SU4 General controls Flashcards
What are the categories of a computerised environment and define each.
Camputerised environment are categorised as either IT General controls or Automated application controls.
IT general controls are those which establish an overall framework of control for computer activities.
Automated application controls are controls that are relevant to a specific task within a cycle of the accounting system.
Benefits of IT controls (5) ?
1) Accurate complex calculations
2) Reduce risk of control override.
3) Proper controls are in place to ensure the validity, completeness and accuracy of the data.
4) Enhanced timeliness, availability and accuracy of info.
5) Improved security over systems and data and segregation of duties.
Name the categories of the roadmap of general controls.
IT general controls (1)- CAP Bus.
1) Control environment
2) Access controls
3) Programme maintenance
4) Business continuity controls
5) System development and implementation controls
IT general controls (2).
6) System software operating controls
7) End user computing
8) Documentation
Components of control environment
C- Communication and enforcement of integrity and ethical values
C- Commitment to competence
H- Human resources policies and practices
O- Organisational structure, assignment of authority and responsibility
M- Management philosophy and operating style
P- Participation by those charged with governance
What are the Human resource policies?
(WRITLAU)
R- Proper recruiting policies
T- Training and career development
I- Rotation of IT staff (relief boredom, non reliance on 1 person)
L- Compulsory leave (unauthorised activity uncovered)
A- Cancellation of access rights on dismissal
W- Written formalization of human resource policies for guidance
U- Policy regarding private use of computer facilities
Components of access control?
P- Physical access controls
O- Other access controls
L- Logical access controls
S- Security policy
What are the principles of the security policy and explain each.
Least privilege- employees should be given access to only those aspects of the system which are necessary for the proper performance of their duties
Fail safe- if a control fails whatever is being protected by that control, should remain safe
Defence in depth- protection is not left up to one control, but rather to a combination of controls
Logging- computer’s ability to log activity which takes place on it, should be extensively incorporated.
What are the two categories of physical access control?
Data centre
Work stations
Physical access control to data centre.
Visit from outside the company to IT building should:
- Be required to have an official appointment to visit IT staff
- On arrival be cleared – phone IT dept
- Provide ID tag + escort
- Locked door – no access – must buzz
- Wait in reception/be met at the door
- Escorted out once finished with business
Company personnel other than IT personnel:
- Must be no need for other personnel to enter the data Centre
Physical entry to the data Centre
(if you do need to enter):
- Only authorized person gain entry to the data Centre
- Access points should be limited to one
- Access should be gained through locked door other than when people are entering & exiting e.g. not popped open by a wastepaper basket for people to come and go
- Locked door deactivated only by swipe card, entry of PIN ect.
- TV surveillance for entry/exit points
- There should be no need for other personnel to enter the data Centre room
What are the physical access controls at remote workstations?
- Can be locked and secured to desk
- Placed where they are visible and not near a window
- Offices should be locked at night/weekends
Principles of logical access controls?
Identification of users and computer resources:
- User ID
- Biometric data
- Magnetic card
- Terminal ID
Authentication to verify user of an ID is the owner:
- Unique password
- Information unauthorized user would not know
- One time pin send per sms to user or dongle
Authorisation granted to programmes and data the user requires to do his job:
- user granted read only
- user can read and write; add, create and delete
- terminal links to specific applications
Logging is recording access and access violation to follow up later.
Principals of other access control?
1) Data communication- implementation of specialised software which:
- controls access to the network
- network management
- data and file transmission
- error detection and control
- data security
- encryption of transmitted data
- protection of physical cable
2) Firewalls- Combination of hardware and software that operates as access control gateways which restrict the traffic that can flow in and out.
3) Libraries- mobile storage devices must be physically access controlled:
- password protected
- externally labelled.
Describe password controls
The user should:
- not use obvious or easily guessed passwords
- minimum length (6 characters)
- not write down the password
- change the password regularly
- confidentiality (disciplinary steps if disclosed to other)
The system should:
- enable users to choose their own passwords
- mixture of alphabetical and numeric characters
- minimum characters
- not allow to reuse an old password within 12 months
- forced by system to change regularly every 30 days.
3) When logging on to the system:
- not show on the screen
- allow only 3 attempts
- not allow users to log on at more than one terminal at time
- terminal disconnects after a period of inactivity
- logged attempts for unauthorized access
Change management controls
- Program change standards (ISO 9000) must be adhere to
- Request for changes should be documented on a Pre-numbered, pre-printed changed control forms
- Approval of program change requests [users (application changes)/CIO (application & system changers) &
IT steering committee(more major changes] - Affected by programmers
- Program changes should be affected by programmers
- Major changes should be seen as a mini-project (see system development)
- Changes should be made to development program and not production program (not live data) - Changes should be tested by programmer & independent snr programmer (debug techniques)
As well as tested by users (user acceptance tests) & signed off - Changes should be discussed& approved by users and internal audit (sign off control form)
7 All documentation affected by change should be updated (doc change)
And amended program should be copies to live environment by independent technical administrator
Define continuity of operations
These are controls aimed at protecting computer from natural disasters as well as attack or abuse by unauthorized people
