

subsets of data warehouse organized to meet the needs of a particular business unit

Data staging and quality layer

responsible for data copying and quality control

Data access layer

operates to connect the data storage and quality layer

Data preparation layer

assembles data in the data marts

Metadata repository layer

for data that extends beyond data structure and formats. Provides detail on business purpose and context

Warehouse management layer

schedules tasks needed to build and populate data marts

Application messaging layer

transports information between various layers

Internet/intranet layer

data communication through internet protocol networking

Data Governance

Critical role is determining which BI initiatives to fund and establishing a business/IT advisory team

International Organization or Standardization (ISO/IEC 27000)

best practices that provides guidance on implementing and maintaining information security programs

Information Technology Infrastructure Library

developed by UK and includes information on how to achieve successful operational service

IT Standards, Policies, and Procedures

Standards: Mandatory requirements

Policies: High level statements for intent, expectations and direction

Information Security Policy: policies set by an org to protect information and related technology

Procedures: documented and defined for achieving objectives

IT Governing Committee (IT Strategy Committee)

Provides insight and advice including:

-alignment of IT and business direction

-achievement of strategic IT objectives

-availability of suitable IT resources

Advises the board and management on IT strategy and prepare strategy approval

-consists of board members

IT Governing Committee (IT Steering Committee)

-Decides on the overall level of spending and cost allocation

-approves project plans and budgets

-Monitors project plans for delivery

-oversees delivery of IT projects

-consists of key business executives, key advisors, and CISO

Senior Management

-implements effective security governance

-defines strategic security

CISO

sits on the steering committee

doesn't have to be the exact title (CEO, CIO, CRO)

Segregation of Duties within IT

Duties that should be segregated are:

-custody of assets

-authorization

-recording transactions

Risk Management Process

-Asset Identification, Evaluation of Threats and Vulnerabilities to Assets, evaluation of impact, calculation of risk, evaluation of and response to risk

Maturity Models

Ongoing performance measurement to assess the efficiency and effectiveness of implemented processes

IDEAL Model (initiating diagnosing establishing acting and learning model)

Software improvement model to plan and implement process improvements in software

Third Party Audit Reports

SOC1: report on service org's system of controls relevant to internal controls over financial reporting

SOC2: report on service org's system of controls relevant to security, availability and confidentiality

SOC3: more general than a SOC2 and used for widespread use. Does not focus on controls