isa 2
Post on 22-Jun-2015
89 Views
Preview:
DESCRIPTION
TRANSCRIPT
Information Security & Assurance
Information Security & Assurance – An Overview
Introduction
• Decision making process of legacy organization,• Now computerized• The inputs now are not easily available • Depends on certain computer-savvy employees to provide
desired information• Now called DATA• Apprehensive about taking decision as doubts creep up
like:
Introduction
• Do I need to know the technology to justify my role?
• How do I know that I am not being misguided by people - who some time takes me for granted?
Introduction
• Is power generally to the hands of those who have access to information? What will happen to my domain knowledge that I have painstakingly acquired?
• And finally, am I sitting on the fence because of these apprehensions?
Introduction
• Picture a situation where you want to purchase a commodity from a website
• It requires you to pay through credit card before you receive the goods
• A host of apprehensions surface in your mind, like:– Are the goods authentic?– Are they in a working order– If I send the money, what option will I have if I never receive
the goods, or if they are not of the standard or quality as represented?
Introduction – Is it safe to disclose my credit card information on the website?– Will my name, credit card information, and other particulars be
passed on to telemarketing agencies?
• First three reflects your apprehension about the organization,
• Last two reflects your conscious as a customer.• There are no any concrete answers to these questions.• What you really need is assurance!
Assurance services
• The AICPA’s (American Institute of Certified Public Accountants) special committee on assurance services defines assurance as:
– Independent professional services that improve the quality of information, or its context for decision makers
– The word Independent – unbiased
Need for Assurance
• In general, the need for assurance services arises because of:– Potential bias in providing information; that is the party
providing the information may want to convey a better impression than real circumstances merit
– Remoteness between a user and the organization or trading partner
– Complexity of the transactions, information or processing system
– Risk management – Voluminous data
Bias in Providing Information • Let us take example of lending activity
– Considerable likelihood that borrower may submit an inaccurate statement to increase the chances of obtaining loan.
• Likewise, the seller of goods and services has a vested interest in convincing you that product being sold is worth more than a similar product you could obtain from elsewhere.
Bias in Providing Information • The management of the company can also give
misinformation about its financial position to attract investment.
• In all the above cases, assurance will help provide reliable information to decision makers.
Remoteness of User
• Thanks to Internet
• Online buying and selling has certain concomitant disadvantages
• For instance, there is a absence of personal interaction with the seller
Remoteness of User
• Unable to physically examine the product before its purchase.
• This remoteness creates the need for assurance, regarding
– Trustworthiness of the individual seller– Quality of the product – Authenticity of the information received
Complexity of the system
• The complexity and dynamism of the IT system has undergone a dramatic change during last decade
• Today, domain knowledge alone may not be sufficient to understand the various ways in which controls are implemented.
• Probably need to have the knowledge of technology that drives the process.
• In such scenario, it is comforting to the management to know that they can seek assurance services whenever needed.
Risk Management
• Consider a bank manger’s decision to grant a loan to a business concern.
• If the bank decides to give the loan, it will charge a rate of interest determined primarily by three factors:– Cost of the fund– Business risk for the borrower– Information risk to the lender
Voluminous Data
• As organization grow and the volume of the organizational information and data increases,
• The chances of misstating facts also rises
• Sometimes, there may be a need to get an independent third party to identify and give an opinion about such misstatements.
Characteristics of Assurance Services
• Assurance services have three critical components:– An assurance provider
– Information or process on which the assurance is provided
– A user or group of users/beneficiaries who derive value from the assurance service provided
Types of Assurance Services
• Assurance services can be classified into– Attestation services
• Involve the evaluation of an assertion made by one party to a third party. • Traditional statutory audit
– Non-attestation services • Do not involve a third party • Internal and control self assessment audits are mainly self-imposed and do
not involve any third party.
Audit Audit
Compliance ReviewCompliance Review IS AuditIS Audit
Attestation Services
Internal auditInternal audit
Control self assessment auditControl self assessment audit
Management consulting Management consulting
Non-attestation services
Types of Assurance Services
Evolution of Information System Audit
• IS auditing, formerly called Electronic Data Processing (EDP) auditing
• Evolved as an extension of traditional auditing
• The need for IS Audit arose due to several reasons, some of which are:
– Auditors realized that a lack of knowledge of computers had adversely affected their ability to perform attestation functions
Evolution of Information System Audit
– The information processing management recognized that using computer systems was vital to compete effectively with other concerns in the business environment and like other valuable business resources within the organization, had a critical need to possess control and audit ability
– With the growing digitization of information, it was felt that evidence-collection, evaluation, and entire process of traditional audit needed a paradigm shift.
Evolution of Information System Audit
– Professional associations, organizations, government bodies, and regulators recognized the need for IT control and audit.
The IS – Lifecycle in the organization
• For any legacy organization, the IS deployment follows three phases– Pervasion
• Initial phase where the objective of organization is popularization of IT
– Consolidation • Second stage where the organization, widespread use of IT, tries to
consolidate the IS• Involve ascertaining who uses what, which technology is popular, any
constraint in the use of resources, etc.
– Control• Tries to put in a place an appropriate mechanism of control and security
•Uncontrolled use•No restriction•Popularization
•Uncontrolled use•No restriction•Popularization
•Consolidation •Standardization •Consolidation •Standardization
•Restriction •Control•Information Security Framework•Audit
•Restriction •Control•Information Security Framework•Audit
Pervasion Consolidation
Control
The lifecycle of IT absorption in an organization
The Knowledge Requirement of an IS professional(Auditor)
• Auditor should be a better at business than the client.
• IS auditor should be more familiar with the Information System than IS manager in the organization.
• To understand the role of IS auditor, it is important to first understand what IS audit is.
The Knowledge Requirement of an IS Auditor
• Ron Weber defines it thus:
– Information System auditing is the process of collecting and evaluating evidences to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively, and uses resources efficiently.
The Knowledge Requirement of an IS Auditor
• According to definition on previous slide, the job of IS auditor is to give assurance to the company that the computer system helps achieve the following objectives:
– Safeguarding assets – Maintaining data integrity – Fulfilling the organizational goal effectively – Consuming resources efficiently
The Knowledge Requirement of an IS Auditor
• Data integrity has no meaning in the organization if the assets are not safeguarded.
• Effectiveness has no meaning unless there is integrity of data and
• Efficiency (doing things right) is futile in the absence of efficacy (doing right things)
The Knowledge Requirement of an IS Auditor
• Assets Safeguarding – IT Governance Institute (USA), in its Governance model i.e.
COBIT (Control Objectives for Information and related Technology) has defined IT resources as being comprised of:• Data: objects in their widest sense – external and internal, structured
and non-structured, graphics, sound, etc. • Application Software: Sum of manual or programmed procedures• Technology: Hardware, Operating System, Database Management
Systems, Network, Multimedia, etc. • Facilities: Resources to house and support Information System• People: Includes staff skills, awareness and productivity in planning,
organizing, acquiring, delivering, supporting and monitoring IS and services.
The Knowledge Requirement of an IS Auditor
• Data Integrity– It refers to the accuracy and completeness of data, very
important from assurance point of view
• Effectiveness– Doing right things– From the IS point of view, it implies possession of knowledge
of user needs– Auditor must know the needs of the user and the nature of
the decision-making environment
The Knowledge Requirement of an IS Auditor
• Efficiency – From auditor’s perspective, is doing a job effectively, using
minimum resources or using minimal resources to achieve the desired objectives
Internal Control Project managementPhilosophy documentation
IS Audit
Computer Organizational domain behavior
ComputerScience
IS Management
BehavioralScience
Traditional Auditing
The Knowledge requirement for an IS auditor
Benefits of IS Audit For an Organization
• Some of the benefits organization receive are:– Mapping business control with IT application– Business Process Re-engineering – The IT Security Policy – Security awareness – Better return on Investment (ROI)– Risk Management
Changing Role of IS Auditors and the Relevance of COBIT
• Rapid technology changing.• Development of new business models.• Outsourcing, downsizing, decentralization.
Traditional Role New role
Detection Prevention
Policemen Business partner
Focus on audit Focus on business
Focus on cost Focus on customer
Focus on function Focus on process
Auditor Risk manager
Hierarchical Team
Quill pen Technology
top related