M1 S2 ISC CPA

SOC 2 Engagement

Examinations in which 3rd-party evaluates and reports on service organization’s system of controls as it relates to AICPA’s five Trust Services Criteria

• Report gives users reasonable assurance that the service organization’s controls listed in its system description are accurately depicted and effective

IT Infrastructure

Supporting IT architecture within most modern companies that has multiple, interconnected technological components

• Core:

  1. On premises/ outsourced hardware

  2. Software

  3. Specialized personnel

AICPA Trust Services Criteria

1. Security

2. Availability

3. Processing Integrity

4. Confidentiality

5. Privacy

End-User Devices (EUDs)

Electronic machines (computers) that directly interact with employees or consumers at the “edge” of a network, meaning they are the point in a chain of applications or an organization’s IT architecture that interfaces with a human

• Different than devices used by programmers, administrator, developer who are not the ultimate users

• Examples: laptops, desktop, tablets, wearable by employees who are the final consumer of the device

External Computer Hardware

External peripheral devices that do not need to be integrated into the machine itself

• Mouse, keyboard, disk drive, network card, monitor, printer, scanner

Network Infrastructure

Hardware, software layout, and topology of network resources that enables connectivity and communication between devices on a computer network n

Modem

Connects a network to an internet service provider’s network by receiving analog signals from the internet service provider and translating them into digital signals

• Device brings internet into home/ office

• Has a public IP address

Router

Manage network traffic by connecting devices to form a network by reading the source and the destination fields in information packet headers to determine the most efficient path through the network for the packet to travel

• Acts as link between a modem and an organization’s switches

Switches

Similar to routers where they connect and divide devices within a computer network by turning one network jack into serveral network jacks so multiple devices can share one network connection

• Not as advanced as a router (assigning IP addresses)

Gateways

A computer or device that acts as an intermediary between different networks by transforming data from one protocol into another so that information can flow between networks

• Interprets differing protocols and converts them into an appropriate format to facilitate network movement between a company’s network and the internet

Protocol

Set of rules that governs the way in which information is transmitted/ how devices in a network communicate with other devices

• Most common = TCP/ IP ←- Used for Internet

Edge-enabled Devices

Allows computing, storage, and networking functions closer to the devices where the data or system request originates, instead of a distant central location

• Move devices closer together

• Benefits = Faster network response times and operability because data does not have to be transmitted to a remote centralized server for processing

Servers

Physical or virtual machines that coordinate computers, programs, and data that are part of the network

• Business use client/server model where client sends a request to the server and it provides a response or executes action

Firewall

Software applications or hardware devices that protect a person’s network traffic by filtering trough security protocols with predefined rules; work by analyzing network traffic that is transmitted in packets and determining if firewall is configured to accept the data

• Rules must align with company’s policies and access guidelines

• Intended to prevent unauthorized access and prevent employees from downloading malicious programs

Types of firewalls:

1. Circuit-Level Gateway

2. Application-Level Gateway

3. Network Address Translation Firewall

4. Stateful Multiplayer Inspection Firewall

5. Next-Gen Firewall

Circuit-Level Gateway

Type of firewall that verifies source of a packet and meets rules and policies set by security team

Application-Level Gateway

Type of firewall that inspects the packet itself

• Resource-intensive and can slow performance

Network Address Translation Firewall

Type of firewall that assigns an internal network address to specific, approved external sources so that those sources are approved to be inside the firewall

Stateful Multilayer Inspection Firewalls

Type of firewall that combines packet-filtering and network address translation

Next-Gen Firewall

Type of firewall that assigns different firewall rules to different applications as well as users

• Low-threat application = More permissive rules

• High-security application = More restrictive rules

Network Topology

Physical layout of equipment or “nodes” in a network where it’s essential to understand how to properly engineer the network for optimal performance

• Different requirements for each topology (Length/ type of connecting cables, data transmission rate, physical position of each node) which is based on size of network, performance needs of organization, and environment

Types

1. Bus Topology

2. Mesh Topology

3. Ring Topology

4. Start Topology

Bus Topology

Type of topology where the layout is in a linear or tree form, with each node connected to a single line or cable

• Can cause signal interference when data is transmitted by a node at the same time

  • Avoid this, cables must be terminated/ properly finished at end

• Disadvantage = If central line is compromised, entire network goes offline

Mesh Topology

Type of topology where there’s numerous connections between nodes with all nodes being connected (full mesh) / some connected (partial mesh)

• Used in wireless networks

• Advantage = Allows for high levels of traffic and promotes stability if a node is damaged

• Disadvantage = Costly to implement and maintain over network’s life span

Ring Topology

Type of topology where nodes are connected in a circular path

• When data is transferred to a destination device, it must go through every device between the source and destination first

• 2 paths

  1. Unidirectional ←- Allows data transmission to move in one direction

  2. Multi-directional ←- Allows two-way data transmission

• Advantage = Data transmission collision is minimized/ eliminated

• Disadvantage = Results in very slow network performance

Star Topology

Type of topology where data passes through a central hub that acts as a switch/ server, and then transmits to peripheral devices that act as clients

• Can be multiple hubs so if one fails, only nodes connected to that hub stop functioning

• Advantage = Easier to identify damaged cables

Open Systems Interconnection (OSI) Model

Model that helps explain how protocols work and how networking devices communicate with each other

• Segregates network functions into 7 layers where each layer is responsible for a specific data exchange function

  1. Application

  2. Presentation

  3. Session

  4. Transport

  5. Network

  6. Data Link

  7. Physical

• Data flows through each layer through Encapsulation process, which adds a header or footer to the data point received from the previous layer

  • Starts with Application with a message and goes down to Physical where the message is transformed into electrical impulses that are sent to receiving network device (Represents the actual networking device that is being used to transmit message)

• Then, Decapsulation process begins with Physical and goes up to Application

Application Layer

Layer that serves as the interface between applications that a person uses and the network protocol needs to transmit a message

• Protocols = HTTP, FTP, SMTP, EDI

Presentation Layer

Layer transforms data received from the Application Layer into a format that other devices using the OSI model can interpret (videos, images, web pages)

• Encryption occurs at this Layer

• Protocols = ASCII, JPEG, MPEG (File Extensions)

Session Layer

Layer that allows session between communicating devices to be established and maintained; enables dialogue between networking devices

• Allow networking devices to have dialogue with each other

• Protocols = RPC, SQL, NFS

Transport Layer

Layer that supports and controls the communication connections between devices

• Setting rules for how devices are referenced, aniunt of data that can be transmitteed, valiting data’s intergrity, and determining whther data has been lost

• Protocols = TCP, UDP, SSL, TLS

Network Layer

Layer that adds routing and addresses headers or footers to the data (source/ destination IP address) so the message reaches the correct devices

• Can help detect errors

• Protocols = IP, IPSec, NAT, IGMP

Data Link

Layer where data packets are formatted for transmission, which is determined by the hardware and networking technology (Ethernet); adds Media Access Control (MAC) addresses which are device identifiers that act as source and destination reference numbers to route messages to the correct device

• Protocols = ISDN, PPTP, L2TP, ARP

Physical Layer

Layer that converts the message sent from the Data Link Layer into bits so it can be transmitted to other physical devices and receives messages from other physical devices and converts those back from bits to a format that can be interpreted by the Data Link Layer (Decapsulation)

• Protocols = HSSI, SONET, V.35, X.21

Network Infrastructure Architecture

Way an organization structures its network from a holistic design standpoint

• Factors:

  • Geographical layout

  • Physical/ Logical layout

  • Network protocols used

Types of Network Architecture Designs

1. LAN

2. WAN

3. SD-WAN

4. DMZ

5. VPN

Local-Area Network (LAN)

Type of network architecture design that provides network access to a limited geographic area (Home, office)

Wide-Area Networks (WAN)

Type of network architecture design that provides access to larger geographic areas (Cities, regions, countries); can connect other networks together to provide broad coverage

• Internet

• Control and management is integrated into hardware

Software-defined Wide Area Networks (SD-WAN)

Type of network architecture design that monitors the performance of WAN connections an manages traffic to optimize connectivity

• Control and management are separated from the hardware and included in a software

Dematerialized Zone (DMZ)

Type of network architecture design of a subnetwork that separates a LAN from other untrusted networks; set up by creating a physical/ logical subnetwork outside the LAN’s firewall

Virtual Private Network (VPN)

Type of network architecture design where there’s a virtual connections through a secure channel/ tunnel that provides remote access and secure access to an existing network

• Remote Desktop Connections (RDC)

Software

Consists of the applications, procedures, programs that provide instructions for a computer to execute

• Controlled by a user interacting with the program

Types of Software:

1. Operating System (OS)

2. Firmware

3. Mobile Devices

Operating System

Type of software that orchestrates global functioning of a group of applications, hardware, and their performance by acting as an intermediary between resources that allow a user to execute specific tasks; balancing resources and allocating them in a way that allows system to run seamlessly without delays/ interruptions

• Defines parameters for managing a system’s memory, processes, records, devices, and user interface

Firmware

Type of software that is locally embedded in harware instructs

Mobile Devices

Type of software that

Cloud Computing

Computing model that uses shared resources over the internet and gives customers the opportunity to gain efficiencies by allowing them to rent from cloud service providers instead of purchasing or building costly solutions

• Customers rent storage space, processing power , proprietary software on remote servers from other company

• Offers infrastructure elasticity where organization rents only as much as needed on a minute-to-minute basis

• Benefits:

  • Company’s data is stored virtually in 1 location

  • Data processing is more centralized which reduces IT hardware

  • Offers distributed redundancy among data centers, which reduces likelihood data is lost

3 Models:

1. IaaS (Infrastructure as-a-Service)

2. PaaS (Platform-as-a-Service)

3. SaaS (Software-as-a-Service)

IaaS (Infrastructure as-a-Service)

Cloud computing model that provides clients with virtualized computing infrastructure resources such as servers, storage, and networking on a pay-as-you-go basis

• Provides an entire virtual data center of resources

PaaS (Platform-as-a-Service)

Cloud computing model that provides customers with a computing platform—including tools, middleware, and runtime environments—that allows customers to develop, test, and deploy their own applications

• Customer builds and manages the application

SaaS (Software-as-a-Service)

Cloud computing model in which the service provider owns, hosts, and manages complete software applications for client organizations, making those applications accessible over a private network or the internet

• Customer does not manage or control the underlying infrastructure, platform, or application code—only user-specific configuration settings within the application.

Cloud Computing Deployment Models

4 types of cloud computing deployment models:

1. Public: Cloud is owned/ managed by CSP, making is available for companies who purchase it

   • Limited control

2. Private: Cloud is created for a single organization and is managed by the organization or CSP

   • Suitable for highly regulated industries due to greater infrastructure control

3. Hybrid: Cloud is composed of two or more clouds, with at least one being private, that remain unique cloud entities but with technology in place that facilities portability between them

4. Community: Shared by multiple organizations to support a common interest

Cloud Service Provider (CSP)

A third party that provides cloud computing services

• Performs all maintenance and technical support on the hardware

• Serve multiple cloud customers at once using common resource and technology for all customers

• Found in SOC 2 Reports regarding compliance with regulations and standards

  • Cloud Control Matrix

Cloud Control Matrix

Framework designed for best practices regarding cloud security, data protection, and compliance in a cloud environment

COSO Enterprise risk Management (ERM)

Framework that categorizes methods for addressing an organizations risk into 5 components and 20 principles which enhances the value of the organization

• Was designed to be customizable and as a standards for reasonable expectations when managing risks associated with business objectives and staretgy

1. Governance & Culture

   1. Exercise Board Risk Oversight

   2. Establish operating structures

   3. Define desired culture

   4. Demonstrate commitment to core values

   5. Attracts, develops, and retains capable individuals

2. Strategy & Objective Setting

   1. Analyze business context

   2. Define risk appetite

   3. Evaluate alternative strategies

   4. Formulate business objectives

3. Performance

   1. Identifies risk

   2. Assess severity of risk

   3. Prioritize risk

   4. Implement risk responses

   5. Develops portfolio views

4. Review & revision

   1. Assess substantial change

   2. Reviews risk and performance

   3. Pursues improvement in enterprise risk management

5. Information, Communication & Reporting

   1. Leverages IT

   2. Communicates risk information

   3. Reports on risk, culture, and performance

Governance & Culture

Component of COSO ERM that sets the company’s tone and reinforce the importance of having oversight of ERM

• Culture = Company’s target behaviors and values and involves understanding risk

Strategy & Objective Setting

Component of COSO ERM that is considered with ERM and strategy during the strategic planning process

• Company’s risk appetite should be aligned with its strategy, and business objectives are put in place to help achieve appetite through identifying risk, assessing, and responding to risk

Performance

Component of COSO ERM that requires organizations to priorize their risks based on their risk apetite so that business objectives are assessed, met, and reported to key stakeholders

Review & Revision

Component of COSO ERM that invloves reviewing a company’s perfromance over time and making revisions to functions when needed

Information Communication & Reporting

Component of COSO ERM that recommends a continual process to be in place that supports sharing both internal and external information throughout the organization in a timely manner

COSO ERM Framework

Framework that helps organizations establish ideal configurations for cloud options by applying 8 components, which allows management to tailor the solution based on company’s own risk appetite

1. Internal Environment

2. Objective-Setting ←- Understand how outsourcing tech functions will help reach/ hinder objectives

3. Event Identification ←- Underdstand how adopting CSP can make event identification more complex/ easier

4. Risk Response

5. Control Activities

6. Information and Communication

7. Monitoring

Internal Environment

Component of COSO ERM Framework that serves as the foundation for a company’s risk appetite, helping a company understand the level where it wants to outsource technology functions

Risk Assessment

Component of COSO ERM Framework where management should understand the risks of cloud strategy, understanding the impact to its risk profile, inherent and residual risks, and likelihood of the impact of all risks

Risk Response

Component of COSO ERM Framework where management decides iif its response to risk will be to avoid a risk, reduce its likelhood, share the risk by transferring a portion to another entity, or accept the risk

Control Activities

Component of COSO ERM Framework where organization should understand how traditional controls (detective, preventative , automated, manual) are modified in a cloud enviornment

Information and Communication

Component of COSO ERM Framework where management understadns how operating in the cloud wil affect the timeliness, availability, and dissemintation of inforamtion & communication

Monitoring

Component of COSO ERM Framework where management should modify its monitoring mechanisms to accommodate new complexities introduced by adopting a cloud solution

Multi-tenant

Serve cloud customers using virtual common resources, so that multiple organizations share the same virtual infrastructure

• Depend on willingness of an organization to be in the same ecosystem as other tenants, the type of tenant or industry in which other tenants operate, and the cost of using dedicated resources versus shared infrastructure.

Business Process-as-a-Service (BPaaS)

Type of cloud computing deployment model that delivers business process outsourcing services to a user