Im 341

Front 1

threat
exposure/impact
likelihood

Back 1

-potential adverse occurrence or unwanted event that could harm AIS
-potential dollar loss if a threat happens
-probability a threat will happen

Front 2

internal control

Back 2

a process implemented by the BODs, mgmt, etc to provide a reasonable assurance the control objectives are achieved

Front 3

3 functions of internal controls (3 controls)

Back 3

preventative, detective, corrective

Front 4

2 kinds of internal controls

Back 4

general controls-to make sure control environment is stable and well managed (sec. mgmt ctrls, IT infra.)

application controls- prevent, detect, and correct transaction errors and fraud (accuracy, completeness of data in the system)

Front 5

PCAOB

Back 5

public company accounting oversight board- to control auditing profession; part of SOX; SEC appoints; 3 non CPAs

Front 6

belief system
boundary system
diagnostic control system
interactive control system

Back 6

4 levers to reconcile conflict b/t creativity and controls
-communicate cores values to inspire employees
-help to act ethically by setting limits (ie- min stds of perform, off limit activities)
-compare actual to planned performance to ensure efficient and effective achievement of goals
-for top management and high level activities that need regular attention (developing strategy, setting objectives)

Front 7

3 control frameworks to help internal control

Back 7

COBIT- control objectives for information related technology
COSO Internal control framework- Committee of Sponsoring Organizations
COSO ERM Framework

Front 8

COBIT- what it is and 3 dimensions

Back 8

generally applicable info systems security and control practices for IT ctrl; helps mgrs to balance risk and control

business objectives, IT resources, IT processes

Front 9

Internal Control- Integrated Framework
what is and components

Back 9

defines controls and provides guidance for enhancing them

-control environment, control activities, risk assessment, information and communication, and monitoring

Front 10

Enterprise Risk Management- Integrated Framework
what is and elements (3D block)

Back 10

expands on Internal Control Framework- a comprehensive process

-Objectives, Units (subsidiary, business unit, division, entity-level), and 8 risk and control components

Front 11

Objectives of ERM framework

Back 11

strategic (high level goals)
operations (effectiveness and efficiency)
reporting (accuracy, completeness, reliability)
compliance (with laws and regs)

*reporting and compliance assured

Front 12

8 risk and control components of ERM

Back 12

Internal Environment
Objective Setting
Event Identification
Risk Assessment
Risk Response
Control Activities
Information and Communication
Monitoring

Front 13

risk appetite

Back 13

part of internal environment; amount of risk willing to accept to achieve goals

Front 14

audit committee

Back 14

entirely outside, independent directors (no fees)- oversee internal control

Front 15

Policies and Procedure manual

Back 15

part of Internal Environment; method to assigning authority and responsibility; explains proper practices, experience needed, policies, etc

Front 16

fidelity bond insurance

Back 16

protects companies from losses that arise from fraud by bonded employees

Front 17

Event

Back 17

event- incident emanating from internal or external source that affects implementation of strategy/achievement of objectives; can be positive or negative
*identify to determine risk appetite

Front 18

2 types of risk

Back 18

inherent- risk that exists before management takes steps to control the likelihood of a risk

residual- risk that remains after mgmt implements internal controls

Front 19

4 ways to respond to risk

Back 19

reduce the likelihood and impact
accept and don't act to prevent it
share it (ie insurance)
avoid it and don't do the activity

Front 20

expected loss (cost) and value of an internal control

Back 20

impact*likelihood
value is the difference between the expected loss with the procedure and expected loss without it

Front 21

control activities- what they do

Back 21

provide assurance that control objectives are met and ensure compliance

Front 22

authorization, digital signature

Back 22

empowers employees to perform activities; documented via
-digital signature- sign doc on a computer with data that can't be forged

Front 23

types of authorization

Back 23

general- employees handle routine activities
specific- activities or transactions of great consequence that requires management review

Front 24

segregation of accounting duties

Back 24

separate authorization, recording and custody functions

Front 25

systems administrators

Back 25

ensure different parts of the information system is running smoothly

Front 26

network managers

Back 26

make sure all applicable devices are hooked to the network and that the networks operate continuously

Front 27

security management

Back 27

ensure system is secure and protected from threats

Front 28

change management

Back 28

manage changes to info system and make sure they are made smoothly to prevent errors

Front 29

users of systems

Back 29

record transactions, authorize data to be processed, and use output

Front 30

system analyst

Back 30

help determine info needs and design systems to meet needs

Front 31

programmers

Back 31

use analyst's design to write computer programs

Front 32

computer operators

Back 32

run software on computers and make sure data properly processed input and needed output is produced

Front 33

information system library

Back 33

storage area that contains corporate databases, files, and programs

Front 34

data control group

Back 34

ensure source data is properly approved, monitors computer work, and errors

Front 35

strategic master plan

Back 35

to align information system with strategies; show projects to be completed, goals, requirements, etc.

Front 36

project controls:
project development plan
project milestones
performance evaluations

Back 36

-how project will be completed
-significant points at which project is reviews
-of project team members when project completed

Front 37

data processing schedule

Back 37

how to organize data processing tasks to maximize use of computer resources

Front 38

steering committee

Back 38

formed to guide and oversee systems development and acquisition

Front 39

systems performance measures and types

Back 39

to evaluate systems:
-throughput- output per unit of time
-utilization- % of time system is being productively used
response time- how long it takes a system to respond

Front 40

post implementation review of development project

Back 40

to determine if beliefs of project were achieved

Front 41

systems integrator

Back 41

vendor who uses common standards and manages a cooperative systems development effort

Front 42

change management controls

Back 42

make sure system changes don't negatively affect systems reliability, security, confidentiality

Front 43

analytical reviews

Back 43

examine relationships between different sets of data (credit sales and A/R, etc) to detect fraud

Front 44

primary purpose of AIS

Back 44

gather, record, process, store, summarize, and communicate info about the organization

Front 45

audit trail

Back 45

individual transactions can be traced through system from origin to financial statements

Front 46

CSO
CCO

Back 46

-computer security officer- in charge of AIS security; independent from IS function
-chief compliance officer- deals with compliance issues, esp relating to SOX

Front 47

forensic accountants
CFE

Back 47

specialize in fraud detections and investigation
-certified fraud examiner

Front 48

computer forensics specialists

Back 48

discover, extract, document computer evidence such that it is authentic, accurate, and will hold up legally

Front 49

neural networks

Back 49

programs that mimic the brain and have learning capabilities; identify suspected fraud

Front 50

trust services framework=5 principles that contribute to systems reliability objective of AIS

Back 50

security, confidentiality, privacy, processing integrity, availability

Front 51

COBIT domains in which processes are grouped

Back 51

PO- plan and organize
AI- acquire and implement
DS- deliver and support
ME- monitor and evaluate

Front 52

info security concepts

Back 52

-security is a mgmt issue, not a tech problem
-time based model of security
-defense in depth

Front 53

time based model of security and how to invest

Back 53

this must be true:
P>D+C
p=time it takes to break through preventative controls
d=time it takes to detect
c= time it takes to respond
*invest in which ever one is the larger improvement

Front 54

preventative controls

Back 54

authentication, authorization, training, controlling physical access, controlling remote access, host and application hardening, encryption,

Front 55

authentication controls
and what to have to authenticate
multifactor authentication

Back 55

verify identity of person attempting to access the system
-need something you have, something you know, and a biometric identifier (physical characteristic)
-using two or more of the above methods of authentication

Front 56

authorization controls

Back 56

restrict access of authenticated users

Front 57

access control matrix and compatibility test

Back 57

to implement authorization controls; table that specifies which portions of system users are permitted
-matches users credentials against control matrix when a user tries to access an IS resource

Front 58

NIC and MAC

Back 58

network interface card- to connect to internal network
media access control- unique identifier that each NIC has - access is restricted to only devices that have a MAC

Front 59

perimeter defense for controlling remote access

Back 59

border router- connects info system to internet
firewall- behind router
IPS- intrusion prevention system- filter to identify and drop packets that are part of an attack

Front 60

DMZ

Back 60

demilitarized zone- separate network that permits controlled access from internet to selected resources

Front 61

TCP/IP

Back 61

protocols that govern the process for transmitting info over the internet
TCP- transmission control protocol- specifies procedures for dividing files and docs into packets and methods for reassembly of original doc
IP- internet protocol- specifies structure of packets and how to route them to proper destination

Front 62

parts of packet

Back 62

header- includes origin and destination info and type of data
body- actual info in packet

Front 63

router

Back 63

special purpose device that reads destination address fields in IP packet header to determine where to send packet

Front 64

ACL

Back 64

access control list- a set of rules that determines which packets are allowed entry; used by routers

Front 65

static packet filtering

Back 65

performed by routers; screens individual IP packets based on source and destination fields in header; examines in isolation (as opposed to stateful packet filtering)

Front 66

stateful packet filtering

Back 66

used by firewalls; uses info in header to determine if the info is from an ongoing communication; maintains table that lists all established connections between organizations computers and Internet;

Front 67

Deep packet inspection

Back 67

part of IPS- looks at info in the body of the packet as well as the header; slow; can be performed by firewalls

Front 68

RADIUS

Back 68

remote authentication dial in user service-to verify identity of users attempting to obtain dial in access (ie- login credentials)

Front 69

rogue modem
and war dialing

Back 69

single, unauthorized modem- connection not filtered by main firewall
war dialing- call every # assigned to org. to identify those connected to modems to identify rogue modems

Front 70

hosts and how to make more secure
hardening

Back 70

workstations, servers, printers, other devices
more secure by modifying their configurations
-hardening- turn off programs when not being used because they have vulnerabilities/flaws that can be exploited

Front 71

encryption

Back 71

process of transforming plain text (normal text) into cipher text (unreadable gibberish)

Front 72

key and algorithm

Back 72

what you need to encrypt and decrypt
key- string of binary digits of fixed length
algorithm- formula for combining the key and text

Front 73

key escrow

Back 73

make copies of all encryption keys used and store them - so if an employee leaves, you can always decrypt info...better to use a built in master key

Front 74

types of encryption systems

Back 74

symmetric- use same key to encrypt and decrypt
asymmetric- use a public and a private key- either can be used to encrypt, but only the other can decrypt

Front 75

hashing

Back 75

process that takes plain text of any length and transforms it into a short code called a hash; not reversible

Front 76

digital signature
and process

Back 76

info encrypted with creator's private key- makes sure message that was decrypted is the same as the original message
-sender runs message through hashing algorithm and then encrypt
-receiver of message uses public key to decrypt digital signature which produces the hash of the original document
-decrypt encrypted document
-run plain text through same hashing algorithm and see if hash matches the digital signature

Front 77

digital certificate

Back 77

e-document created and digitally signed by a 3rd party that certifies the identity of the owner of a public key

Front 78

PKI

Back 78

Public Key Infrastructure- system and processes used to issue and manage asymmetric keys and digital certificates

Front 79

Certificate Authority

Back 79

organization that issues public and private keys and records public key in the digital certificate

Front 80

e-signature

Back 80

cursive style imprint of name that is applied to an e-document ; register with company to get one; legally binding

Front 81

detective controls

Back 81

log analysis, IDS, managerial reports, security testing

Front 82

log analysis

Back 82

examine logs of who accesses system and what they do to monitor security

Front 83

IDS and where located

Back 83

Intrusion Detection System- to automate monitoring- create logs of network traffic permitted in and analyze logs for signs of attempted/successful intrusion; usually located just inside of main firewall

Front 84

types of security testing

Back 84

vulnerability scans- use automated tools to determine if a system possesses any well known vulnerabilities
penetration test- attempt to break into info system to test for weaknesses

Front 85

corrective controls

Back 85

CERT, CISO, patch management

Front 86

CERT and steps

Back 86

computer emergency response team- to respond to security incidents promptly
-recognition
-containment
-recovery
-follow up

Front 87

CISO-

Back 87

chief information security officer- independent of IS functions; integrates physical and information security; works closely with security builder and involved in the PO (planning an d organizing)

Front 88

patch management, patch, exploits, script kiddie

Back 88

regularly applying patches and updates to all software to avoid exploits
-patch- code that fixes vulnerabilities in software
-exploit- set of instructions for taking advantage of a vulnerability
-script kiddies run exploits

Front 89

controls to satisfy confidentiality principle

Back 89

encryption (VPNs), access controls, training of employees

Front 90

VPN

Back 90

virtual private network- functionality of a private network but on the internet; encrypt info while being sent over internet which creates private communication channels (tunnels)

Front 91

Cookie

Back 91

text file created and stored on visitor's hard drive - info about what was done on website- thought to violate privacy

Front 92

groups of application controls

Back 92

input, processing, output

Front 93

field check

Back 93

if characters in a field are the proper type

Front 94

sign check

Back 94

if data in a field have appropriate arithmetic sign

Front 95

limit check

Back 95

test if numerical amounts to see if they exceed a certain amount

Front 96

range check

Back 96

like a limit check but with upper and lower limits

Front 97

size check

Back 97

ensures data will fit into an assigned field

Front 98

completeness check

Back 98

all required data are entered

Front 99

validity check

Back 99

compare ID code/account number in transaction data to a master file to make sure it is a valid customer

Front 100

reasonableness test

Back 100

make sure there is a logical relationship between 2 data items

Front 101

check digit verification

Back 101

ID number includes a check digit that is computed using the other digits- if error is made in the regular digits, the check digit won't calculate correctly

Front 102

batch processing controls

Back 102

sequence check, error log, batch totals

Front 103

sequence check

Back 103

test if a batch of input data are in proper sequence (same as master file)

Front 104

error log

Back 104

info about data input/processing errors to be reviewed and corrected

Front 105

batch totals and types

Back 105

summarize key values for a batch of input records
-financial totals- sums fields w/dollar values
-hash total- sums non-financial numeric field
-record count-sums number of records in a batch

Front 106

online data entry controls

Back 106

prompting, preformatting, closed loop verification, transaction log, error messages

Front 107

prompting

Back 107

system requests each input data and waits for appropriate response

Front 108

preformatting

Back 108

display document with highlighted blanks

Front 109

closed loop verification

Back 109

check data accuracy by using it to retrieve other info

Front 110

transaction log

Back 110

detailed record of all transaction data

Front 111

processing controls

Back 111

data matching (invoice, PO, RR), file labels, recalculate batch totals, crossfooting balance test, zero balance test, write protect info, processing integrity procedures

Front 112

internal label parts

Back 112

header record- located at beginning of file; name, date, other ID data
trailer record- end of file; contains batch totals calculated at input

Front 113

transposition error and how to detect

Back 113

2 adjacent digits reversed; detect via recalculating batch totals

Front 114

crossfooting balance test

Back 114

compare results of totals found in 2 different ways to verify accuracy

Front 115

concurrent update controls

Back 115

protect records from errors that occur when 2 or more users attempt to update the same record simultaneously

Front 116

output controls

Back 116

review output, reconciliation, data transmission controls

Front 117

data transmission controls

Back 117

parity checking and message acknowledgment techniques

Front 118

parity check and parity bit

Back 118

to ensure proper number of bits to set value equal to zero
parity bit- extra digit added to every character to detect lost bits

Front 119

echo test

Back 119

receiving unit calculates summary of statistics about message and sends back to see if it matches what the sending unit calculated

Front 120

trailer record

Back 120

where sending unit stores control totals and receiving uses to make sure the whole message was received

Front 121

availability objectives

Back 121

minimize risk of downtime (via preventative maintenance), disaster recovery and business continuity planning

Front 122

how to minimize risk of system downtime

Back 122

fault tolerance, UPS

Front 123

fault tolerance

Back 123

user redundant components (dual processors, multiple hard drives, etc) to enable system to keep functioning if a component fails

Front 124

UPS

Back 124

uninterruptible power supply- provides protection in event of prolonged power outage (via battery)

Front 125

components of data recovery

Back 125

data backup procedures, infrastructure replacement, documentation, testing

Front 126

backup and restoration

Back 126

-exact copy of most current version of a database, file, or program
-process of installing the backup for use

Front 127

types of backup

Back 127

full backup- entire database
partial backups:
incremental backup- copy only data items that have been changed
differential backup- copy all changes since last full backup (longer, but simpler restoration)

Front 128

RPO

Back 128

recovery point objective- maximum length of time it is willing to risk the possible loss of transaction data

Front 129

real time monitoring

Back 129

2 copies of database are kept at 2 separate data centers updated in real time; expensive

Front 130

checkpoint

Back 130

point at which a temporary copy of a database is made

Front 131

archive

Back 131

copy of a database, master file, software that will be retained indefinitely as a historical record

Front 132

disk vs tape

Back 132

first store on disk, then transfer to tape
disk- faster, less easy to lose
tape- cheaper, easier to transport, more durable

Front 133

RTO

Back 133

recovery time objective- time following a disaster by which the organization's info system must be available again

Front 134

reciprocal agreement

Back 134

use another organization's info system resources

Front 135

cold site

Back 135

empty building that is prewired and a contract with vendors to get new equip if a disaster happens

Front 136

hot site

Back 136

prewired and already has office equipment to use in case of disaster

Front 137

IT governance

Back 137

process of overseeing and managing IT concerns; helps assess if org is aligning IT with enterprise, managing IT resources responsibly, recognizing IT opportunities

Front 138

how IT governance has changed

Back 138

from ad hoc (as long as it works, doesn't matter how it's built) to formal IT governance structures for a solution

Front 139

who is responsible for IT governance

Back 139

shareholders (represented by BOD) and executive management

Front 140

IP datagram

Back 140

data packet that conforms to the IP spec