Understanding and Conducting Information Systems Auditing

1 - Understanding and Conducting Information Systems Auditing [Seite 3]
2 - Contents [Seite 9]
3 - Preface [Seite 13]
4 - Acknowledgments [Seite 17]
5 - PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT [Seite 19]
5.1 - Chapter 1: Overview of Systems Audit [Seite 21]
5.1.1 - Information Systems Audit [Seite 21]
5.1.2 - Information Systems Auditor [Seite 22]
5.1.3 - Legal Requirements of an Information Systems Audit [Seite 22]
5.1.4 - Systems Environment and Information Systems Audit [Seite 25]
5.1.5 - Information System Assets [Seite 26]
5.1.6 - Classification of Controls [Seite 27]
5.1.6.1 - General Controls [Seite 27]
5.1.6.2 - Application Controls [Seite 28]
5.1.6.3 - Objective-Based Control Classification [Seite 29]
5.1.7 - The Impact of Computers on Information [Seite 30]
5.1.8 - The Impact of Computers on Auditing [Seite 32]
5.1.9 - Information Systems Audit Coverage [Seite 33]
5.2 - Chapter 2: Hardware Security Issues [Seite 35]
5.2.1 - Hardware Security Objective [Seite 35]
5.2.1.1 - Asset Classification and Control [Seite 36]
5.2.1.2 - Physical Equipment Placement and Protection [Seite 37]
5.2.1.3 - Power Supplies [Seite 37]
5.2.1.4 - Cabling Security [Seite 38]
5.2.1.5 - Physical Access and Service Disruption [Seite 38]
5.2.1.6 - Other Concerns [Seite 39]
5.2.1.7 - Information Systems Facilities [Seite 40]
5.2.2 - Peripheral Devices and Storage Media [Seite 40]
5.2.2.1 - Management of Peripheral Devices [Seite 40]
5.2.2.2 - Management of Removable Computer Media [Seite 41]
5.2.3 - Client-Server Architecture [Seite 41]
5.2.4 - Authentication Devices [Seite 42]
5.2.5 - Hardware Acquisition [Seite 42]
5.2.6 - Hardware Maintenance [Seite 44]
5.2.7 - Management of Obsolescence [Seite 45]
5.2.8 - Disposal of Equipment [Seite 46]
5.2.9 - Problem Management [Seite 47]
5.2.10 - Change Management [Seite 48]
5.2.11 - Network and Communication Issues [Seite 49]
5.2.11.1 - Policy on Use of Network and Network Services [Seite 50]
5.2.11.2 - Enforced Path [Seite 51]
5.2.11.3 - User Authentication for External Connections [Seite 52]
5.2.11.4 - Node Authentication [Seite 52]
5.2.11.5 - Segregation of Networks [Seite 53]
5.2.11.6 - Network Connection Control [Seite 54]
5.2.11.7 - Network Routing Control [Seite 54]
5.2.11.8 - Security of Network Services [Seite 54]
5.2.11.9 - Other Network Controls [Seite 55]
5.2.11.10 - Network Integrity [Seite 56]
5.2.11.11 - Network Equipment [Seite 56]
5.2.11.12 - Change Control Procedure [Seite 57]
5.2.11.13 - Network Monitoring [Seite 57]
5.2.11.14 - Protection during Transmission [Seite 57]
5.2.11.15 - Network Availability [Seite 57]
5.2.11.16 - Wireless Network Considerations [Seite 58]
5.3 - Chapter 3: Software Security Issues [Seite 59]
5.3.1 - Overview of Types of Software [Seite 59]
5.3.1.1 - System Software [Seite 59]
5.3.1.2 - Operating Software [Seite 60]
5.3.1.3 - Memory Resident Programs [Seite 62]
5.3.1.4 - Utility Programs [Seite 62]
5.3.1.5 - Application Software [Seite 62]
5.3.1.6 - Communication Software [Seite 64]
5.3.1.7 - Database Management Systems [Seite 65]
5.3.2 - Elements of Software Security [Seite 65]
5.3.2.1 - Access Control [Seite 66]
5.3.2.2 - Operational Controls [Seite 68]
5.3.2.3 - Protection against Malicious Software [Seite 70]
5.3.2.4 - Information Backup [Seite 70]
5.3.2.5 - Operator 's Log [Seite 71]
5.3.3 - Control Issues during Installation and Maintenance [Seite 71]
5.3.3.1 - Preimplementation Issues [Seite 72]
5.3.3.2 - Postimplementation Issues [Seite 73]
5.3.4 - Licensing Issues [Seite 73]
5.3.5 - Problem and Change Management [Seite 74]
5.4 - Chapter 4: Information Systems Audit Requirements [Seite 77]
5.4.1 - Risk Analysis [Seite 77]
5.4.2 - Threats, Vulnerability, Exposure, Likelihood, and Attack [Seite 79]
5.4.3 - Information Systems Control Objectives [Seite 79]
5.4.4 - Information Systems Audit Objectives [Seite 80]
5.4.5 - System Effectiveness and Efficiency [Seite 81]
5.4.6 - Information Systems Abuse [Seite 81]
5.4.7 - Asset Safeguarding Objective and Process [Seite 82]
5.4.8 - Evidence Collection and Evaluation [Seite 83]
5.4.8.1 - Techniques of Audit Evidence Collection [Seite 84]
5.4.8.2 - Categories of Audit Evidence [Seite 84]
5.4.9 - Logs and Audit Trails as Evidence [Seite 85]
5.4.9.1 - Audit Trails [Seite 85]
5.4.9.2 - System Logs [Seite 87]
5.5 - Chapter 5: Conducting an Information Systems Audit [Seite 89]
5.5.1 - Audit Program [Seite 89]
5.5.1.1 - Audit Checklists [Seite 89]
5.5.1.2 - Resource Planning [Seite 90]
5.5.1.3 - Consistency [Seite 90]
5.5.2 - Audit Plan [Seite 90]
5.5.2.1 - Engagement Letter [Seite 91]
5.5.2.2 - Background Overview [Seite 92]
5.5.2.3 - Materiality Level [Seite 92]
5.5.2.4 - Techniques Used for Information Systems Planning [Seite 92]
5.5.3 - Audit Procedures and Approaches [Seite 93]
5.5.4 - System Understanding and Review [Seite 95]
5.5.5 - Compliance Reviews and Tests [Seite 95]
5.5.6 - Substantive Reviews and Tests [Seite 98]
5.5.7 - Audit Tools and Techniques [Seite 99]
5.5.7.1 - Testing Computer Application Program Controls [Seite 99]
5.5.7.2 - Selecting/Monitoring Data Processing Transactions [Seite 100]
5.5.7.3 - Data Verification [Seite 100]
5.5.7.4 - Analyzing Application Programs [Seite 101]
5.5.7.5 - Other Tools and Techniques [Seite 101]
5.5.8 - Sampling Techniques [Seite 102]
5.5.9 - Audit Questionnaire [Seite 103]
5.5.10 - Audit Documentation [Seite 104]
5.5.11 - Audit Report [Seite 105]
5.5.12 - Auditing Approaches [Seite 107]
5.5.12.1 - Auditing around the Computer [Seite 107]
5.5.12.2 - Auditing with the Computer [Seite 108]
5.5.12.3 - Auditing through the Computer [Seite 109]
5.5.13 - Sample Audit Work-Planning Memo [Seite 109]
5.5.13.1 - Audit Objectives and Scope [Seite 109]
5.5.13.2 - Audit Process [Seite 109]
5.5.13.3 - Testing Techniques [Seite 110]
5.5.13.4 - Audit Team Assignment [Seite 110]
5.5.13.5 - Activities and Deliverables [Seite 110]
5.5.14 - Sample Audit Work Process Flow [Seite 111]
5.6 - Chapter 6: Risk-Based Systems Audit [Seite 119]
5.6.1 - Conducting a Risk-Based Information Systems Audit [Seite 119]
5.6.2 - Risk Assessment [Seite 122]
5.6.3 - Risk Matrix [Seite 123]
5.6.4 - Risk and Audit Sample Determination [Seite 125]
5.6.4.1 - Sample Selection [Seite 126]
5.6.5 - Audit Risk Assessment [Seite 127]
5.6.5.1 - Audit Process and Audit Risk [Seite 127]
5.6.5.2 - Populating a Risk Matrix [Seite 129]
5.6.6 - Risk Management Strategy [Seite 130]
5.7 - Chapter 7: Business Continuity and Disaster Recovery Plan [Seite 133]
5.7.1 - Business Continuity and Disaster Recovery Process [Seite 133]
5.7.2 - Business Impact Analysis [Seite 134]
5.7.2.1 - Impact Analysis [Seite 134]
5.7.2.2 - Requirements for Recovery [Seite 135]
5.7.3 - Incident Response Plan [Seite 136]
5.7.4 - Disaster Recovery Plan [Seite 137]
5.7.5 - Types of Disaster Recovery Plans [Seite 138]
5.7.6 - Emergency Preparedness Audit Checklist [Seite 139]
5.7.7 - Business Continuity Strategies [Seite 140]
5.7.8 - Business Resumption Plan Audit Checklist [Seite 141]
5.7.9 - Recovery Procedures Testing Checklist [Seite 144]
5.7.10 - Plan Maintenance Checklist [Seite 144]
5.7.11 - Vital Records Retention Checklist [Seite 145]
5.7.12 - Forms and Documents [Seite 146]
5.7.12.1 - Alternative Site Procedure [Seite 146]
5.7.12.2 - Communication Resources [Seite 148]
5.7.12.3 - Contingency Log [Seite 149]
5.7.12.4 - Contingency Plan Contact Information [Seite 150]
5.7.12.5 - Documentation List [Seite 152]
5.7.12.6 - Emergency Procedures [Seite 152]
5.7.12.7 - External Support Agreement [Seite 157]
5.7.12.8 - Hardware Inventory [Seite 158]
5.7.12.9 - Information Asset Usage Procedure [Seite 159]
5.7.12.10 - Layout Inventory [Seite 160]
5.7.12.11 - Software Inventory [Seite 161]
5.7.12.12 - Team Staffing and Tasks [Seite 162]
5.7.12.13 - Vendor Contact List [Seite 163]
5.8 - Chapter 8: Auditing in the E-Commerce Environment [Seite 165]
5.8.1 - Introduction [Seite 165]
5.8.2 - Objectives of an Information Systems Audit in the E-Commerce Environment [Seite 166]
5.8.3 - General Overview [Seite 167]
5.8.4 - Auditing E-Commerce Functions [Seite 168]
5.8.4.1 - Preliminary Review [Seite 168]
5.8.4.2 - Implementation [Seite 169]
5.8.4.3 - Policies and Procedures [Seite 169]
5.8.4.4 - Administration [Seite 169]
5.8.4.5 - Accounting and Processing [Seite 170]
5.8.4.6 - Legal and Regulatory Matters [Seite 171]
5.8.4.7 - Internet Security Administration [Seite 171]
5.8.5 - E-Commerce Policies and Procedures Review [Seite 173]
5.8.6 - Impact of E-Commerce on Internal Control [Seite 173]
5.9 - Chapter 9: Security Testing [Seite 177]
5.9.1 - Cybersecurity [Seite 177]
5.9.2 - Cybercrimes [Seite 178]
5.9.3 - What Is Vulnerable to Attack? [Seite 180]
5.9.4 - How Cyberattacks Occur [Seite 180]
5.9.5 - What Is Vulnerability Analysis? [Seite 183]
5.9.5.1 - Steps of Vulnerability Analysis [Seite 183]
5.9.5.2 - Types of Vulnerability [Seite 184]
5.9.5.3 - Conducting a Vulnerability Analysis [Seite 185]
5.9.6 - Cyberforensics [Seite 186]
5.9.7 - Digital Evidence [Seite 188]
5.9.7.1 - Presenting Digital Evidence in a Court of Law [Seite 188]
5.9.7.2 - Acceptability Tests [Seite 190]
5.10 - Chapter 10: Case Study: Conducting an Information Systems Audit [Seite 191]
5.10.1 - Important Security Issues in Banks [Seite 192]
5.10.1.1 - User Access Management [Seite 192]
5.10.1.2 - User Registration [Seite 192]
5.10.1.3 - Authentication of Users [Seite 193]
5.10.1.4 - Password Management System [Seite 193]
5.10.1.5 - Limiting Sign-On Attempts [Seite 194]
5.10.1.6 - Unattended Terminals [Seite 194]
5.10.1.7 - Information Access Restriction [Seite 195]
5.10.1.8 - Use of System Utilities [Seite 195]
5.10.1.9 - Limitation of Connection Time [Seite 196]
5.10.1.10 - Warning [Seite 196]
5.10.1.11 - External Users [Seite 197]
5.10.1.12 - Audit Trails [Seite 197]
5.10.1.13 - Fault Logging [Seite 197]
5.10.1.14 - Logging and Reviewing of Events [Seite 198]
5.10.2 - Implementing an Information Systems Audit at a Bank Branch [Seite 198]
5.10.3 - Special Considerations in a Core Banking System [Seite 203]
5.10.3.1 - Migration Controls [Seite 204]
5.10.3.2 - Day-End Controls [Seite 204]
5.10.3.3 - Control over Periodical/Mass-Runs (System Generated Transactions) [Seite 205]
5.10.3.4 - Control over Inter-SOL Transactions [Seite 205]
5.10.3.5 - Control over Proxy/Parking Transactions [Seite 205]
5.10.3.6 - Mapping of Accounts [Seite 206]
5.10.3.7 - Application Control Review [Seite 206]
5.10.3.8 - Database and System Administration [Seite 207]
5.10.3.9 - Firewalls [Seite 209]
5.10.3.10 - Help Desk [Seite 212]
5.10.3.11 - Information Security [Seite 212]
5.10.3.12 - Logs of Activity [Seite 212]
5.10.3.13 - Departure from Normal Patterns [Seite 213]
5.10.3.14 - Management Practices [Seite 213]
5.10.3.15 - Operational Activities [Seite 214]
6 - PART TWO: INFORMATION SYSTEMS AUDITING CHECKLISTS [Seite 215]
6.1 - Chapter 11: ISecGrade Auditing Framework [Seite 217]
6.1.1 - Introduction [Seite 217]
6.1.2 - Licensing and Limitations [Seite 218]
6.1.3 - Methodology [Seite 218]
6.1.4 - Domains [Seite 218]
6.1.5 - Grading Structure [Seite 220]
6.1.6 - Selection of Checklist [Seite 221]
6.1.7 - Format of Audit Report [Seite 224]
6.1.8 - Using the Audit Report Format [Seite 225]
6.2 - Chapter 12: ISecGrade Checklists [Seite 227]
6.2.1 - Checklist Structure [Seite 227]
6.2.2 - Information Systems Audit Checklists [Seite 228]
6.3 - Chapter 13: Session Quiz [Seite 299]
6.3.1 - Chapter 1: Overview of Systems Audit [Seite 299]
6.3.2 - Chapter 2: Hardware Security Issues [Seite 302]
6.3.3 - Chapter 3: Software Security Issues [Seite 304]
6.3.4 - Chapter 4: Information Systems Audit Requirements [Seite 306]
6.3.5 - Chapter 5: Conducting an Information Systems Audit [Seite 308]
6.3.6 - Chapter 6: Risk-Based Systems Audit [Seite 311]
6.3.7 - Chapter 7: Business Continuity and Disaster Recovery Plan [Seite 312]
6.3.8 - Chapter 8: Auditing in an E-Commerce Environment [Seite 314]
6.3.9 - Chapter 9: Security Testing [Seite 315]
7 - About the Authors [Seite 317]
8 - About the Website [Seite 319]
9 - Index [Seite 321]
10 - EULA [Seite 335]