3.

33 Information Systems Control and Audit

Question 30
What are Asynchronous Attacks? Explain Subversive threats to an Information System.
Answer
Asynchronous Attacks: They occur in many environments where data can be moved
asynchronously across telecommunication lines. Numerous transmissions must wait for
the clearance of the line before data being transmitted. Data that is waiting to be
transmitted are liable to unauthorized access called Asynchronous Attack. These attacks
are hard to detect because they are usually very small pin like insertions.
Subversive Threats: An intruder attempts to violate the integrity of some components in
the sub-system. Subversive attacks can provide intruders with important information
about messages being transmitted and the intruder can manipulate these messages in
many ways. An intruder attempts to violate the integrity of some components in the sub-
system by:
• Invasive tap: By installing it on communication line, s/he may read and modify data.
• Inductive tap: It monitors electromagnetic transmissions and allows the data to be
read only.

Exercise
1. Discuss major General Controls within an enterprise in brief.
2. What do you mean by Detective Controls? Explain with the help of examples. Also,
describe their main characteristics in brief.
3. Discuss Application Controls and their categories in brief.
4. ‘There are various general guidelines, regarding ‘Segregation of Duties’, which may be
followed in addition with the concepts like, ‘maker should not be the checker’. Explain those
guidelines.
5. What is ‘Data Integrity’? Explain six categories of Integrity Controls in brief.
6. Explain some of the key logical access controls in detail with the help of suitable examples.
7. Describe major controls over environmental exposures.
8. What is Cyber Fraud? Differentiate between pure cyber frauds and cyber enabled frauds.
9. Explain major cyber-attacks reported by various agencies in recent years.
10. Discuss Managerial Controls and their categories in brief.
11. Write short notes on the following:
(i) Need for protection of Information Systems (ii) Compensatory Controls
(iii) BCP Controls (iv) Cyber Frauds
(v) Topological Controls (vi) Backup Controls

© The Institute of Chartered Accountants of India