Domain 4: Change and incident Management Flashcards
cyclic redundancy check (CRC)
The accuracy of blocks of data transfers, such as data transfer from hard disks, is validated by a cyclic redundancy check (CRC).
Checksum
A checksum or digital signature is commonly used to validate the integrity of a downloaded program or other transferred data.
Emergency Releases
Emergency releases to an application are fixes that require implementation as quickly as possible to prevent significant user downtime. Emergency release procedures are followed in such situations.
Code Signing
Code signing ensures that the executable code came from a reputable source and has not been modified after being signed.
configuration management
The configuration management process may include automated tools that will provide an automated recording of software release baselines. Should the new release fail, the baseline will provide a point to which to return.
Baseline
baseline itself refers to a standard configuration
DBA Responsibilities
A. Performing database changes according to change management procedures would be a normal function of the database administrator (DBA) and would be compliant with the procedures of the organization.
B. Installing patches or upgrades to the operating system is a function that should be performed by a systems administrator, not by a DBA. If a DBA were performing this function, there would be a risk based on inappropriate segregation of duties.
C. A DBA is expected to support the business through helping design, create and maintain databases and the interfaces to the databases.
D. The DBA often performs or supports database backup and recovery procedures.
postincident review
A postincident review examines both the cause and response to an incident. The lessons learned from the review can be used to improve internal controls. Understanding the purpose and structure of postincident reviews and follow-up procedures enables the information security manager to continuously improve the security program. Improving the incident response plan based on the incident review is an internal (corrective) control.
developer requires full access to production data
Providing separate login IDs that would only allow a developer privileged access when required is a good compensating control, but it must also be backed up with monitoring and supervision of the activity of the developer.
Availability vs. Integrity of Data
Because most data in a data warehouse are historic and do not need to be changed, applying read-only restrictions prevents data manipulation.
Backups address availability, not integrity. Validated backups ensure that the backup will work when needed.
DBA User Account
The use of a DBA user account is normally set up to log all changes made and is most appropriate for changes made outside of normal hours. The use of a log, which records the changes, allows changes to be reviewed. Because an abbreviated number of steps are used after hours, this represents an adequate set of compensating controls.
Fallback Procedures
Fallback procedures are used to restore a system to a previous state and are an important element of the change control process. The other choices are not related to the change control process—a process which specifies what procedures should be followed when software is being upgraded but the upgrade does not work and requires a fallback to its former state.
configuration management database (CMDB)
The configuration management database (CMDB) is used to track configuration items (CIs) and the dependencies between them. An out-of-date CMDB in a large multinational company could result in incorrect approvals being obtained, or leave out critical dependencies during the test phase.
Steps to Problem Management
A. Analysis and resolution are performed after logging and triage have been performed.
B. Exception ranking can only be performed once the exceptions have been reported.
C. The reporting of operational issues is normally the first step in tracking problems.
D. Root cause analysis is performed once the exceptions have been identified and is not normally the first part of problem management.
software version control system
It is common practice for software changes to be tracked and controlled using version control software. An IS auditor should review reports or logs from this system to identify the software that is promoted to production. Only moving the versions on the version control system (VCS) program will prevent the transfer of development or earlier versions.
