COMPUTER BASED INFORMATION SYSTEM

1) CBIS
a) Characteristics
i) Predetermined set of obj.
ii) No sys works in isolation
iii) If one sys fails complete sys may fail
iv) Interaction with each sys
v) Common goal
b) Components
i) People
ii) Hardware
(1) Input device
(2) Processing device
(a) Control unit
(b) Arithmetic and logical unit
(c) Register
(i) Accumulators
(ii) Memory and storage registers
(iii) Address registers
(iv) Miscellaneous
(3) Data storage device
(a) Internal
(i) Processor registers
(ii) Cache memory
(b) Primary memory
(c) Secondary memory
(d) Virtual memory
(4) Output device
(a) Textual
(b) Graphical
(c) Tactile
(d) Audio
(e) Video
iii) Software
(1) Operating sys
(a) Functions
(i) Perform HW function
(ii) Hardware independence
(iii) GUI
(iv) Task management
(v) File management
(vi) Memory management
(vii) Network managememt
(viii) Logical access security
 (2) Application software
(a) Types
(i) Application suite
(ii) Enterprise SW
(iii) Educational SW
(iv) Content access SW
(v) Information SW
(vi) Media development
(b) Advantages
(i) Addressing user needs
(ii) Licensed application SW
(iii) Less threat from virus
(c) Disadvantages
(i) Infection from virus
(ii) Development is time consuming and costly
(d) Application areas
(i) Finance and accounting
(ii) Marketing and sales
(iii) Production and manufacturing
(iv) Human resource and development
(v) Inventory management
iv) Data
(1) Definition
(2) Database
(a) Hierarchy
(i) File>Records>Fields>Characters>Bits
(b) Models
(i) Hierarchical
1. Logically organized
2. Inverted tree pattern
3. Nodes(all records in hierarchy)
4. Parent and child relation
5. Root record (top parent)
(ii) Network
1. Sets
2. Owner record and member records
3. Many to many relation
4. Directly address location on disk
5. Excellent retrieval performance
(iii) Relational
1. Table format
2. Rows=domains and columns=attributes
3. No identical records
4. Each record contains single value
(iv) Obj oriented
(c) DBMS
 (i) Advantages
1. Minimize data duplication and data redundancy
2. Data consistency
3. Data integration
4. Data independence
5. File security
6. File sharing
7. User friendly
8. Faster application development
(ii) Disadvantages
1. Security
2. Costly
(d) Data warehouse
(i) Criteria
1. Non operational data
2. Time variant (data receives time stamp)
3. Extraction Transformation Load
(ii) Approaches
1. Bottom up (small data marts>larger data warehouses)
2. Top down (enterprise wide data warehouse>data marts)
(iii) Benefits
1. Better understanding of data
2. Centralized view
3. One version of truth
4. Snapshot of data that allows trend analysis
5. Further analysis
(iv) Data mining
1. Analyzing data
2. Find trend, patterns, associations
3. Extremely large data sets
4. DB>Targetdata(selection)>DW(ETL)>PTA(DM)>Knowledge(interpretation and evaluation)
v) Network
(1) Types
(a) Connection oriented network
(b) Connectionless network
(2) Solution of basic issues
(a) Routing
(b) Bandwidth
(c) Resilience
(d) Contention
(3) Benefits
(a) Resource sharing
(b) Information sharing
(c) Computational power sharing
(d) Reliability
(e) User communication
 (4) Impact
(a) Time compression
(b) Overcoming geographical constrains
(c) Restructuring Business relationships
vi) Concepts
(1) Transmission modes
(a) Simplex
(b) Half duplex
(c) Duplex
(2) Topology
(a) Bus topology
(b) Star topology
(c) Ring topology
(d) Mesh topology
(3) Packet
(4) MAC address
(5) Internet protocol address (IP address)
(6) Switch
(7) Packet switching
(8) Protocol
(9) Bridges
(10)Routers
(11)Domain names
(12)DNS (Domain name system)
(13)WiFi (Wireless fidelity)
(14)VOIP (voice over internet protocol)
c) Controls
i) Exposures
(1) Errors of omission
(2) Improper authorization
(3) Inefficient activity
ii) Problems
iii) Impact of technology on controls
(1) Competent and trustworthy personnel
(2) Segregation of duties
iv) Classification of IS control
(1) Based on objectives
(a) Preventive
(b) Detective
(c) Corrective
(2) Based on nature
(a) Environmental control
(i) Fire damage
1. Auto and manual fire alarms
2. Master switches and different fire suppression systems
3. Manual fire extinguishers
 4. Fireproof walls, floors and ceilings
5. Fire exits
6. Know how to use systems
7. Less wood and plastic in computer rooms
8. Gas based fire suppression system
9. Strategically planned locations
10. Inspection by fire dept
11. Fire repression systems
12. Smoke detectors
13. Wiring placed in electrical panels and conduit
(ii) Water damage
1. Waterproof ceilings, walls and floors
2. Positive drainage system exists
3. Install alarms at strategic points
4. Waterproofing
5. Water leakage alarms
(iii) Power spikes
1. Electrical surge protectors
2. Uninterruptible power system (UPS)
3. Voltage regulators
4. Emergency power off switch
(iv) Pollution damage and others
1. Power leads form 2 substations
2. Prohibitions against eating within processing facility
(b) Physical access controls
(i) Locks on doors
1. Cipher locks
2. Bolting door locks
3. Electronic door locks
(ii) Physical identification medium
1. PIN
2. Plastic cards
3. Identification badges
(iii) Logging on facilities
1. Manual logging
2. Electronic logging
(iv) Other means
1. Video cameras
2. Security guards
3. Controlled visitor access
4. Bonded personnel
5. Dead man doors
6. Non exposures of sensitive facilities
7. Computer terminal locks
8. Controlled single entry point
9. Alarm system
 10. Perimeter
11. Control of out of hours employees
12. Secured report/document distribution cart
(c) Logical access controls
(i) Exposures
1. Technical exposures
a. Data diddling (changing data before entering)
b. Bomb (Bad piece of code)
i. Time bomb
ii. Logic bomb
c. Worms (Programs that copy itself)
d. Christmas card (Trojan)
e. Rounding down (transfer of small fraction of money into unauth a/c)
f. Salami technique (slicing of amt which includes Recurring deposits)
g. IP Spoofing (forging IP address)
2. Asynchronous exposures
a. Piggybacking (using auth person to go through security doors)
b. Wire tapping (spying during transmission)
c. Subversive threats (modification in system)
d. Data leakage (unauth copying or dumping of data)(spooling)
(ii) Controls
1. User access management
a. User registration
b. Privilege management access
c. Password management
d. Review user accessibility
2. User responsibility
a. Password use
b. Unattended user equipment
(iii) Network access controls
1. Firewall
2. Encryption
3. Call back device
4. Enforced path
5. Policy on NW services
(iv) OS access control
1. Login procedure
2. Access controls list
3. Access tokens
4. Job discretionary
5. Terminal lockout
6. Limitation of connection time
(v) Application and monitoring system access control
1. Info access restrictions
2. Sensitive system isolation
3. Event logging
 4. Monitor system use
5. Clock synchronization
(3) Based on audit functions
(a) Managerial controls
(i) Top management controls
1. Planning
a. Preparing a plan
i. Identifying opportunity and threats
ii. Evaluate the strategies
iii. Identify resources to achieve strategy
b. Types of plan
i. Strategic plan (LT)
ii. Operational plan (ST)
c. IT steering committee
2. Organizing
a. Resourcing IS functions
b. Staffing IS function
3. Leading
a. Motivate IS personnel
b. Communication with IS personnel
4. Controlling
a. Comparing actual performances with planned performance
b. Evaluating policies and procedures
c. Evaluating services by SLA
(ii) System Development management controls
1. System authorization activities
2. User specification activities
3. Internal auditor participation
4. Program testing
5. User acceptance and testing
(iii) Program Management control
1. Planning
2. Control
3. Design
4. Coding
5. Testing
a. Unit testing
b. Integrated testing
c. System testing
6. Operation and maintenance
a. Repair maintenance
b. Adaptive maintenance
c. Perfective maintenance
(iv) Data resource management
1. Access control
2. Backup control
 3. Update control
4. Definition control
5. Quality control
(v) Quality assurance management control
1. Demanding users
2. More ambitious projects
3. Worldwide trend
4. Organizations are concerned about their liabilities
5. Poor quality may lead to missed deadlines, dissatisfied customers etc.
(vi) Security management controls
1. Fire protection systems
2. Proper drainage
3. Regular cleaning
4. UPS, Generator etc.
5. Physical access controls
6. Facility must withhold structural damage
7. Antivirus
8. Logical access controls
9. Disaster recovery planning
10. Insurance
(vii) Operations management control
1. Help desk
2. Monitoring
3. Capacity planning
4. Computer operation
5. Network operation
6. Data preparation and entry
7. File library
8. documentation
(b) Application controls
(i) Boundry controls
1. Passwords
2. PIN
3. Cryptosystems
4. ID cards
5. Biometrics
(ii) Input controls
1. Source doc controls
a. Use pre numbered SD
b. SD in sequence
c. Periodic audit of SD
2. Data coding errors
a. Transcription errors
i. Addition errors
ii. Truncation errors
iii. Substitution errors
 b. Transposition errors
i. Single transposition
ii. Multiple transposition
3. Batch control
a. Physical batch control
b. Logical batch control
4. Validation controls
a. Field interrogation
i. Picture checks
ii. Limit checks
iii. Valid code check
iv. Arithmetic check
v. Cross check
b. Record transaction
i. Reasonableness check
ii. Sequence check
iii. Valid sign check
c. File interrogation
i. Version usage
ii. Labeling
iii. Data file security
iv. Data file maintenance
v. Logs
(iii) Processing controls
1. Processor controls
a. Error detection and correction
b. Multiple execution state
c. Timing control
d. Component replication
2. Real memory
3. Virtual memory
4. Data processing control
a. RTR totals
b. RV (Reasonable Verification)(password confirmation)
c. Edit checks
d. Field initialization
e. Exception recording
(iv) Output controls
1. Storing and logging of sensitive and critical forms
2. Spooling
3. Control over printing
4. Report distribution and collection control
5. Retention control
6. Recovery control
(v) Database control
1. Update control
 a. Ensure every transaction file has master file
b. Ensure all records on txn file are processed completely
c. Ensure multi transaction for a single record is processed in correct order
d. Maintain suspense a/c for any violation in above
2. Report control
a. Print suspense a/c
b. Print RTR control
c. Standing data
d. Recovery control
(vi) Communication control
1. Physical component control
2. Line error control
3. Link control
4. Flow control
5. Topological control
6. Inter networking controls
(4) Information system audit
(a) Objectives
(i) Asset safeguarding
(ii) Data integrity
(iii) System effectiveness
(iv) System efficiency
(b) Needs (Why)
(i) Data loss
(ii) Incorrect decision making
(iii) HW and SW
(iv) Computer abuse
(v) Controlled evolution of computer use
(vi) Maintenance and privacy
(c) Tools
(i) Snapshots
1. Tracing transaction
2. Inbuilt in system
3. Easier reporting
(ii) Integrated test facility(ITF)
1. Creating a dummy entity in application and processing dummy entries to verify
completeness
2. The transaction is entered with normal production data
3. The auditor needs to decide the method to be used to remove ITF effect or reverse txn.
4. Can be ignored if immaterial
(iii) System control audit review file (SCARF)
1. Embedding audit module in host application to provide continuous monitoring
2. All info will be written on scarf file
3. Scarf can be used for snapshot and data collection
(iv) Continuous and intermittent simulations (CIS)
 1. All transactions are entered thru CIS, then CIS determines whether it wants to examine
transaction
2. All txns passed to CIS and exceptions identified are written down in exception log file which
is used in audit
(v) Audit hoot
1. It flags suspicious transactions
2. Auditors can be informed of questionable transactions
(5) Audit trails
(a) Objectives
(i) Detecting unauthorized access
(ii) Reconstruction of event
(iii) Personal accountability
(b) Auditing environment controls
(i) Role of auditor in AEC
(ii) Audit of environmental control
(iii) Power conditioning
(iv) Backup power
(v) Heating, ventilation, and AC
(vi) Water detection
(vii) Fire detection and suppression
(c) Auditing Physical Security Controls
(i) Role of IS auditor in PAC
1. Risk assessment
2. Control assessment
3. Review of documents
(ii) Audit of Physical control
1. Sitting and marking
a. Proximity to hazards
b. Marking
2. Physical barriers
3. Surveillance
4. Guards or dogs
5. Key Card system
(d) Auditing in logical access controls
(i) Role of IS auditor in auditing LAC
1. Network access paths
2. Documentation
(ii) Audit of logical access controls
1. User access controls
(iii) Auditing user access controls
1. Authentication
2. Access violation
3. User account lockout
4. Intrusion detection and prevention
5. Dormant accounts
6. Shared accounts
 7. System accounts
(iv) Auditing password management
1. Password standard
(v) Auditing user access provisioning
1. Access request process
2. Access approvals
3. New employee provisioning
4. Segregation of duties
5. Access reviews
(vi) Auditing employee termination
1. Termination process
2. Access reviews
3. Contractor access and termination
(vii) User accounts logs
1. Centralized access logs
2. Access log protection
3. Access review
4. Access log retention
(viii) Investigate procedures
1. Investigation policies and procedures
2. Computer crime investigations
(ix) Internet points of presence
1. Search engines
2. Social networking sites
3. Online sales sites
4. Domain names
5. Justification of online presence
(e) Managerial controls and their audit trails
(i) Top management and IS management controls
1. Planning
2. Organizing
3. Leadership
4. Controlling
(ii) Types of system development audit
1. Concurrent audit
2. PI audit
3. General audit
(iii) Programming management controls
1. Planning
2. Control
3. Design
4. Coding
5. Testing
6. O&M
(iv) Data resource management controls
1. Maintain data integrity
 2. Check whether access controls and update controls are working
(v) Quality assurance management controls
1. Check how quality assurance personnel perform their monitoring role
2. How QA personnel recommendations for improvement
3. Reporting and training
(vi) Security management controls
1. High quality security reviews
2. Disaster recovery plan
3. Appropriate insurance plan
(vii) Operation management controls
1. Security of documents
2. Evaluate
a. Activities of documentation librarians
b. Capacity planning
c. Compliance with outsourcing plan
d. Financial viability of any outsourcing vendor
(f) Application controls and their audit trails
(i) Boundary control
(ii) Input controls
(iii) Processing controls
(iv) Output controls
(v) DB controls
(vi) Comm. Controls
(6) Organization structure and responsibilities
(a) Individual roles and responsibilities
(i) Executive manager
(ii) Owner
(iii) Manager
(iv) User
(b) Job titles and job descriptions
(i) Executive manager
1. CIO (Information)
2. CTO (Technical)
3. CSO (Security)
4. CPO (Privacy)
5. CISO (Information security)
(ii) Software Development
1. System analyst
2. System designer/architect
3. SW Programmer
4. SW tester
(iii) Data management
1. DB admin
2. DB analyst
3. DB architect
(iv) Network Management
 1. NW architect
2. NW engineer
3. NW admin
4. Telecom engineer
(v) System management
1. System architect
2. System engineer
3. System admin
4. Storage engineer
(vi) General operation
1. Data entry
2. Operation analyst
3. Operation manager
4. Control analyst
5. System operator
6. Media librarian
(vii) Security operation
1. Security architect
2. Security engineer
3. Security analyst
4. Security auditor
5. User a/c manager
(viii) Service Desk
1. Helpdesk analyst
2. Technology analyst