1 / 30

Content of this Presentation

How to use CobiT to assess the security & reliability of Digital Preservation Erpa WORKSHOP Antwerp 14 - 16 April 2004 Greet Volders Managing Consultant - VOQUALS N.V. Vice President & in charge of Education - IS ACA Belux. Content of this Presentation. Agenda. ISACA & CobiT

niveditha
Télécharger la présentation

Content of this Presentation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. How to use CobiT to assess the security & reliability of Digital PreservationErpa WORKSHOP Antwerp14 - 16 April 2004Greet Volders Managing Consultant - VOQUALS N.V.Vice President & in charge of Education - ISACA Belux

  2. Content of this Presentation Agenda • ISACA & CobiT • Introduction ISACA Organisation • IT Audit Process • CobiT Framework • Focus on some CobiT-processes • Relevant to digital preservation • With a focus on reliability, confidentiality and security • Practical guidelines to audit these processes and domains Voquals NV Greet Volders ERPA - 14 April 2004

  3. Mission & Strategy of Voquals • Voquals offers advice on quality management to organisations or more specifically to Information Technology departments. In addition Voqualsprovides assistance during the implementation of methods for application development and project management. • Voquals was founded in 1996 by Greet Volders & Eddy Volckaerts and indicates ”Volders quality services” or ”Volckaerts quality services” • A pragmatic and contextual approach is at the heart of every project we carry out. Voquals NV Greet Volders ERPA - 14 April 2004

  4. Our Core Business We are specialised in : • Quality Management • Project Management • Consultancy, Coordination, Implementation • Quality Audits (ISO, EFQM, TickIT, ...) • IT-Audits (CobiT, CMM) • EFQM - Self Assessment • Process Analysis and Development • Transitions to a Project-Based Approach to Work • Electronic Document Management(in general or focused on Quality) Voquals NV Greet Volders ERPA - 14 April 2004

  5. Content of this Presentation Agenda • ISACA & CobiT • Introduction ISACA Organisation • IT Audit Process • CobiT Framework Voquals NV Greet Volders ERPA - 14 April 2004

  6. CobiT Framework Why the need for CobiT Changing IT Emphasis Ten years ago we were afraid of rockets destroying computing centres…. … right now, we should be aware of software errors destroying rockets Voquals NV Greet Volders ERPA - 14 April 2004

  7. CobiT Framework Control Objectives Linking management’s IT expectations With management‘s IT responsibilities Business Processes What you get What you need Information Criteria IT Resources • Data • Application systems • Technology • Facilities • People • Effectiveness • Efficiency • Confidentiality • Integrity • Availability • Compliance • Reliability Information ? Do they match Voquals NV Greet Volders ERPA - 14 April 2004

  8. CobiT FrameworkNavigation Aids Linking Process, Resource & Criteria to 34 control objectives with 318 DETAILED control objectives Planning & organisation • effectiveness • efficiency • confidentiality • integrity • availability • compliance • reliability Acquisition &Implementation Delivery &Support Monitoring The control of IT Processes Which statisfy Business Requirements • people • applications • technology • facilities • data Is enabled by Control Statements And considers Control Practices Voquals NV Greet Volders ERPA - 14 April 2004

  9. Content of this Presentation Agenda • ISACA & CobiT • Introduction ISACA Organisation • IT Audit Process • CobiT Framework • Focus on some CobiT-processes • Relevant to digital preservation • With a focus on reliability, confidentiality and security • Practical guidelines to audit these processes and domains Voquals NV Greet Volders ERPA - 14 April 2004

  10. CobiT Frameworkrelevant to digital preservation Criteria • effectiveness • efficiency • confidentiality • integrity • availability • compliance • reliability IT RESOURCES • data • application systems • technology • facilities • people PLANNING AND ORGANISATION MONITORING ACQUISITION AND IMPLEMENTATION DELIVERY AND SUPPORT PO1 Define a strategic IT Plan PO2 Define the information architecture PO3 Determine the technological direction PO4 Define the IT org. and relationships PO5 Manage the IT investment PO6 Communicate mngt aims and direction PO7 Manage human resources PO8 Ensure compliance with ext. req. PO9 Assess risks PO10 Manage Projects PO11 Manage Quality BusinessObjectives M1 Monitor the process M2 Assess internal control adequacy M3 Obtain independent assurance M4 Provide for independent audit DS1 Define service levels DS2 Manage third-party services DS3 Manage perform. and capacity DS4 Ensure continuous service DS5 Ensure systems security DS6 Identify and attribute costs DS7 Educate and train users DS8 Assist and advise IT customers DS9 Manage the configuration DS10 Manage problems and incidents DS11 Manage data DS12 Manage facilities DS13 Manage operations AI1 Identify automated solutions AI2 Acquire and maintain application SW AI3 Acquire and maintain techn. Infrastr. AI4 Develop and maintain IT procedures AI5 Install and accredit systems AI6 Manage changes Voquals NV Greet Volders ERPA - 14 April 2004

  11. PO8 Ensure Compliance with External Requirements Control over the IT process of ensuring compliance with external requirements that satisfies the business requirement to meet legal, regulatory and contractual obligations Is enabled by identifying and analysing requirements for their IT impact, and taking appropriate measures to comply with them Voquals NV Greet Volders ERPA - 14 April 2004

  12. PO8 Ensure Compliance with External RequirementsDevelop Audit Plan • Interviewing: • Legal counsel • Human Resources Officer • Senior Management of the IT function • Obtaining: • Relevant government and/or external requirements • Standards, policies and procedures concerning • External requirements reviews • Safety and health (including ergonomics) • Privacy • Security • Sensitivity rating of data being input, processed, stored, outputted and transmitted • Electronic commerce • Insurance • Copies of all IT function related insurance contracts • Audit reports from • External auditors • Third-party service providers • Governmental agencies Voquals NV Greet Volders ERPA - 14 April 2004

  13. PO8 Ensure Compliance with External RequirementsEvaluating • Policies and procedures for: • Coordinating the external requirements review • Addressing appropriate safeguards • Appropriate safety and health training and education is provided to all employees • Monitoring compliance with applicable safety and health laws and regulations • Providing adequate direction/focus on privacy in order that all legal requirements fall within its scope • Informing the insurers of all material changes to the IT environment • Ensuring compliance with the requirements of the insurance contracts • Ensuring updates are made when applicable • Security procedures are in accordance with all legal requirements and are being adequately addressed, including: • Password protection and software to limit access • Authorisation procedures • Terminal security measures • Data encryption measures • Firewall controls • Virus protection • Timely follow-up of violation reports Voquals NV Greet Volders ERPA - 14 April 2004

  14. PO8 Ensure Compliance with External RequirementsSubstantiate the risk of C.O.’s not being met by: • Performing : • Benchmarking of external requirements compliance • A detailed review of the external requirements review files to ensure corrective actions have been undertaken or are being implemented • A detailed review of security reports to assess whether sensitive/private information is being afforded appropriate security and privacy protections • Identifying • Privacy and security weaknesses related to data flow and/or transborder data flow • Weaknesses in contracts with trading partners related to communications processes, transaction messages, security and/or data storage • Weaknesses in trust relationships of trading partners • Non-compliances with insurance contract terms Voquals NV Greet Volders ERPA - 14 April 2004

  15. AI3 Acquire and Maintain Technology Infrastructure Control over the IT process of acquiring and maintaining technology infrastructure that satisfies the business requirement to provide the appropriate platforms for supporting business applications Is enabled by judicious hardware and software acquisition, standardising of software, assessment of hardware and software performance and consistent system administration Voquals NV Greet Volders ERPA - 14 April 2004

  16. AI3 Acquire and Maintain Technology InfrastructureDevelop Audit Plan • Interviewing: • IT planning/steering committee • Chief information officer • IT senior management • Obtaining: • Policies and procedures relating to hardware and software acquisition, implementation and maintenance • Senior management steering roles and responsibilities • IT objectives and long- and short-range plans • Status reports and minutes of meetings • Vendor hardware and software documentation • Hardware and software rental contracts or lease agreement Voquals NV Greet Volders ERPA - 14 April 2004

  17. AI3 Acquire and Maintain Technology InfrastructureEvaluating Policies and procedure to cover • Evaluation plan • Is prepared to assess new hardware and software for any impact on the overall performance of the system • System software • Ability to access without interruption • Set up, installation and maintenance does not jeopardise the security of the data and programmes being stored on the system • Parameters are selected in order to ensure the integrity of the data and programmes • Installed and maintained in accordance with the acquisition and maintenance framework for the technology infrastructure • Vendors provide integrity assurance statements with their software and all modifications to their software Voquals NV Greet Volders ERPA - 14 April 2004

  18. DS5 Ensure System Security Control over the IT process of ensuring systems security that satisfies the business requirement to safeguard information against unauthorised use, disclosure or modification, damage or loss Is enabled by logical access controls which ensure that access to systems, data and programmes is restricted to authorised users Voquals NV Greet Volders ERPA - 14 April 2004

  19. DS5 Ensure System Security Develop Audit Plan • Interviewing: • Senior security officer of the organisation • IT senior and security management • IT data base administrator • IT security administrator • IT application development management • Obtaining: • Organisation-wide policies and procedures • IT policies and procedures • Relevant policies and procedures, and legal and regulatory body information systems security requirements including • User account management procedures • User security or information protection policy • Data classification schema • Inventory of access control software • Floor pan & schematic of physical access points to IT resources • Security software change control procedures • Security violation reports and management review procedures • Copies of contracts with service providers for data transmission Voquals NV Greet Volders ERPA - 14 April 2004

  20. DS5 Ensure System SecurityEvaluating • Strategic security plan • Cryptographic modules and key maintenance procedures • Password policy includes • Change initial password • Minimum password length • Allowed values (list of not-) • Location control methods are used to apply additional restrictions at specific locations • Security related hardware and software, such as cryptographic modules, are protected against tampering or disclosure, and access is limited to a “need to know” basis • Trusted paths are used to transmit non-encrypted sensitive information Voquals NV Greet Volders ERPA - 14 April 2004

  21. DS12 Manage Facilities Control over the IT process of managing facilities that satisfies the business requirement to provide a suitable physical surrounding which protects the IT equipment and people against man-made and natural hazards Is enabled by the installation of suitable environmental and physical controls which are regularly reviewed for their proper functioning Voquals NV Greet Volders ERPA - 14 April 2004

  22. DS12Manage FacilitiesDevelop Audit Plan • Interviewing: • Facility manager • Security officer • Risk manager • IT operations manager • IT security manager • Obtaining: • Organisational policies and procedures relating to facility management, layout, security, safety, fixed asset inventory and capital acquisition/leasing • List of individuals who have access to the facility and floor layout of facility • List of performance, capacity and service level agreements Voquals NV Greet Volders ERPA - 14 April 2004

  23. DS12Manage FacilitiesEvaluating • Facility location • Is not obvious externally • Is in least accessible area or organisation • Access is limited to least number of people • Logical and physical access procedures are sufficient, including security access profiles • “Key” and “card reader” management procedures and practices are adequate • Organisation is responsible for physical access within the IT function that includes • Security policies and procedures • Relationships with security-oriented vendors • Security awareness • Logical access control • Penetration test procedures and results Voquals NV Greet Volders ERPA - 14 April 2004

  24. More Information Coordinates ISACA & ISACFISACA Belux 3701 Algonquin Road, suite 1010 Rolling Meadows, Illinois 60008 USA Phone +1 708 253 1445 Education@isaca.orgEducation@isaca.be http://www.isaca.orghttp://www.isaca.be Voquals N.V. Greet Volders Diestsebaan 1 3290 Diest - Belgium Phone +32 13 326464 Mobile +32 475 63 45 06 Gvolders@voquals.be www.voquals.be Voquals NV Greet Volders ERPA - 14 April 2004

  25. Information Systems Audit and Control Association®Information Systems Audit and Control Foundation The recognized global leaders in IT governance, control and assurance.

  26. Mission: To support enterprise objectives through the development, provision and promotion of research, standards, competencies and practices for the effective governance, control and assurance of information, systems and technology. Information Systems Audit and Control Association (ISACATM) Information Systems Audit and Control Foundation (ISACFTM) Voquals NV Greet Volders ERPA - 14 April 2004

  27. ISACA Membership Benefits ACCESS • To: • Leading-edge research • K-NET, an internet-based • global knowledge network for • IT governance, control and • assurance information DISCOUNTS • On: • CISA exam registration fee • and study materials • CISM exam registration fee and • study materials • ISACA-sponsored conferences • and Training Weeks • COBITand other publications NETWORKING AND LEADERSHIP OPPORTUNITIES Through: Local chapters Voquals NV Greet Volders ERPA - 14 April 2004

  28. Information Systems Audit and Control Association/ Foundation 3701 Algonquin Road, Suite 1010 Rolling Meadows, IL, USA 60008 Phone: +1.847.253.1545 Fax: +1.847.253.1443 E-mail: info@isaca.org Web site: www.isaca.org Do you want to know more? Voquals NV Greet Volders ERPA - 14 April 2004

  29. ISACA BeLux Chapter Chapter Organization ISACA Belux Board ISACA Belux Education Committee ISACA Belux Luxembourg Development Voquals NV Greet Volders ERPA - 14 April 2004

  30. ISACA BeLux Chapter • Core activities • CISA preparation • CISM preparation • Round Table Meetings • Board meetings • Educational Committee meetings • Annual General Meeting • Miscellaneous events (social) • New Year drink • Gala Dinner • For more information: • www.isaca.be Voquals NV Greet Volders ERPA - 14 April 2004

More Related