IS4680 Security Auditing for Compliance Unit 3 Information Security Policy Audit Tools

1. IS4680 Security Auditing for Compliance Unit 3 Information Security Policy Audit Tools

2. Class Agenda 6/27/16 • Covers Chapter 5 • Learning Objectives • Lesson Presentation and Discussions. • Discussion on Assignments. • Discussion on Lab Activities. • Lab will be perform in class. • Break Times as per School Regulations.

3. Learning Objective • Describe the components and basic requirements for creating an audit plan to support business and system considerations.

4. Key Concepts • Identifying key building blocks and critical requirements of an audit • Identifying critical security control points and assessing information technology (IT) security • Obtaining information through documentation and resources • Organizing the IT security policy • Analyzing best practices for testing and monitoring

5. Components of an IT Infrastructure Audit IT controls cross all seven of the domains on an infrastructure. They include: • Data • Applications systems • Technology • Facilities • Personnel

6. Components of an IT Infrastructure Audit (Continued) The scope should not restrain the organization and cause: • Lesser resources • Limited time frame • Prevented discovery of audit evidence • Restricted audit procedures

7. Audit Building Blocks • Before an audit can be completed, scopes, goals, objectives, and frequency must be defined.

8. Audit Building Blocks (Continued) • The scope should not restrain the organization and cause: • Lesser resources • Limited time frame • Prevented discovery of audit evidence • Restricted audit procedures

9. Audit Building Blocks (Continued) • The goals must be aligned with the business objectives. • The objectives of an audit should satisfy a requirement placed internally or externally on the organization.

10. Audit Building Blocks (Continued) • The frequency must not interfere with ongoing operations such that full-time employees (FTEs) are always working on an audit, unless the organization is large enough to have full-time audit departments.

11. Security Control Points in IT Infrastructure • On a high-level, controls for IT systems are of two types: general and the other application. These controls apply broadly to all system components across an organization.

12. Security Control Points in IT Infrastructure (Continued) • National Institute of Standards and Technology (NIST) defines following three IT security controls: • Management Controls: Includes controls typically governed by management as part of the overall security program. • Operational Controls: Includes controls that are implemented by people rather than systems. • Technical Controls: Includes controls that are performed by the IT systems.

13. Information Gathering  • In the process of assessing IT security, information is gathered from many areas within the organization to be analyzed. • An auditor must also need to understand the following prior to performing an audit: • Understanding of the organization, such as business requirements and goals of the organization. • Knowledge of how the security program is currently in place. • Industry “best practices” for the type of organization and systems.

14. Information Gathering (Continued)  Other types of documentation are: • Administrative documentation • System documentation • Procedural documentation • Network architecture diagrams • Vendor support access documents and agreements

15. Risk Management Risk management provides information about the organization’s risk and how much risk an organization can operate under, depends on the following: • Aligning risk appetite and strategy: Helps manage the uncertainty with consideration of the goals of the organization.

16. Risk Management (Continued) • Enhancing risk response decisions: Improves the ability to make better decisions about how to manage risk. • Reducing operational surprises and losses: Enhances the organization’s ability to identify potential events or threats and react appropriately.

17. Risk Management (Continued) • Identifying and managing multiple and cross-enterprise risks: Helps consider related risks from across the organization and provide a unified response across the varying risks. • Seizing opportunities: Helps the organization recognize events from which new opportunities can be pursued.

18. Risk Management (Continued) • Improving deployment of capital: Improves how organizations divide their financial resources to enhance performance and profitability.

19. Threat Analysis • When undertaking a risk management plan, a complete threat analysis must be conducted. • Part of the risk assessment process requires an examination of those activities that represent danger.

20. Threat Analysis (Continued) • Threats can be grouped through a combination of the following: • External or internal • Natural or man made • Intentional or accidental

21. Vulnerability Analysis After performing a threat analysis, you need to identify weaknesses or flaws. Specifically, you need to identify vulnerabilities that can be exploited by previously identified threats. Some examples are: • Vulnerability lists and databases published by industry organizations • Security advisories • Software and security analysis using automated tools

22. Risk Assessment Analysis • Given the previous inputs, the final step is to determine the level of risk. When pairing threats and vulnerabilities, risk is determined primarily by three functions: • The likelihood of a threat to exploit a given vulnerability. • The impact on the organization if that threat against the vulnerability is achieved. • The sufficiency of controls to either eliminate or reduce the risk.

23. Risk Assessment Analysis (Continued) • There are always tradeoffs, and they include: • Cost: Are the costs of a control justified by the reduction of risk? • Operational impact: Does the control have an adverse effect on system performance? • Feasibility: Is the control technically feasible? Will the control be feasible for the end users?

24. Roles and Responsibilities • Senior Managers • Responsible for making the organization meet governance requirements. • IT Managers • Responsible for placing and monitoring IT controls on systems.

25. Roles and Responsibilities (Continued) • IT Auditors • Responsible for information assurance. • Data Owners • Responsible for identifying data to be protected.

26. Roles and Responsibilities (Continued) • System Administrators • Responsible for implementation of IT controls and providing data custodian functions. • Risk Managers • Responsible for managing risk within the organization.

27. Information Security Policy Audit Framework • The IT security policy framework includes policies, standards, and guidelines. Each of these include: • Technology • Processes • Personnel

28. Information Security Policy Audit Framework (Continued) The framework covers all seven of the domains of an IT infrastructure which are listed below: • User Domain • Workstation Domain • Local Area Network (LAN) Domain • LAN-to-Wide-Area Network (WAN) Domain

29. Information Security Policy Audit Framework (Continued) • WAN Domain • Remote Access Domain • System/Application Domain

30. Information Security Policy Audit Framework (Continued) • In many instances, policies, standards, and guidelines cross all domains: • The seven domains also map across various high-level areas. Examples include access control and operations management.

31. IT Testing and Monitoring • The most important and beneficial elements of an IT security program. • Testing and monitoring must be conducted to know the controls are working. • All frameworks include a control objective for regularly assessing and monitoring IT systems and controls.

32. IT Testing and Monitoring (Continued) • Questions that must be answered are: • Is IT performance measured to detect problems before it is too late? • Does management ensure that internal controls are effective and efficient? • Can IT performance be linked back to business goals? • Are adequate confidentiality, integrity, and availability controls in place for information security?

33. Summary • In this presentation, the following were covered: • Components of an IT infrastructure audit, building blocks of an IT audit, and security control points in the IT infrastructure • Process of information gathering, risk management, threat analysis, vulnerability analysis, and risk assessment analysis • Roles and responsibilities associated with information security policy audit tools • Framework in which the information security policy audit takes place • Need for the IT testing and monitoring

34. Assignment and Lab • Discussion 3.1 Information Gathering • Lab 3.2 Define a Process for Gathering Information Pertaining to a HIPAA Compliance Audit • Assignment 3.3 Analyzing the Critical Security Control Points