Ais Chapter 5

Front 1

COBIT Framework Provides...

Back 1

Comprehensive guidance for effectively controlling and managing information systems
- 4 Controlled Domains: Plan&Organize, Deliver&Support, Require&Implement, and Monitor&Evaluate

Front 2

COBIT Specifies

Back 2

-210 Control Objectives
- Management control activities and responsibilities
-IT, process, and activites goals
- Performance evaluation metrics

Front 3

Trust Services Framework for Reliable Systems is...

Back 3

- Developed by the AICPA and Canadian Institute of Chartered Accountants
- Contains best practices for systems reliability
- Used by accountants primarily in assurance and advisory engagements

Front 4

Trust Services Framework Principles (5)

Back 4

1. Security
2. Confidentiality
3. Privacy
4. Processing Integrity
5. Availablility

Front 5

Trust Services Broad Areas for Successful Implementation (4)

Back 5

1. Develop and document policies
2. Communicate policies to all authorized users
3. Design and employ control procedures to implement policies
4. Monitor the system and take corrective action to maintain compliance with policies

Front 6

Trust Services Security Principle

Back 6

The system is protected against unauthorized access (physical and logical)

Front 7

Fundamental Information Security Concepts Issue is for...

Back 7

-Management, not technology
---responsibile for the accuracy of internal reports and F/S produced by IS

Front 8

Fundamental Information Security Concepts (Time)

Back 8

Management should ID cost-effective approaches to:
A) increased time it takes an attacker to breach B) Decrease the time it takes to detect an attack in progress C) Decrease the response time

Front 9

Fundamental Information Security Concepts (Defense)

Back 9

- Employ multiple layers of controls
- Use multiple types of controls (Preventative, Detective, and Corrective)

Front 10

Fundamental Information Authentication (Verification)

Back 10

- Verify the identity using (Usernames and Passwords, Smart cards and ID badgers, biometrics, Media Access Control (MAC) addresses on network interface cards (NIC)

Front 11

Preventative Controls: Authentication - Effective Passwords

Back 11

- @ least 8 characters
- contain alpha, numeric and special characters
- Upper and lower case letters
- No dictionary words
- Changed periodically

Front 12

Preventative Controls: Authentication (In General)

Back 12

- Restricts access of authenticated users to specific portions of the system
- Specifies what actiosn they are permitted to perform
- Implemented by creating an access control matrix and performing compatibility tests

Front 13

Preventive Controls: Training

Back 13

- Top management support
- Employees need to be trained in safe computing and avoiding prey to engineering attacks
- Continuous training of information security professionals is important

Front 14

Preventive Controls: Physical Access

Back 14

- Locks, Security guards, Card Readers, Numeric keypads, Biometric devices, Alarms, Security Cameras, Laptops and cell phones require special attention

Front 15

Preventive Controls: Network Access - Transmission Control Protocol/Internet Protocol (TCP/IP)

Back 15

- A set of rules or standards that allow different kidns of computers on different networks to communicate with eac other
- Basic communication rules of the internet
- Higher layer assembles messages or files intro smaller packets to be transmitted over the internet
- Lower layer assigns IP addresses and insures that messages are delivered to the appropriate computer

Front 16

Preventive Controls: Network Access - Perimeter Defense

Back 16

- router (reads destination address fields and decides where to send packets)
- firewall (hardware or software running that filters information in or out)
- intrusion prevention system identifies and drops packets taht are part of an attack

Front 17

Preventive Controls: Securing a Wireless Network

Back 17

Use encryption, enable MAC address filtering and authentication of devices, configure all authorized wireless NIC to operate only inside infrastructure, Use non-informative names, place access points away from exterior walls and windows, reduce broadcast strength

Front 18

Preventive Controls: Device and Software Hardening

Back 18

Endpoint configuration:
- include workstations, servers, printers, and other devices
- turn of all unnecessary features on endpoints (hardening)
- run updated anti virus software
- Use software firewall to retain important/sensitive info

Front 19

Preventive Controls: Hardening for Accounts

Back 19

User accounts and privileges: all accounts should be carefully managed, administrative rights accounts are prime for attacks (should have 2 accounts, limited account for routine and admin account when only necessary)

Front 20

Preventive Controls: Hardening for Software Design

Back 20

- Scrub user input to remove potentially malicious code, treat all input from users as not trustworthy

Front 21

Detective Controls: Log Analysis

Back 21

- Logs track who accesses the system and what specific actions each performed
- Log analysis is the process of examining logs to monitor security
- Special software helps examine logs for anomalous behavior

Front 22

Detective Controls: Intrusion Detection Systems

Back 22

Creates logs of all network traffic that permitted to pass the firewall and analyzes those logs for signs of attempted or successful intrusions

Front 23

Detective Controls: Managerial Reports

Back 23

Use key performance indicators to monitor and assess control effectiveness (Number of security incidents, downtime cause by security incidents, time to react to security incidents once detected)

Front 24

Detective Controls: Security Testing

Back 24

1. Vulnerability Scans: Automated tools designed to identify whether a system possess any well-known vulnerabilities
2. Penetration TestsL an authorized attempt by either an internal audit or external security consultant to break into an organization's IS

Front 25

Corrective Controls: Computer Emergency Response Teams

Back 25

Should include both technical specialists and senior operations management

Front 26

Corrective Controls: Chief Information Security Officer

Back 26

- should be independent, report to COO or CEO, work with CIO to design and implement security policies and procedures, should be an impartial evaluator of the IT environment, conduct vulnerability and risk assessments, audit security measures

Front 27

Corrective Controls: Patch Management

Back 27

Process for regularly applying patches and updates to all software (fix known vulnerabilities with patches, install updates to programs and systems)

Front 28

Security Implications of Virtualization and Cloud Computing

Back 28

1. Virtualization: running multiple systems simultaneously on one physical computer
2. Cloud Computing: using a browser to remotely access software, data storage devices, hardware, or application platforms
3. Risks: increased exposure to losses if breach occurs, authentication in cloud computing often relies only on passwords