Domain 4 Information Systems Operations, Maintenance and Support

What is RFID (Radio Frequency Identification) ?

RFID usses radio waves to identify tagged objects and the main purpose is to identify and locate assets within a limited radius.

The tag that is used to identify the item/object is made up of a mmicrochip and a antenna. The microchip is used to store information and antenna is used to transmit information to an RFID reader.

What are the risks assocaited with RFID?

1. Unauthorized access to RFID generated information may harm the business

2. Risk of non-adherence to regulations. For example, if the RFID system uses personal information without the consent of customers, that is a risk of non-adherence.

3. Any attacks on RFID systems may impact business processes adversely

4. RFID tags are exposed to the risk of eavesdropping, the same as wireless devices

What are the controls to mitigate risks associated with RFID?

1. Provide access on a need to know basis

2. Ensure managemnet oversight over the RFID systems and processes

3. Existing policies should be update to address risks and control for RFID systems and processes

4. Implement physical and logical security controls for accesss to RFID systems and RFID generated data

5. Implementing technical controls such as encrypting data on tag and wireless communication.

What type of report should an IS auditor verify to determine compliance with the uptime requirement defined in the SLA?

The availability report: The availability report indicates the time period during which the system is up and available for use. An IS auditor can determine downtime with the help of availability reports.

What technical controls are required for RDIF Security

1. encryption of data stored on the tag

2. Encryption of data in transit

3. Logical and physical access controls

4. Tag Self destruction

which report helps determine the efficiency of a preventive maintenance program

System downtime report, as this report tells you how long the system has been down and it should be low.

What activity should not be conducted during peak production hours?

Preventive maintenance, as this should be done during low production hours.

What is the first step in IT Asset Management

Identify and create an inventory of IT Assets

What type of information should be included in the inventory of IT Assets?

1. Who is the Owner of the IT asset

2. Who uses the IT asset (Custodian)

3. Where is the IT asset located

4. What is the security classification of the IT asset

What is an approved software list and why is it important?

The approvedn software list is a list provided by the IT department that lists the approved softwares that can be installed and used.

Processes should be in place to ensure only standard approved lists can be installed and used as unapproved softwares poses potential risks such as leak of data

What is source code?

Code that is readable by humans

What is object code

Code that can only be read by computers

What can be used to ensure the synchronization of source and object code?

Date and time stamping of source and object code

What is the first step after the replacement of hardware?

Update the IT asset inventory

Why is maintaining an IT asset inventory important?

Without identifying IT asset inventory, further risk management, access control, and security measures cannot be properly implemented.

What is a job schedule?

It is a program that is run various processes, tape backups, and other maintenance processes automatically

What are the advantages of automated job scheduling

1. Reduces the probability of error as manual intervention is eliminated

2. Increases the availability of records for job executions, making it easier to take subsequent action on failure reports effectively

3. It provides a more secure environment as compared to manual processes

What aspects should an IS auditor consider while reviewing the job scheduling process?

1. Whether procedures for collecting and reporting KPIs are defined and implemented

2. Whether the priority of each job has been identified

3. Whether an audit trail is captured for each job

4. Whether job completion status is monitored and appropriate action is taken on failed jobs

5. Whether approval roles are defined for scheduling, changing, or prioritizing jobs

What is a tape management system?

Software that tracks and contorls magentic tapes used for backups, archieves, and batch processing to ensure that the tapes are clearly defined as to:

• What data is contained

• Where the tape is data is being stored

• Where tapes can be resued

• And which tapes should not be overriden

what is the best compensating control for tape managemet system where some paramters are set to bypass or ignore tape header records?

Staging and job setup

• Staging is data sotred in an intermediate place (between the data source and the data target) processing is done

What should be considered while scheduling jobs?

• High priority jobs should receive optimum resource availability

• Maintenance functions should be performed during non-peak hours

What is a major ocncern when reviewing job scheduling?

Operators overriding scheduled jobs

What are staging and job setup controls?

Staging and job setup controls are procedures used to verify data, files, and processing parameters before a job is executed. This helps ensure that the correct tapes are selected and associated with the appropriate processing jobs, reducing the risk of processing incorrect or unauthorized tapes.

What is end user computing?

Refer to a system wherein a user (non-programmer) can create their own application as there are available products to aid end users in designing and completing systems according to their requirements without the aid of programmers.

What are the advantages of end user computing?

1. End user computing is quick way to build and deploy applications without relying on an IT department

2. End user computing applications are generally flexible and have the ability to quickly address any new requirements or modifications

3. End user computing reduces pressure on the IT Department who can concentrate on critical and complex applications

What are the risks of end user computing?

1. Applications created via end user computing may not be subject to various tests and therefore carry a risk of information security in terms of data integrity, confidentiality, and availability

2. Users may not adhere to change management and release management procedures

3. system controls in terms of authorizations, authentications, audit trails and logs, encryption, and non-repudiation may not be given due importance

4. An appropriate redundancy and backup arrangement may not be addressed for business continuity

Summary: No Testing, No change management, no backup, no security, and no audit trail

why is a documented end user computing policy important?

A documented EUC policy ensures that EUC solutions follow control standards so that errors, unauthorized access, data loss, and compliance violation are minimized. It also helps auditors verify accountability and ensures that critical EUC applications are monitored, supported, and properly integrated into the organization’s control environment.

What are the types of free software?

1. Open source: This software can be listed, modified, and redistributed as required. However, this should be done in accordance with terms and conditions mentioned in the software license

2. Freeware: Software is free but source code cannot be redistributed

3. Shareware: Software is available for free for some trial period and has limited functionality as compared to the full version

What should an IS Auditor ensure for software license requirements?

IS auditor should ensure that software copyright laws are followed by the organization. Any violation may lead to regulatory consequences, reputational loss, and financial losses due to penalties.

What is the best way to determine the sue of unauthorized software?

Scan the entire network using automated tools and capture a list of installed software to compare against the approved software list

What are important aspects of source code management?

• If an application is developed by a third party vendor, it is essential to have access to the source code. If it is not supplied, it is important to arrange for escrow agreement

• Access to the source code should be restricted and any update to source code should be managed by using a version control system (VCS)

• Appropriate backups of source code should be maintained.

Why is log management important?

Log activities provide data to allow for future analysis

• Logs should be appropriately protected as an intruder may attempt to alter logs to hide their activities

What is the best way to protect logs ?

Capture logs in a centralized secure server using security information and event management (SIEM) software.

Why is parameter setting important?

Parameter setting is an important factor that determines how a system will function

• Software control parameters handle data management, resource management, job management, and priority setting

What is the most effective method to determine the functioning of controls within an operating system?

Review of parameter settings

What is registry?

System settings are parameters are set in configuration files known as registry

Why is control of registry important?

Protecting registry is important for ensuring the integrity, confidentiality, and availability of systems

• Registry editing should be privileged and only admins should have the ability to edit

What are utility programs?

Utility programs help manage and control computer resources and support the operating system

What is important aspect to remember for utility programs?

Many utility programs can function by bypassing the security system and function without producing an audit trail, which is why it is very important to restrict and control the activities of utility programs.

What is Nucleus?

The nucleus is responsible for basic processes associated with the operating system

• It manages process creation, interrrupt handling support for input and output process, allocation, the release of memory, etc

What is key aspect to remember about nucleus?

The nucleus is a highly sensitive area where access should be restricted to only authorized users.

What is the major concern about use of open source software?

Non-adherence to terms and conditions for use of open source software