1. Chapter Three Objectives
Understand risks faced by information assets.
Comprehend the relationship between risk and asset vulnerabilities, and comprehend the nature and types of threats faced by the asset.
Understand the objectives of control and security of information assets and how these objectives are interrelated.
Understand the building blocks of control and security frameworks for information systems.
Apply a controls framework to a financial accounting system.

3. Protecting Information Assets
It is necessary to protect information assets
There is a potential for compromises of such assets.
There may be attacks on the information assets.
There may be unintentional compromises of information assets.
Systems are subject to regulatory protection requirements.

4. Vulnerabilities and Threats
Vulnerability: A weakness in the information assets that leads to risk.
Threat: The probability of an attack on the information asset.
Attack: A series of steps taken by an attacker to achieve an unauthorized result.
Threat agent: An entity, typically a person, who triggers a threat.
Countermeasure: An antidote or an action that dilutes the potential impact of a known vulnerability.

6. Framework for Control and Security
ISO 17799
Is a standard focused on the protection of information assets.
It is broadly applicable across industries, therefore it is a high-level standard.
It is a general model that follows from Part I of British Standard 7799 (BS 7799).
The standard is organized into ten categories (sections).
Each section is divided into subcategories, each of which includes a broad implementation approach (method).

7. Internal Control and Information Security Objectives
Internal control objectives
Efficiency of operations
Effectiveness of operations
Reliability of information
Compliance with applicable laws and regulations
Information security objectives
Information integrity
Message integrity
Confidentiality
User authentication
Nonrepudiation
Systems availability

8. A Comparison of Internal Control and Information Security Objectives
Objectives of internal controls
Objectives of information security
Effectiveness of operations
Efficiency of operations
Reliability of information
Compliance with regulations
Information integrity X
Confidentiality
User authentication
Non-repudiation
Availability

9. Implementing a Framework

10. Assurance Considerations
Without a framework, no objectives can be achieved with a high degree of assurance.
A first step toward assurance is to adopt a holistic framework.
Elements of more than one framework can be combined into the framework adopted by an entity, to provide necessary granularity.
The framework allows for a systematic approach to the design, implementation, and audit of control and security systems.
The business may seek assurance regarding proper implementation of a chosen framework.