P1.F.2 Data Governance Flashcards
Data Governance Definition & Objectives
P1.F.2 Data Governance
The control of enterprise data through formal policies and procedures to help ensure data can be trusted and is accessible.
Functions are part of Enterprise Risk Management (ERM).
Objectives
- Availability: to anyone who needs them
- Usability: in a useful format
- Integrity: veracity of data in terms of accuracy and validity over its useful life
- Security: preservation of integrity
Data Governance Framework
P1.F.2 Data Governance
Purpose: to eliminate gaps.
COSO: implements and manages internal controls, enterprise risk, and fraud deterrence.
Integrates internal control, SOX requirements and strategic planning in order to manage risk.
COBIT: based on information technology. Consists of principles, objectives, components, focus areas and design factors.
COSO Objectives
P1.F.2 Data Governance
- Strategic: development of high-level goals.
- Operations: proper management of the day-to-day activities.
- Reporting: reliability of financial/operational reporting an reduce risk.
- Compliance: compliance with laws and regulations can reduce company’s risk.
COSO Components
P1.F.2 Data Governance
- Internal environment: corporate culture, overall setting, general tone
- Objective setting: statement of goals
- Event identification: identify company’s objectives as opportunity or risk.
- Risk assessment: impact and probability of occurrence.
- Risk response: possible responses include avoidance, acceptance, mitigation, transfer or retention of risk.
- Control activities: policies and procedures to execute response
- Information and communication: pertinent information transmitted to relevant parties.
- Monitoring: ongoing assessment and modifications, if applicable.
COBIT Principles
P1.F.2 Data Governance
- Each enterprise needs a governance system.
- Built from a number of components that can work together in a holistic way.
- Should be dynamic.
- Should clearly distinguish between governance and management activities and structures.
- Tailored to enterprises needs
- Should cover end to end (on all processing).
COBIT Objectives
Governance Domain
(P1.F.2 Data Governance)
Evaluate, Direct and Monitor (EDM): the governing body evaluates strategic options, directs senior management on the chosen strategic options, and monitors the achievement of strategy.
COBIT Objectives
Management Domain
(P1.F.2 Data Governance)
- Align, Plan and Organize (APO): addresses overall organization, strategy, and supporting activities for IT.
- Build, Acquire, and Implement (BAI): treats the definition, acquisition and implementation of IT solutions and their integration in business processes.
- Deliver, Service and Support (DSS): addresses the operational delivery and support of IT services, including security.
- Monitor, Evaluate and Assess (MEA): addresses performance monitoring and conformance of IT with internal performance targets, internal control objectives and external requirements.
COBIT Components
P1.F.2 Data Governance
- Processes
- Organizational structures: are the key decision making entities
- Principles, policies and frameworks: translates desired behavior into practical guidance for day-to-day management
- Information
- Culture, ethics and behavior: underestimated factors
- People, skills and competencies
- Services, infrastructure and applications
Data Life Cycle Phases
P1.F.2 Data Governance
- Data capture: captured from a variety of sources
- Data maintenance: processing via create, read, update and delete (CRUD)
- Data synthesis: creating new data from existing data
- Data usage: extracting useful information from data
- Data analytics: usage that involves evaluating information to make decisions
- Data publication: reporting outside of the organization
- Data archival: storage of inactive data
- Data purging: deleting unwanted data
Defenses from Cyberattacks
Detection Defenses
(P1.F.2 Data Governance)
- Antivirus software: scans storage systems and downloading activity for known threats (detection)
- Packet filtering: routers and firewalls can block packets based on source/ destination
- Intrusion detection system (IDS): monitors network for suspicious patterns in incoming traffic.
4 Intrusion prevention system (IPS): blocks traffic flagged by IDS.
Defenses from Cyberattacks
Physical Defenses
(P1.F.2 Data Governance)
- Access control: physical barrier to on-site premises
- Biometrics: identification of authorized users via unique physical features of their bodies
- Do-not-carry rules: policy preventing employees and reps from carrying internet-connected devices under certain circumstances.
Defenses from Cyberattacks
Technological Defenses
(P1.F.2 Data Governance)
- Penetration test: sanctioned attempt to break into system to find vulnerabilities
- Vulnerability assessment: scans, prioritizes possible ways to penetrate
- Encryption: makes data unreadable by destinations without correct decryption key
- Authentication: act of ensuring the person trying to access system is who they claim to be
- Remote wipe capabilities (or mobile kill switch): tool to delete data stores on lost/stolen mobile devices
- Business continuity planning: critical for recovery from cyber incidents.
