Auditing2e ppt15 l03

Auditing IT Infrastructures for
Compliance
Lesson 3
What Is the Scope of an
IT Compliance Audit?
© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com
All rights reserved.
Learning Objective
▪ Explain the scope of an IT audit for
compliance and the use of standards and
frameworks.

Auditing IT Infrastructures for Compliance www.jblearning.com Page 2
Key Concepts
▪ The business challenges that exist in compliance
▪ The ISS domains that are audited within an IT
infrastructure
▪ The organizational barriers to maintaining IT
compliance
▪ The organizational involvement in maintaining IT
compliance
▪ Proper security controls, such as configuration
and change management

What Must Your Organization Do
to Be in Compliance?
▪ Start with an organizational governance
framework
• Example: ISO27k, NIST, COBIT, SANS
▪ Implement controls
▪ Have sound policies in place
▪ Perform a gap analysis

Business Challenges to the
Organization for Compliance
• Standards/regulations change
• Organizational policies change
External
• Standards can interfere with

operations
Internal • Gaining acceptance is
challenging

Privacy Management
Privacy Management – “The rights and obligations of individuals and
organizations with respect to the collection, use, disclosure, and retention of
personal information.”
Social
Name Security Address
number
Physical
E-mail
characteristics

Protecting Privacy Data
▪ Develop appropriate privacy policies
▪ Establish a privacy officer
▪ Conduct training and awareness around data handling,
identity theft, and social engineering
▪ Establish data retention and data destruction controls
▪ Conduct regular risk assessments of access controls
▪ Limit data to only that which is required
▪ Consider security technologies (encryption)
▪ US privacy laws and regulations: HIPAA, GLBA, COPPA,
DNC Registry, and more
▪ EU privacy laws and regulations: GDPR

Designing and Implementing
Security Controls
Assess Authorize Monitor
Discover Select Implement
Discover Security Implement Assess Authorize Monitor the
and controls security security the controls
classify controls controls controls
data and
information
systems

What Are You Auditing Within
the IT Infrastructure?
▪ Examine the existence of relevant and
appropriate security policies and
procedures.
▪ Verify the existence of controls supporting
the policies.
▪ Verify the effective implementation and
ongoing monitoring of the controls.

Domain Audit Objectives
Examine
Verify controls
security
that support
policies and
the policies
procedures
Verify
implementation
and ongoing
monitoring of
the controls

Seven Domains of a Typical IT
Infrastructure

Auditing ISS Domains
User Domain
Acceptable use policy (AUP),
Anyone accessing
system access policy, Internet Authentication methods
organizations info
access policy, e-mail policy
Workstation Domain
Desktops, laptops, printers,
End user’s computing Maintenance of system
scanners, mobile devices,
environment hardware and software
wireless devices

Auditing ISS Domains (con’t)
LAN Domain
Access to centralized Logon access control,
Computing and networking resources (file servers, hardening, configuration,
equipment printers), administration, backup procedures, network
physical connections power supply
LAN-to-WAN Domain
Routers, firewalls, intrusion Public IP addresses; high
WAN connects multiple LANs
detection devices level of security required

WAN Domain
Routers, firewalls, intrusion Channel service unit/data
End-to-end connectivity detection system, service unit, codecs,
between LANs telecommunications backbone circuits, Internet,
components untrusted zone
Remote Access Domain

Remote access solutions,
Access organization Unsecured transports,
VPNs, encryption, two-factor
resources remotely Internet, dial-up modem
authentication

System/Application Domain
Mainframes, application Harden servers to authorized
Systems and software servers, Web servers, baseline, configured to
applications that users access proprietary software, and policies and standards with
applications controls
Audit preparedness!!

What Must Your Organization Do
to Maintain IT Compliance?
Conduct periodic security
assessments
Perform an annual security

compliance audit
Define proper security controls

Defining Proper Security
Controls
Defined roles and responsibilities
Configuration and change management
Environments for development test and production
Segregation of duties

Defining Proper Security
Controls (Cont.)
Identity and authentication
Principle of least privilege
Monitoring, measuring, and reporting
Appropriate documentation

Creating an IT Security Policy
Framework

Configuration and Change
Management
▪ Process of systems control throughout their
life cycle
▪ Making sure that systems are operating
correctly and as intended in accordance
with security policies and standards

Organizational Barriers to IT
Compliance
▪ Lack of alignment to the business
objectives and strategy
▪ General misunderstanding on the rationale
for IT compliance
▪ Funding shortfalls
▪ Support from top management
▪ Misconception of what the IT compliance
will do for the organization
Security Controls, Configuration
and Change Management
Security
Apply across the IT infrastructure
Controls
Configuration Ensures changes are requested,

Management evaluated, and authorized
Change Provides method for tracking

Management unauthorized changes

Configuration and Change
Management Process
Identify and Evaluate

Decision
request change
response
change request
Implement
Monitor
approved
change
change

Summary
▪ The business challenges that exist in compliance
▪ The ISS domains that are audited within an IT
infrastructure
▪ The organizational barriers to maintaining IT
compliance
▪ The organizational involvement in maintaining IT
compliance
▪ Proper security controls, such as configuration
and change management


Auditing2e ppt15 l03

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Auditing2e ppt15 l03

Uploaded by

Copyright:

Available Formats

Auditing IT Infrastructures for

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

• Standards can interfere with

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Remote Access Domain

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Perform an annual security

Define proper security controls

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Defined roles and responsibilities

Configuration and change management

Environments for development test and production

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Identity and authentication

Principle of least privilege

Monitoring, measuring, and reporting

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Configuration Ensures changes are requested,

Change Provides method for tracking

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Identify and Evaluate

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

You might also like