Presented by: Brandon McAndrew Jordan Schafer Keith Edwards IT Audit Automation

Overview of scripting languages Demonstrations IT Audit Automation

A type of programming language Interprets and automates the execution of tasks Script Language

Examples 1. Bash – UNIX or UNIX-like operating systems 2. Visual Basic – Microsoft Office Applications 3. ACLScript – Audit Command Language (ACL) Analytics Script Language

When to use scripts? 1. If repetitive tasks need to be completed 2. If a large number of sample items need to be reviewed 3. If similar reviews will be conducted in the future Script Language

Items to consider before writing a script 1. What do you need the script to do? 2. What criteria will be used for tests? 3. How will source data be obtained? Script Language

You don’t always need a formal programming background to write and use scripts! Script Language

Web searches and help files are a great starting place. Script Language

Demonstration

When not to use scripts? 1. When source data will be provided in an inconsistent format 2. When there is no positive cost benefit 3. When resource limitations become a barrier Script Language

Risks when using scripts 1. Errors in scripting logic producing improper results 2. Could prompt auditors to jump to faulty conclusions 3. Costs could exceed benefits Script Language

Questions And Answers (3 Minutes)

Illustration: Oracle

Summary - Oracle Illustration 1. Obtain an understanding 2. Establish criteria 3. Identify tables 4. Request files 5. Design import script 6. Design testing script 7. Design export script 8. Design master script

Handout – “Oracle Example Script”

 Identify the database and version  V$Version Obtain An Understanding

 CIS benchmarks  Policies and procedures  Determine the most restrictive Obtain Criteria ?

 DBA_Users  DBA_Profiles  DBA_Parameters Identifying Tables  DBA_RolePrivs  DBA_TabPrivs  DBA_SysPrivs

 Request files  Easiest format Data Gathering

 Perform manually  Import scripts  Comments  Perform reconciliations Designing Scripts Step 1 -Formatting

 Add comments  Define the fields  Use established criteria to create tests  Direct tests  Indirect tests  Other information (Criteria reference) Designing Scripts Step 2 - Testing

Defining Fields

Direct Tests Input “Not In Compliance” in the virtual field V_COMPLIANCE if “Failed Login Attempts” is greater than 5 or set to “Unlimited” and is not “DEFAULT.”

Indirect Tests/ Other Information

 Export script  Perform manually  Follow up on all items Step 3 Output & Overview

Master Script  Create 1 script that controls all other scripts  Identifies which scripts are ran  Sets overall variables  Identifies outputs

Questions And Answers (3 Minutes)

Statewide UNIX Security Controls Illustration

Summary – UNIX Illustration Selecting audit criteria and defining tests Visual Basic Writing a data gathering script Solaris operating system Automating testing in ACL Importing criteria and source files

Background UNIX is a multiuser and multitasking operating system Various open source and commercial variations Automation for data gathering and data analytics

Audit Criteria & Defining Tests Selecting audit criteria Defining the tests applicable to the operating system Separate criteria and tests per operating system Making audit criteria variable Simple and efficient changes Visual Basic

Demonstration

Data Gathering Selecting a script language Using audit criteria Other sources of information Testing commands and reviewing results

Demonstration

Data Gathering – Continued Commenting and formatting your scripts Determine the need for multiple scripts Thoroughly test the final scripts Ensure auditee cooperation Request auditee review the script Make scripts simple or complex Ensure uniformity Allow for efficient adjustments

Demonstration

Importing data Audit criteria (Visual Basic) Data gathering results (source files from server) Creating control scripts Dialog boxes for users of the scripts Allow the user to determine tests ran and outputs generated Using variables and adding pertinent information Data Analysis – ACL

Demonstration

Testing & Results - ACL Testing Scripts Base script logic on audit criteria Thoroughly test Results Export necessary information Manually review results and make conclusions Perform normal testing procedures with script outputs

Demonstration

Concluding Thoughts Putting it all together Lessons learned Impact on IT audits

fin.

Contact Information Brandon McAndrew – Jordan Schafer – Keith Edwards –