Chapter 16—IT Controls Part II: Security and Access

TRUE/FALSE 1. In a computerized environment, the audit trail log must be printed onto paper documents. ANS: F 2. Disguising message packets to look as if they came from another user and to gain access to the host’s network is called spooling. ANS: F 3. Access controls take on increased importance in a computerized environment because all of the records may be found in one place. ANS: T 4. Computer viruses usually spread throughout the system before being detected. ANS: T 5. A worm is software program that replicates itself in areas of idle memory until the system fails. ANS: T 6. Viruses rarely attach themselves to executable files. ANS: F 7. Subschemas are used to authorize user access privileges to specific data elements. ANS: F 8. A recovery module suspends all data processing while the system reconciles its journal files against the database. ANS: F 9. The Database Management System controls program files. ANS: F 10. Operating system controls are of interest to system professionals but should not concern accountants and auditors. ANS: F 11. The most frequent victims of program viruses are microcomputers. ANS: T

12. ANS: F 20. Electronic data interchange customers may be given access to the vendor's data files. The message authentication code is calculated by the sender and the receiver of a data transmission. ANS: T 19. loss or misuse through unauthorized access. A firewall is a hardware partition designed to protect networks from power surges. The request-response technique should detect if a data communication transmission has been diverted. ANS: T 16. ANS: F 24. In a telecommunications environment. ANS: T 23. ANS: T 22. ANS: T 15. ANS: T 13. ANS: T 18. The audit trail for electronic data interchange transactions is stored on magnetic media. Access controls protect databases against destruction. A value added network can detect and reject transactions by unauthorized trading partners. ANS: F 14. ANS: T . ANS: T 21. line errors can be detected by using an echo check. Operating system integrity is not of concern to accountants because only hardware risks are involved. Audit trails in computerized systems are comprised of two types of audit logs: detailed logs of individual keystrokes and event-oriented logs. To preserve audit trails in a CBIS environment. Firewalls are special materials used to insulate computer facilities ANS: F 17. Electronic data interchange translation software interfaces with the sending firm and the value added network. transaction logs are permanent records of transactions.

assigns memory to applications c. Trojan horse c. none of the above ANS: B 4. A software program that replicates itself in areas of idle memory until the system fails is called a a. Examining programmer authority tables for information about who has access to Data Definition Language commands will provide evidence about who is responsible for creating subschemas. A software program that allows access to a system without going through the normal logon procedures is called a a. logic bomb d. a virus that formats the hard drive d. staggered backup approach c. the systems programmer accessing individual user files ANS: B 3. worm c. direct backup d. All of the following will reduce the exposure to computer viruses except a. grandfather-father-son approach b. translates third-generation languages into machine language b. ANS: T MULTIPLE CHOICE 1. The operating system performs all of the following tasks except a. a hacker gaining access to the system because of a security flaw b. install antivirus software b.25. authorizes user access d. Which of the following is considered an unintentional threat to the integrity of the operating system? a. worm d. install public-domain software from reputable bulletin boards ANS: D 6. logic bomb b. intermittent backup . Trojan horse b. Which backup technique is most appropriate for sequential batch systems? a. remote site. assign and control user passwords d. back door ANS: D 5. a hardware flaw that causes the system to crash c. install factory-sealed application software c. schedules job processing ANS: C 2.

off-site backups are not required c. Which of the following is not a basic database backup and recovery feature? a. Hackers can disguise their message packets to look as if they came from an authorized user and gain access to the host’s network using a technique called a. backups are created using the grandfather-father-son approach b. All of the following are objectives of operating system control except a. spoofing. processing a transaction file against a maser file creates a backup file c. files are backed up immediately before an update run d. In a direct access file system a. signature characteristics ANS: A 12. spooling. a. Which is not a biometric device? a. b. antivirus software b. passwords d. password b. ANS: A 9. the more significant the data. protecting users from themselves d. protesting users from each other c. protecting the environment from users . Which of the following is not an access control in a database system? a. voice prints d. checkpoint b. c. database authorization table c. protecting the OS from users b. the greater the number of backup versions ANS: D 8. the number of backup versions retained depends on the amount of data in the file b. When creating and controlling backups for a sequential batch system.ANS: A 7. it cannot be reconstructed ANS: C 10. if the master file is destroyed. backup files can never be used for scratch files d. database authority table ANS: D 13. dual-homed. voice prints ANS: A 11. backup database c. retina prints c. d. transaction log d. screening.

failure to change passwords on a regular basis b. using obscure passwords unknown to others c. the recipient's application software can validate the password after the transaction has been processed ANS: D 20. All of the following techniques are used to validate electronic data interchange transactions except a. reduce the need for other forms of security d. Which method is most likely to detect unauthorized access to the system? a. Which method will render useless data captured by unauthorized receivers? a. facilitate reconstruction of events c. Audit trails cannot be used to a. detect unauthorized access to systems b. promote personal accountability ANS: C 16. echo check b. value added networks can compare passwords to a valid customer file before message transmission b. encryption c. prior to converting the message. customers routinely access . echo check b. parity bit c. selecting passwords that can be easily detected by computer criminals ANS: B 15. Security can be compromised by all of the following except a. the recipient's application software can validate the password prior to processing d. data encryption standard c. message sequencing ANS: C 18. In an electronic data interchange environment. Which control will not reduce the likelihood of data loss due to a line error? a. vertical parity bit d. the translation software of the receiving company can compare the password against a validation file in the firm's database c.ANS: D 14. request-response technique ANS: A 19. Passwords are secret codes that users enter to gain access to systems. recording passwords in obvious places d. message transaction log b. vertical parity check d. horizontal parity bit ANS: B 17. public key encryption d.

d. confirming that backup procedures are adequate c. verifying that only authorized software is used on company computers b. detection and correction of message loss due to equipment failure b. inspecting biometric controls b. ensuring that authorized users access only those files they need to perform their duties d. verifying that unauthorized users cannot access data files ANS: A 23. physical security measures are adequate to protect the organization from natural disaster d. examining the password policy including a review of the authority table ANS: B 22. the auditor is testing which audit objective? a. illegal access to the system is prevented and detected ANS: D 26. all of the above ANS: D 25. all EDI transactions are authorized b. application programs are protected from unauthorized access c.a. procedures that render intercepted messages useless d. c. In an Electronic Data Interchange (EDI) environment. reconciling program version numbers c. a complete audit trail is maintained . the vendor's price list file the vendor's accounts payable file the vendor's open purchase order file none of the above ANS: A 21. Audit objectives for communications controls include all of the following except a. All of the following tests of controls will provide evidence that adequate computer virus control techniques are in place and functioning except a. Audit objectives for the database management include all of the following except a. authorized trading partners have access only to approved data d. comparing job descriptions with access privileges stored in the authority table d. reviewing system maintenance records c. they are testing which audit objective? a. attempting to retrieve unauthorized data via inference queries ANS: B 24. prevention and detection of illegal access to communication channels c. confirming that antivirus software is in use d. incompatible functions have been segregated b. when the auditor compares the terms of the trading partner agreement against the access privileges stated in the database authority table. b. verifying that the security group monitors and reports on fault tolerance violations b. unauthorized trading partners cannot gain access to database records c. When auditors examine and test the call-back feature. All of the following tests of controls will provide evidence that access to the data files is limited except a.

a complete audit trail of EDI transactions is maintained d. All of the following are designed to control exposures from subversive threats except a. all EDI transactions are authorized b. is a printout of all incoming and outgoing transactions b.ANS: C 27. field interrogation d. is an electronic log of all transactions received. access the vendor's inventory file with read-only authority d. Audit objectives in the Electronic Data Interchange (EDI) environment include all of the following except a. the policy on the purchase of software only from reputable vendors b. one-time passwords c. is a computer resource authority table d. access the vendor's accounts receivable file with read/write authority b. all of the following policies are relevant except a. access the vendor's price list file with read/write authority c. In determining whether a system is adequately protected from attacks by computer viruses. inference controls ANS: C 30. In an electronic data interchange environment. the policy that permits users to take files home to work on them ANS: D 29. the audit trail a. access the vendor's open purchase order file with read-only authority ANS: C 31. customers routinely a. backup procedures are in place and functioning properly ANS: D 28. backup controls d. antivirus software . consists of pointers and indexes within the database ANS: B 32. translated. firewalls b. Which of the following is not a test of access controls? a. the policy that current versions of antivirus software should be available to all users d. hardware access procedures b. the policy that all software upgrades are checked for viruses before they are implemented c. unauthorized trading partners cannot gain access to database records c. biometric controls b. and processed by the system c. In an electronic data interchange environment. data encryption ANS: C 33. Many techniques exist to reduce the likelihood and effects of data communication hardware failure. encryption controls c. One of these is a.

object system. ANS: A SHORT ANSWER 1. EDI audit trail d. c.c. 2. user manual. application listing. database schema. user view. special materials used to insulate computer facilities b. What is a virus? ANS: A virus is a program that attaches itself to another legitimate program in order to penetrate the operating system. . Which of the following deal with transaction legitimacy? a. access controls c. a system that enforces access control between two networks c. An integrated group of programs that supports the applications and facilitates their access to specified resources is called a (an) a. 3. d. facility system. none of the above ANS: B 36. special software used to screen Internet access d. c. operating system. data encryption ANS: C 34. b. parity checks d. utility system d. database management system. ANS: D 37. transaction authorization and validation b. Briefly define an operating system. ANS: An integrated group of programs that supports the applications and facilitates their access to specified resources. all of the above ANS: D 35. e. Describe one benefit of using a call-back device. The database attributes that individual users have permission to access are defined in a. operating system. Firewalls are a. e. b.

data encryption. 5. message sequence numbering. In the Public Key Encryption approach all senders receive a copy of the key used to send messages. ANS: In the Private Encryption Standard approach. message transaction logs. displaying passwords where others can see them. Contrast the Private Encryption Standard approach with the Public Key Encryption approach to controlling access to telecommunication messages. failure to change passwords frequently. message authentication codes. 8. Verification of the entries in the log is part of the audit process. the recipient of the message can validate the password prior to translating the message. and request-response technique 6.ANS: Access to the system is achieved when the call-back device makes contact with an authorized user. Discuss the key features of the one-time password technique: ANS: The one-time password was designed to overcome the problems associated with reusable passwords. ANS: value-added networks use passwords to detect unauthorized transactions before they are transmitted to recipients. . 4. The user’s password changes continuously. Describe two ways that passwords are used to authorize and validate messages in the electronic data interchange environment. and electronically displays. Explain how transactions are audited in an electronic data interchange environment. a new and unique password every 60 seconds. ANS: Firms using electronic data interchange maintain an electronic log of each transaction as it moves from receipt to translation to communication of the message. List three methods of controlling unauthorized access to telecommunication messages. This reduces the chance of an intruder gaining access to the system from an unauthorized remote location. This technology employs a credit card-sized smart card that contains a microprocessor programmed with an algorithm that generates. both the sender and the receiver use the same key to encode and decode the message. using simple. the receiver is the only one with access to the key to decode the message. Describe are some typical problems with passwords? ANS: users failing to remember passwords. This transaction log restores the audit trail that was lost because no source documents exist. the recipient of the message can validate the password prior to processing the transaction 7. easy-to-guess passwords 9. ANS: call-back devices.

What is a user-defined procedure? ANS: A user-defined procedure allows the user to create a personal security program or routine to provide more positive user identification than a password can. Event logs typically record the IDs of all users accessing the system. If the data do not match. and the files. verify that database administration employees have exclusive responsibility for creating authority tables and designing user subschemas. . ANS: compare job descriptions with authority tables. access is denied. databases. What is event monitoring? ANS: Event monitoring summarizes key activities related to system resources. which it compares with the profile data stored internally or on the ID card. What are the auditor's concerns in testing EDI controls? ANS: When testing EDI controls. evaluate biometric and inference controls 11. voiceprints. retina prints. in addition to a password. the time and duration of a user’s session. so that at any point in time both the smart card and the network software are generating the same password for the same user. Each user is granted certain privileges that are coded in the authority table. which only the legitimate user is likely to know. that authorized trading partners have access only to approved data. 12. or signature characteristics. 10. a special scanning device captures his or her biometric characteristics. 13.The card works in conjunction with special authentication software located on a mainframe or network server computer. and other resources accessed. Describe two tests of controls that would provide evidence that the database management system is protected against unauthorized access attempts. 15. the auditor's primary concerns are related to ascertaining that EDI transactions are authorized. which is used to verify the user’s action requests. that no unauthorized organizations gain access to records. These user characteristics are digitized and stored permanently in a database security file or on an identification card that the user carries. What is a database authorization table? ANS: The database authorization table contains rules that limit the actions a user can take. and in compliance with organization policy. For example. validated. printers. Each user’s card is synchronized to the authentication software. programs that were executed during a session. When an individual attempts to access the database. and that adequate controls are in place to maintain a complete audit trail. 14. the security procedure asks a series of personal questions (such as the user’s mother’s maiden name). What are biometric devices? ANS: Biometric devices measure various personal characteristics such as fingerprints.

and applications. 4. the ability to monitor user activity can support increased personal accountability. By monitoring system performance. A formal log-on procedure is the operating system’s first line of defense. ANS: 1. databases. to protect itself from its environment.. to protect users from each other. A logic bomb is a destructive program triggered by some "logical" condition–a matching date. and processing errors. 4. 2. workgroups. ANS: Audit trails support system security objectives in three ways. 2.. e. By detecting unauthorized access to the system. Individuals who intentionally (or accidentally) insert computer viruses or other forms of destructive programs into the operating system. What is an operating system? What does it do? What are operating system control objectives? ANS: An operating system is a computer’s control program. Operating systems have five basic control objectives: 1. An operating system carries out three primary functions: translating high level languages into machine language using modules called compilers and interpreters. allocating computer resources to users. Discus three sources of exposure (threats) to the operating system. and peripherals such as printers. There are many techniques for breaching operating system controls. to protect it from itself. A worm is software that replicates itself in memory. 3. 2. Common PC operating systems include Windows 2000. It controls user sharing of applications and resources such as processors. Michelangelo's birthday. Systems administrators and systems programmers require unlimited access to the operating system to perform maintenance and to recover from system failures. 3. memory. etc. Discuss three. Most are destructive. to protect users from themselves. 5. Such individuals may use this authority to access users’ programs and data files. that can later be used for unauthorized access. In addition. A virus is a program that attaches itself to legitimate software to penetrate the operating system. Windows NT.g. changes in the system may be detected. ANS: Browsing involves searching through areas of main memory for password information. to protect itself from users.ESSAY 1. 3. Masquerading is a technique where a user is made to believe that he/she has accessed the operating system and therefore enters passwords. the audit trail protects the system from outsiders trying to breach system controls. What are the three security objectives of audit trails? Explain. Explain this works. The audit trail can also contribute to reconstructing events such as system failures. Individuals both internal and external to the organization who browse the operating system to identify and exploit security flaws. security breaches. and 5. Privileged personnel who abuse their authority. and managing job scheduling and multiprogramming. and Linux. .

But this ease of sharing can also jeopardize security. who is the owner of the general ledger. A user view is a subset of a database that limits a user’s “view” or access to the database. the system should lock out the user from the system. To protect the data in a database. then the log-on attempt is authenticated. Resource owners in this setting may be granted discretionary access privileges. a new and unique password every 60 seconds. To access the network. The system compares the ID and password to a database of valid users. however. Explain the concept of discretionary access privileges. ANS: Two general types of risk exist when networks communicate with each other–risks from subversive threats and risks from equipment failure. If the system finds a match. The password can be used one time only. A newer technique uses biometric devices to authenticate users. the user must provide both a secret reusable personal identification number (PIN) and the current one-time only password for that point in time. insert. ANS: In centralized systems system administrator usually determines who is granted access to specific resources and maintains the access control list. At any point in time both the smart card and the network software are generating the same password for the same user. To access the operating system. however.. For example. modify. Discuss at least three forms of access control designed to reduce this risk. The message should not reveal whether the password or the ID caused the failure. 6. Any attempt by the budgeting manager to add. What are the two broad areas of concern? Explain. The card works in conjunction with special authentication software located on a mainframe host or network server computer. delete. may be granted both read and write permissions to the ledger. the user enters the PIN followed by the current password displayed on the card. 9. The use of discretionary access control needs to be closely supervised to prevent security breaches because of its liberal use. the log-on attempt fails and a message is returned to the user. or change the general ledger will be denied. ANS: Many types of access control are possible. he or she is presented with a dialog box requesting the user’s ID and password. may grant read-only privileges to a manager in the budgeting department. After a specified number of attempts (usually no more than five). which allow them to grant access privileges to other users. The system should allow the user to reenter the log-on information. If. and visually displays. Explain how the one-time password approach works. In distributed systems. the user’s password changes continuously. many systems use data encryption to make it unreadable by intruders. resources may be controlled (owned) by end users. . A user-defined procedure adds additional queries to user access to prevent others from accessing in a specific user’s place.e. however.ANS: When the user logs on. The database authorization table contains rules that limit what a user can do. One purpose of a database system is the easy sharing of data. delete. One technology employs a credit-card-sized device (smart card) that contains a microprocessor programmed with an algorithm that generates. The accounts payable manager. the controller. i. Network communication poses some special types of risk for a business. the password or ID is entered incorrectly. read. 7. ANS: Under this approach. 8.

parity checks. computer hackers gaining unauthorized access to the organization’s network. The problems can be minimized with the help of echo checks. This can be compensated for through the use of transaction logs which can be reconciled. The buying company’s purchasing system creates and transmits a purchase order electronically in an agreed format. and call-back devices. digital certificates. message transaction logs. encryption. and good backup control. digital signatures. 10. . Equipment failure can be the result of line errors. The absence of paper documents in an EDI transaction disrupts the traditional audit trail. The selling company receives the information. and it is converted electronically into a sales order. either directly or through a value-added network. What is EDI? How does its use affect the audit trail? ANS: Electronic data interchange is an arrangement which links the computer systems of two trading partners to expedite sales/purchases. Methods for controlling these risks include firewalls.Subversive threats include interception of information transmitted between sender and receiver. and denial-of-service attacks from remote locations on the Internet.

Sign up to vote on this title
UsefulNot useful