信息系統(tǒng)審計講lecture 4

Informationsystemsauditing2015YingQianContentITbasicsInternetandwebtechnologyInformationTechnologyBasicsThemostbasicformofinformationtechnologyInputProcessOutput

IPOInputKeyboardSensorOutputFileReportProcessingprogramsPersonalComputer’sIPOInput:KeyboardMouseTouchscreenDiskdriverOutputTouchscreenDiskdriverPrinterProcessing:CPUMotherboardRAMROMMemoryRequirementofISConfidentialitywhohasaccesstothehardware,logicalorphysical?

WhohasaccesstothedataandIntegrityWhocanmakechangestothedata?

Who’sreviewingthosechangestothedatatoseeifthechangewasauthorized?

Availabilitydataand/orsystemisavailablewhenitisneededITauditor’sconcernoverhardwareDoesthevendorstillsupportthehardwareorhasitreachedEOL(end-of-life)andisunsupported?Ifitbreaksitcan’tbefixedThehardwarehasBIOS(BasicInputOutputSystem)whichisbeingupdatedbythevendor,typicallytosupportnewfunctionsand/orfeatures.

IstheBIOScurrent,andistheBIOSprotected?”

Whydoyouaskifitisprotected?

ITauditor’sconcernoversoftwareProtectedfrommaliciousmischief.Unauthorizedsoftwarechangelackofchangemanagementlackofreconciliation(waitaminutethat’sthefinancialauditorsjob)separationofdutiesITauditor’sconcernoverdistributedsystemandc/stechnologyHowtoensureconfidentialityofthedatawhenthedataistransmitted?

Howdoyouensureintegrityofthedatabeingtransmittedhowtomakesurethelocalsystemisavailableifthehomeofficesystemgoesdown?

ITauditor’sconcernoverremoteaccessWasremoteaccessapproved?Isremoteaccessviaanencryptedcommunicationlink?Isthelaptopprotected(keylock,harddiskencryption)?Isthereascreensaverandisitpasswordprotected?Istwo-factorauthenticationrequiredtoaccessthenetwork?Isnetworkaccessrestrictedfromknownlocations?Ifmodemsareusediscall-backemployed?ITsystemmaintenanceArethesystemsbeingmaintainedandarepatchesbeingappliedinatimelymanner?

Whatisthesecuritythatsurroundssystemmaintenance?Cananyoneupdatetheanti-virusdefinitionfile?

Whocheckstoseeifthisisdone,assumingthattheend-useristheoneresponsibleforupdatingthe.datfile?

Themostbasicandfundamentalquestionofall,“DoallandIrepeatALLchangesgothroughchangemanagement?”InternetandWebTechnologyDMZnetworkaDMZordemilitarizedzone(sometimesreferredtoasaperimeternetwork)isaphysicalorlogicalsubnetworkthatcontainsandexposesanorganization'sexternal-facingservicestoalargeranduntrustednetwork,usuallytheInternet.ThepurposeofaDMZistoaddanadditionallayerofsecuritytoanorganization'slocalareanetwork(LAN);anexternalnetworknodeonlyhasdirectaccesstoequipmentintheDMZ,ratherthananyotherpartofthenetwork.Thenameisderivedfromtheterm"demilitarizedzone",anareabetweennationstatesinwhichmilitaryoperationisnotpermitted.ServicesintheDMZWebserversMailserversFTPserversVoIPserversProxyserverwithintheDMZCompliancewithlegalstandardsandmonitoringreasons,someenterprisesinstallaproxyserverwithintheDMZ.Obligesinternalusers(usuallyemployees)tousetheproxyserverforInternetaccess.ReducedInternetaccessbandwidthrequirementssincesomewebcontentmaybecachedbytheproxyserver.Simplifiesrecordingandmonitoringofuseractivities.Centralizedwebcontentfiltering.RelatedrisksIncorrectrouter/firewallconfigurations(notaccordingtoorganizationspecifications)Inadequateconfigurations(donotworkasdesigned)Abilityforremoteuserstobypasstheborderrouterandfirewallandgetdirectaccesstothedatabaseserver(e.g.viaamodeminstalledforsupport)AbilitytospooftheinternalIPAddressandbypassthewebserverInternaluserswhohavemaliciousintentandbybeinginternaldonotgothroughthefirewalland/orborderrouterSystemadministratorshavingunlimiteddirectaccesstothedatabaseDevelopersnotbeingadequatelytrainedinsecurecodingtechniquesforwebapplicationdevelopmentinsiderabusesCollusionbetweenaninsiderandanoutsider(towit,I(outsider)placeanorderfor3new53”colorTVs,andmypartner(insider)goesinandadjuststheitempricefromseveralthousanddollarsto$0.33each.

WhentheorderisinvoicedIpay$0.99for3new53”colorTVs.Unauthorizedaccessbyinsider(maybeIchangethedeliverylocationtobemyapartment,in