IT Auditing Using Controls to Protect Information Assets

Title Page......Page 2
Copyright Page......Page 4
Dedication......Page 8
About the Author......Page 9
Contents......Page 15
Acknowledgments......Page 31
Introduction......Page 37
Part I Audit Overview......Page 43
Chapter 1 Building an Effective Internal IT Audit Function......Page 112
Why Are We Here? (The Internal Audit Department’s Mission)......Page 113
Independence: The Great Myth......Page 117
Adding Value Outside of Formal Audits......Page 121
Business Advisory Audits......Page 122
Early Involvement......Page 125
Informal Audits......Page 131
Knowledge Sharing......Page 136
Self-Assessments......Page 142
Continuous Auditing......Page 143
Final Thoughts on Adding Value Outside of Formal Audits......Page 144
Relationship Building: Partnering vs. Policing......Page 145
Learning to Build Partnerships......Page 148
The Role of the IT Audit Team......Page 154
Application Auditors (or Integrated Auditors)......Page 157
Data Extraction and Analysis Specialists......Page 158
IT Auditors......Page 161
Forming and Maintaining an Effective IT Audit Team......Page 163
Career IT Auditors......Page 164
IT Professionals......Page 167
Career IT Auditors vs. IT Professionals: Final Thoughts......Page 171
Co-sourcing......Page 175
Maintaining Expertise......Page 176
Sources of Learning......Page 177
Relationship with External Auditors and Internal Assurance Functions......Page 182
Summary......Page 184
Chapter 2 The Audit Process......Page 186
Types of Internal Controls......Page 187
Internal Control Examples......Page 189
Determining What to Audit......Page 191
Creating the Audit Universe......Page 192
Ranking the Audit Universe......Page 197
The Stages of an Audit......Page 202
Planning......Page 203
Fieldwork and Documentation......Page 208
Issue Discovery and Validation......Page 211
Solution Development......Page 213
Report Drafting and Issuance......Page 223
Issue Tracking......Page 233
Summary......Page 236
Part II Auditing Techniques......Page 239
Background......Page 243
Test Steps for Auditing Entity-Level Controls......Page 246
Knowledge Base......Page 278
Master Checklist......Page 279
Chapter 4 Auditing Cybersecurity Programs......Page 282
Background......Page 283
Steps for Auditing Cybersecurity Programs......Page 285
Knowledge Base......Page 322
Master Checklist......Page 323
Background......Page 44
Data Center Auditing Essentials......Page 45
Physical Security and Environmental Controls......Page 48
System and Site Resiliency......Page 51
Data Center Operations......Page 52
Test Steps for Auditing Data Centers......Page 53
Neighborhood and External Risk Factors......Page 54
Physical Access Controls......Page 61
Environmental Controls......Page 72
Power and Electricity......Page 75
Fire Suppression......Page 81
Data Center Operations......Page 87
System Resiliency......Page 98
Data Backup and Restoration......Page 100
Disaster Recovery Planning......Page 102
Knowledge Base......Page 108
Master Checklists......Page 109
Background......Page 325
Network Auditing Essentials......Page 328
Protocols......Page 330
OSI Model......Page 331
Routers and Switches......Page 334
LANs, VLANs, WANs, and WLANs......Page 337
Firewalls......Page 339
General Network Equipment Audit Steps......Page 343
Additional Switch Controls: Layer 2......Page 361
Additional Router Controls: Layer 3......Page 365
Additional Firewall Controls......Page 369
Additional Controls for Wireless Network Gear......Page 375
Tools and Technology......Page 382
Master Checklists......Page 383
Background......Page 387
Windows Auditing Essentials......Page 389
Command-Line Tips......Page 392
Essential Command-Line Tools......Page 393
Common Commands......Page 396
Server Administration Tools......Page 397
Test Steps for Auditing Windows......Page 398
Initial Steps......Page 399
Account Management......Page 404
Permissions Management......Page 410
Network Security and Controls......Page 413
Security Monitoring and Other General Controls......Page 419
Knowledge Base......Page 427
Master Checklist......Page 428
Background......Page 431
Unix and Linux Auditing Essentials......Page 434
Key Concepts......Page 435
File System Layout and Navigation......Page 436
File System Permissions......Page 440
Users and Authentication......Page 443
Network Services......Page 448
Test Steps for Auditing Unix and Linux......Page 449
Account Management......Page 450
Permissions Management......Page 475
Network Security and Controls......Page 487
Security Monitoring and Other General Controls......Page 508
Network Vulnerability Scanners......Page 517
Malware Detection Tools......Page 518
Host-Based Vulnerability Scanners......Page 519
Knowledge Base......Page 520
Master Checklists......Page 522
Background......Page 527
Web Auditing Essentials......Page 528
One Audit with Multiple Components......Page 530
Part 2: Test Steps for Auditing Web Servers......Page 531
Part 3: Test Steps for Auditing Web Applications......Page 542
Additional Steps for Auditing Web Applications......Page 558
Tools and Technology......Page 564
Master Checklists......Page 566
Background......Page 569
Database Auditing Essentials......Page 571
Common Database Vendors......Page 572
Database Components......Page 577
NoSQL Database Systems......Page 585
Test Steps for Auditing Databases......Page 587
Initial Steps......Page 589
Operating System Security......Page 590
Account Management......Page 594
Permissions Management......Page 600
Data Encryption......Page 606
Security Log Monitoring and Management......Page 608
Auditing Tools......Page 615
Monitoring Tools......Page 616
Encryption Tools......Page 617
Knowledge Base......Page 618
Master Checklist......Page 621
Background......Page 623
Big Data and Data Repository Auditing Essentials......Page 626
Test Steps for Auditing Big Data and Data Repositories......Page 628
Master Checklist......Page 643
Background......Page 645
Key Storage Components......Page 647
Key Storage Concepts......Page 654
Test Steps for Auditing Storage......Page 658
Initial Steps......Page 659
Account Management......Page 661
Storage Management......Page 663
Encryption and Permissions Management......Page 666
Security Monitoring and Other General Controls......Page 669
Knowledge Base......Page 671
Master Checklists......Page 672
Chapter 13 Auditing Virtualized Environments......Page 674
Background......Page 675
Virtualization Auditing Essentials......Page 678
Test Steps for Auditing Virtualization......Page 680
Initial Steps......Page 682
Account Management and Resource Provisioning/Deprovisioning......Page 684
Virtual Environment Management......Page 686
Security Monitoring and Additional Security Controls......Page 693
Hypervisors......Page 701
Master Checklists......Page 702
Background......Page 704
Windows and Mac Auditing Essentials......Page 708
Test Steps for Auditing Windows and Mac Client Systems......Page 710
Knowledge Base......Page 734
Part 2: Auditing Mobile Devices......Page 735
Mobile Device Auditing Essentials......Page 736
Test Steps for Auditing Mobile Devices......Page 738
Additional Considerations......Page 750
Master Checklists......Page 752
Chapter 15 Auditing Applications......Page 756
Background......Page 757
Application Auditing Essentials......Page 758
Test Steps for Auditing Applications......Page 759
Input Controls......Page 760
Interface Controls......Page 764
Audit Trails and Security Monitoring......Page 767
Account Management......Page 769
Permissions Management......Page 776
Software Change Controls......Page 777
Backup and Recovery......Page 782
Data Retention and Classification and User Involvement......Page 784
Master Checklists......Page 787
Background......Page 789
Cloud Computing and Outsourced Operations Auditing Essentials......Page 790
IT Systems, Software, and Infrastructure Outsourcing......Page 791
IT Service Outsourcing......Page 803
Other Considerations for IT Service Outsourcing......Page 805
Third-Party Reports and Certifications......Page 806
Test Steps for Auditing Cloud Computing and Outsourced Operations......Page 811
Initial Steps......Page 812
Vendor Selection and Contracts......Page 818
Account Management and Data Security......Page 824
Operations and Governance......Page 837
Legal Concerns and Regulatory Compliance......Page 847
Tools and Technology......Page 852
Knowledge Base......Page 853
Master Checklist......Page 854
Chapter 17 Auditing Company Projects......Page 857
Background......Page 858
High-Level Goals of a Project Audit......Page 859
Basic Approaches to Project Auditing......Page 860
Waterfall and Agile Software Development Methodologies......Page 862
Seven Major Parts of a Project Audit......Page 865
Test Steps for Auditing Company Projects......Page 867
Overall Project Management......Page 868
Project Startup, Requirements Gathering, and Initial Design......Page 876
Detailed Design and System Development......Page 886
Testing......Page 888
Implementation......Page 894
Training......Page 898
Knowledge Base......Page 900
Master Checklists......Page 901
Background......Page 906
Generalized Frameworks......Page 907
Best Practices......Page 913
Initial Steps......Page 917
Account Management......Page 919
Permissions Management......Page 922
Network Security and Controls......Page 923
Security Monitoring and Other General Controls......Page 926
Master Checklists......Page 929
Part III Frameworks, Standards, Regulations, and Risk Management......Page 932
Chapter 19 Frameworks and Standards......Page 933
Introduction to Internal IT Controls, Frameworks, and Standards......Page 934
COSO......Page 935
Key Concepts of Internal Control......Page 937
Internal Control–Integrated Framework......Page 938
Enterprise Risk Management–Integrated Framework......Page 942
Relationship Between Internal Control and Enterprise Risk Management Publications......Page 947
IT Governance......Page 949
IT Governance Maturity Model......Page 951
COBIT......Page 954
ITIL......Page 957
ITIL Concepts......Page 958
ISO 27001......Page 959
ISO 27001 Concepts......Page 961
NIST Cyber Security Framework......Page 964
NSA INFOSEC Assessment Methodology Concepts......Page 976
Pre-assessment Phase......Page 977
Onsite Activities Phase......Page 978
Frameworks and Standards Trends......Page 979
Knowledge Base......Page 981
Chapter 20 Regulations......Page 984
An Introduction to Legislation Related to Internal Controls......Page 985
Regulatory Impact on IT Audits......Page 986
History of Corporate Financial Regulation......Page 988
The Sarbanes-Oxley Act of 2002......Page 989
SOX’s Impact on Public Corporations......Page 990
Core Points of the SOX Act......Page 991
SOX’s Impact on IT Departments......Page 995
Impact of Third-Party Services on SOX Compliance......Page 997
Specific IT Controls Required for SOX Compliance......Page 999
The Financial Impact of SOX Compliance on Companies......Page 1008
Gramm-Leach-Bliley Act......Page 1009
GLBA Requirements......Page 1010
Federal Financial Institutions Examination Council......Page 1012
General Data Protection Regulation......Page 1013
Additional Privacy Regulations......Page 1023
California Security Breach Information Act (SB 1386)......Page 1024
Canadian Personal Information Protection and Electronic Documentation Act......Page 1025
Privacy Law Trends......Page 1027
Health Insurance Portability and Accountability Act......Page 1029
HIPAA Privacy and Security Rules......Page 1030
The HITECH Act......Page 1031
HIPAA’s Impact on Covered Entities......Page 1032
Basel II Capital Accord......Page 1033
Payment Card Industry Data Security Standard......Page 1034
PCI Impact on the Payment Card Industry......Page 1039
Other Regulatory Trends......Page 1041
Knowledge Base......Page 1043
Chapter 21 Risk Management......Page 1048
Benefits of Risk Management......Page 1049
Risk Management from an Executive Perspective......Page 1051
Quantitative vs. Qualitative Risk Analysis......Page 1052
Elements of Risk......Page 1054
Practical Application......Page 1056
Addressing Risk......Page 1059
Common Causes for Inaccuracies......Page 1060
Quantitative Risk Analysis in Practice......Page 1064
IT Risk Management Life Cycle......Page 1065
Phase 1: Identify Information Assets......Page 1066
Phase 2: Quantify and Qualify Threats......Page 1073
Phase 3: Assess Vulnerabilities......Page 1084
Phase 4: Remediate Control Gaps......Page 1087
Phase 5: Manage Residual Risk......Page 1090
Risk Identification......Page 1092
Risk Assessment......Page 1093
Monitoring and Reporting......Page 1095
Knowledge Base......Page 1096
Index......Page 1097