BEC IT2 Flashcards
_____ concerns the completeness, validity, accuracy, timeliness, and authorization of system process.
Processing integrity
An organization implements an integrated package of authentication controls related to its critical systems. This is an example of:
Defense in depth.
_____ concerns whether the system is operational and usable as specified in commitments and agreements.
Availability
According to the AICPA ASEC, the requirement of notice related to privacy states:
Individuals must be told about privacy policies including why information is collected, used, retained, and disclosed.
The AICPA Assurance Services Executive Committee (ASEC) principles and criteria can be used to evaluate:
(1) the controls of a system and (2) the confidentiality and privacy of the information processed by the system.
ASEC specifies five trust services principles:
- Security- foundation of systems reliability. Security procedures restrict access to authorized users only, protect the confidentiality and privacy of sensitive information, provide integrity of information, and protect against attacks. Security is a top management issue.
- Availability concerns whether the system is operational and usable as specified in commitments and agreements.
- Processing integrity concerns the completeness, validity, accuracy, timeliness, and authorization of system processing.
- Confidentiality concerns whether confidential information is protected consistent with the organization’s commitments and agreements.
- Privacy addresses whether the system’s collection, use, retention, disclosure, and disposal of personal information conforms to its own commitments and with criteria set forth in generally accepted privacy principles (GAPP). . GAPP includes these 10 subprinciples.
Time-based model of controls
P>D+C, so time it takes intruder to break through should be more than time to defect and correct attack for system to be effective
Defense in depth
The strategy of implementing multiple layers of controls to avoid having a single point of failure. Combination of firewalls, passwords, etc.
IT detective controls include:
- Log analysis (audit log)
- Intrusion detection systems
- Managerial reports (downtime due to security issues)
- Security testing
IT corrective controls include:
- Computer emergency response team (CERT)
- Chief security officer hired
- Patch management for known issues
Assessments of cyber risk impact:
Should assess the likelihood and severity of impacts and should be led by senior management in consultation with business and IT stakeholders.
Managing cyber risks requires:
Attempting to prevent cyber breaching but addressing those that occur through detective and corrective controls.
Principle 6—The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
Unless management understands which systems are critical to organizational objectives and which are not, it will underallocate scarce resources to mission-critical systems and overallocate resources to unimportant systems.
Principle 7—The organization identifies risks to the achievement of its objectives across the entity and analyzes risks in order to determine how the risks should be managed.
Principle 8—The organization considers the potential for fraud in assessing risks to the achievement of objectives.
led by senior management, in collaboration with business and IT stakeholders
Principle 9—The organization identifies and assesses changes that could significantly impact the system of internal control.
Rapidly changing technologies and cyber-criminals’ quick adaption to these changes yields new methods of exploiting system vulnerabilities
Principle 10—The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
Principle 11—The organization selects and develops general control activities over technology to support the achievement of objectives.
Principle 12—The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.
Preventive, detective, and corrective controls are all essential to addressing cyber risks. Well-designed preventive controls may stop attacks from being realized by keeping intruders outside of the organization’s internal IT environment and keeping the information systems secure.
Principle 13—The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
Control system data must be transformed into actionable, high-quality information that informs and communicates about the effectiveness of cyber-related controls.
Principle 14—The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
Communication about cyber risks should include all personnel, personnel responsible for managing and monitoring cyber risks and controls, and the board of directors.
The need for a cybersecurity framework
The goals of the framework included creating a common language for understanding, and cost-effective means for managing, organizational cybersecurity risks without imposing regulations.
The need for a cybersecurity framework
The goals of the framework included creating a common language for understanding, and cost-effective means for managing, organizational cybersecurity risks without imposing regulations. Consists of 3 parts: the core, the profile, the implementation tiers.
Core elements of cybersecurity framework:
- Functions -cybersecurity activities and include: Identify, Protect, Detect, Respond, and Recover (5 core functions). They help manage cybersecurity risk by organizing information, enabling risk management, addressing threats, and enabling learning through monitoring.
- Categories -cybersecurity outcomes that link to organizational needs and activities. Examples of categories are: asset management, access control, physical security, and incident detection processes.
- Subcategories- divide categories into specific outcomes of technical and/or management activities, high-level control goals. Examples include: Identify and catalog external information systems; Protect data at rest.
- (Informative) References- are specific standards, guidelines, and practices that provide benchmarks and methods for achieving the control goals (i.e., outcomes) found in the subcategories.
Complete the missing words in the following sentence: ____ are actions that implement _____.
Procedures, policies
All polities, including IT policies should:
- Be linked to the entity’s strategy and objectives
- Need an owner who is responsible for ensuring that the policy is operating and is updated
- Need a process for evolving with change
- Should include a title, purpose, scope and context, statement of responsibilities, and time for updating
Important IT policies:
- Values and Service Culture—What is expected of IT function personnel in their interactions with clients and others
- Contractors, Employees, and Sourcing—Why, when, and how an entity selects IT human resources from among employees or outside contractors
- Electronic Communications Use—Policy related to employee use of the Internet, intranet, email, blogs, chat rooms, and telephones
- Use and Connection Policy—Policy that states the entity’s position on the use of personal devices and applications in the workplace and connection to the entity’s systems.
- Procurement—Policy on the procurement processes for obtaining IT services
- Quality—Statement of IT performance standards
- Regulatory Compliance—Statement of regulatory requirements of IT systems
- Security—Policy related to guarding against physical or electronic threats to IT. May include disaster recovery preparation policies
- Service Management and Operational Service Problem Solving—Policies for ensuring the quality of live IT services
E-business is
Business process that relies on electronic dissemination of information or on automated transaction processing. Conducted within the organization as well as between the organization and its trading partners.
E-commerce is
This term is narrower than e-business and is used to refer to transactions between the organization and its trading partners.
Types of E-commerce
Business-to-Business (B2B) E-Commerce
Business-to-Consumer (B2C) E-Commerce— relies heavily on intermediaries or brokers to facilitate the sales transaction.
Business-to-Employee (B2E)—Involves the use of web-based technology to share information with, and interact, with an organization’s employees
Business-to-Government (B2G)
Risks of E-commerce:
- System availability- don’t want system to go down
- Security and confidentiality
- Authentication- must trust the person is who they say they are
- Nonrepudiation- audit trail that renders transaction verifiable
- Integrity- secure from hackers
E-commerce models:
- Electronic Marketplaces and Exchanges—These marketplaces bring together buyers and sellers of goods who connect virtually rather than physically to one another. Ex. eBay.
- Viral Marketing—Organizations increasingly attempt to increase brand awareness or generate sales by inducing people to send messages to friends using social networking applications.
- Online Direct Marketing—Many companies now have large online presences to sell directly to consumers or other businesses. Ex. Amazon.
- Electronic Tendering Systems—These tendering or bidding systems allow companies to seek bids for products or services that the organizations wish to purchase. Also called “e-procurement systems.”
- Social Networking/Social Computing—Is concerned with how people use information systems to connect with others.
Which of the following statements is correct concerning the security of messages in an electronic data interchange (EDI) system?
Encryption performed by a physically secure hardware device is more secure than encryption performed by software.
E-commerce applications:
- Customer relationship management- retain and gain customers, analyze info to develop personalized marketing plans
- Electronic data interchange (EDI)
- Electronic funds transfer (EFT)- ATM, POS terminals, direct deposit, Paypal (token-based payments), allows transfer of funds from one bank account directly to another
- Supply chain management (SCM)-incorporates all activities from purchase of raw materials to sale and consumption
Electronic data interchange (EDI)
Computer-to-computer exchange of business data in structured formats allowing direct processing of the data by the receiving system; EDI reduces handling costs and speeds transaction processing compared to traditional paper-based processing. EDI requires that all transactions be submitted in a specified format; translation software is required to convert transaction data from the internal company data format to the EDI format and vice versa. The vast majority of EDI transactions are still processed through value-added networks due to well-established controls, security and audit trails.
Risk of cloud computing:
- Unauthorized cloud activity- put preventive and detective controls in place
- Lack of CSP transparency- only used pre-approved cloud vendors
- CSP reliability and performance- effective incident management procedures must be in place
- Cyber attack- Incident management plan that considers increased risk of attack on CSP
Risk management plan for cloud computer should include who?
Senior management and IT steering committee, if risk is substantial, include the BOD
According to COSO, which of the following differences relevant to the risk assessment process is most likely to exist between a large entity and a small entity?
The CEO of a small entity is more likely than the CEO of a large entity to be attuned to risks arising from internal factors through hands-on involvement with all levels of personnel. The engagement of the owner in a small entity is likely to improve the assessment of risks because of their hands-on involvement with all levels of personnel.
An internal cloud is:
A cloud that is behind an entity’s firewall.
A cloud computing system solution integrates which of the following elements?
A business process, a deployment model, and a service delivery model. Effective cloud solutions require considering and integrating a relevant business process, a deployment model and a service delivery model.
A small accounting firm buys SaaS from a third-party CSP. As a part of this process, the accounting firm regularly requests and receives data about the system’s performance of the CSP. This is an example of managing which of the following cloud-computing risks?
Lack of CSP transparency
Which of the following statements is true regarding small business computing?
Spreadsheets should be reviewed and tested by an independent third party.
Which of the following critical accounting function is most likely to be absent in a small business computing environment?
Authorization.
Which of the following is an effective control related to personal computing in a small business?
Locking doors when offices are open and removing storage devices to secure locations.
Small business and segregation of duties
Because there are too few individuals to provide for segregation of duties, incompatible functions are frequently combined. It is critical to effective control that the functions of authorization, custody of assets, and record keeping be separated. If essential, the duties of authorization and review/auditing may be combined.
Specific Risks and Controls Related to Small-Organizational Computing
- Physical Access— make sure that doors are locked when offices are open and that removable storage devices are stored in secure locations.
- Logical Access—All machines should require a username and password
- Data Backup Procedures—Company-wide standards for backing up files should be established and enforced
- Program Development and Implementation—User-developed programs—which include spreadsheets and databases—should be subject to third-party review and testing
- Data Entry and Report Production— all work should be regularly reviewed by an independent third party.
Mobile device risks
- Malicious applications—Mobile devices are susceptible to malicious applications that contain hidden functionalities to collect and transmit user data to third parties.
- Loss and theft—The ubiquity and portability of mobile devices makes them particularly vulnerable to loss or theft, system capabilities must enable blocking the device from accessing organizationally sensitive systems.
- Restricting access and permission rights—may be desirable to allow users fewer access and permission rights on mobile devices. (called view-only access).
A data warehouse in an example of
Online analytical processing.
The multi-location system structure that is sometimes called the “Goldilocks” solution because it seeks to balance design tradeoffs is
Distributed
A distributed processing environment would be most beneficial in which of the following situations?
Large volumes of data are generated at many locations and fast access is required.
Multi-location system structures:
- Centralized system- Maintain all data and perform all data processing at a central location, slower response but higher security and consistency
- Decentralized system- Allow each location to maintain its own processing system and data files, most of the transaction processing is accomplished at the regional office, and summarized data is sent to the central office, better responsiveness but greater potential security violations
- Distributed (hybrid) system- rather than maintaining a centralized or master database at a central location, the database is distributed across the locations according to organizational and user needs, more current and complete information, better communication among remote locations to distribute database (but extra cost of doing so)
Components of a network:
- Nodes- any device connected to the network (client node, server node)
- Transmission media
- Network operating system
- Communications devices (modem, hub, repeaters, multiplexers, concentrators, bridges, routers, gateways)
Transmission media
- Wire communications
a. Copper or twisted pair-Traditionally used for phone connections, The slowest, least secure (e.g., easy to tap) and most subject to interference of the wired media, Least expensive media
b. Coaxial cable— faster, more secure, and less subject to interference but slightly higher cost.
c. Fiber optic cable—Extremely fast and secure, fiber optic cable communications are based on light pulses instead of electrical impulses; therefore, they are not subject to electrical interference - Wireless communications
a. Microwave transmission— used primarily by WANs.
b. Wi-Fi or spread-spectrum radio transmission-Found in both LANs and WANs, slower than wired systems using coaxial cable or fiber optic cable
c. Bluetooth—Uses the same radio frequencies as Wi-Fi but with lower power consumption resulting in a weaker connection
c. Digital cellular (cellular digital packet data, or CDPD)—transmission of data over the cell network; used by WANs.
Types of networks:
- Local Area Networks (LANs)- use dedicated lines
- Wide Area Networks (WANs)—Although WANs can vary dramatically in geographic area, most are national or international in scope.
- Storage Area Networks (SANs)— LANs that connect storage devices to servers
- Personal Area Networks (PANs)—Often a home network that links devices used by an individual or family to one another and to the Internet.
Networks can be public or private.
The data control protocol used to control transmissions on the Internet is
Transmission control protocol/Internet protocol (TCP/IP) is the protocol used by the Internet. TCP/IP is a packet-switched network protocol. The Internet is the world’s largest packet-switched network.
Which of the following technologies is specifically designed to exchange financial information over the World Wide Web?
Extensible business reporting language (XBRL).
The Internet is made up of a series of networks which include
Gateways to allow mainframe computers to connect to personal computers.
