Presentation is loading. Please wait.

Presentation is loading. Please wait.

GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Dotting Your I’s and Crossing Your T’s: Preparing for an IT Audit David.

Published byToby Parker Modified over 9 years ago

Similar presentations

Presentation on theme: "GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Dotting Your I’s and Crossing Your T’s: Preparing for an IT Audit David."— Presentation transcript:

1 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Dotting Your I’s and Crossing Your T’s: Preparing for an IT Audit David Nisbet & Shelia Sloan Information Technology Services Board of Regents of the University System of Georgia

2 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Agenda Why Audits Matter Learning from the Past Two Years’ Audits Knowing What Auditors are Looking For ITS-developed Tools and Processes How You Can Prepare for Your Next IT Audit Q&A

3 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 University of Hawaii faces lawsuit after a security breach in 2009 Names, academic performance, disabilities, and other sensitive information of 40,000 former University of Hawaii students was online for nearly a year. Why Do Audits Matter?

4 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Ohio State University is notifying up to 760,000 students, professors and others that their names and Social Security numbers might have made it to cyberspace in one of the largest and most costly breaches to hit a college campus. Why Do Audits Matter? Ohio State expects to spend about $4 million to pay for the forensic investigation and credit-protection services for those whose personal information was on a server that was hacked.

5 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 University of Texas at Austin acknowledged that the names, e-mail addresses and Social Security numbers of some 59,000 students, alumni and employees were obtained through a brute force attack on a University database. According to the University, the incident could have been prevented if additional security measures were taken. Why Do Audits Matter?

6 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Headline: Two Charged with Hacking PeopleSoft to Fix Grades Why Do Audits Matter? Two California men are facing 20 years in prison on charges they hacked into a California state university's PeopleSoft system to change their grades. IT staff finally caught wind of the problem during a routine audit.

7 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 An examination of the checks and balances, or controls, within an information technology (IT) group Collects and evaluates "evidence" of an organization's information systems, practices, and operations Determines if the information systems are: -safeguarding the information assets -maintaining data integrity -operating effectively and efficiently to achieve the organization's business goals or objectives What is an IT Audit?

8 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 2010 focused on: Change management issues – Supporting documentation – Approvals Terminated employee access in PeopleSoft Financials 2011 focused on: Security forms and approvals for user access More concentrated campus focus PeopleTools access Shift in focus to Banner Previous Years’ Audits

9 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Auditors are looking for: General and application controls Backup procedures Monitored and documented job scheduling Auditors are interested in insuring data integrity, availability and confidentiality.

10 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 General and Application Controls include Logical Access, Change Management, and IT Operations. ways to help maintain general and application controls… There are

11 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 1.Strong Password Settings Minimum lengths Complex password composition Lock accounts Frequently force changes Nine General and Application Controls

12 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 2. Limit Privilege Functions to appropriate personnel Review your security administrators on campus. Look at users with full access. Do users have access to system utilities/resources such as database tools, sql tools and crystal reports? Nine General and Application Controls

13 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 3.Maintain Segregation of Duties by separating the following roles: Requesting Access Approving Access Setting up Access Monitoring Access and Violations Performing Rights as a privileged user, and Monitoring a privileged user Nine General and Application Controls

14 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 4. Ensure Appropriate User Access and Authorization Is there an authorization form on file with the appropriate approvals in place? Are these periodically reviewed for changes or updates? Are terminated employee accounts locked or removed? Nine General and Application Controls

15 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 5.Maintain General Security Settings Firewalls Anti-Virus software Re-authentication Encryption Time-outs Nine General and Application Controls

16 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 6.Control Access Physical access of computer hardware Access to the data center Environmental controls such as fire suppression, temperature control, and UPS Nine General and Application Controls

17 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 7. Change Management Are the changes to the application approved, tested, monitored, and authorized? What are the types of changes? Updates Bugs Functionality Report changes Nine General and Application Controls

18 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 8. Change Management - Maintain Separation of Duties Requester of change Developer of change System Tester of change Person who migrates the change in and out of production Person who monitors the program development and changes Nine General and Application Controls

19 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 9. Testing should involve User Testing F89UAT was created for the purpose of user testing. Changes are migrated here after system testing is complete. Users validate the changes in a test environment and provide approval that it has met their requirements. Nine General and Application Controls

20 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Ensure Back up Procedures are in Place Frequency location Testing Monitoring Backup Procedures

21 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Have a Disaster Recovery Plan Procedures for restoration Key personnel/processes Vendor for equipment How to return to normal operations Backup Procedures

22 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Job Scheduling includes: Backup Processes Batch Processes Responsible Personnel Resolution procedures Requirements Job Scheduling

23 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Monthly, ITS performs an internal security review. This review focuses on: Super User Access – Security Admins Terminations – Are the accounts locked and base role removed? – Uses query BOR_SEC_TERMINATED_USERS User Access – User Page Access report: Main Menu > BOR Menus > BOR Utilities > User Access Report – There is also a ROLE PAGE access report to cross reference ITS-developed Tools and Processes

24 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Locking Accounts ITS-developed Tools and Processes

25 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Remove the Base Role ITS-developed Tools and Processes

26 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Review documentation and security request form Is there a security request form on file for all users, and does it match their access in the system? http://www.usg.edu/gafirst- fin/documentation/job_aids/category/security/ http://www.usg.edu/gafirst- fin/documentation/job_aids/category/security/ Update PeopleSoft and security forms for users whose jobs have changed Ensure appropriate approvals are in place Review terminations Prepare for an Audit with Monthly Monitoring

27 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Review user preferences and role assignments for control and segregation of duty issues. Review budget security Limit approvals to certain individuals Prepare for an Audit with Monthly Monitoring

28 GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123

Download ppt "GALILEO GeorgiaBEST GeorgiaFIRST Georgia ONmyLINE GeorgiaVIEW GIL PeachNet USG123 Dotting Your I’s and Crossing Your T’s: Preparing for an IT Audit David."

Similar presentations

Overview This session is aimed at both PeopleSoft Financials users and Security Administrators. We will discuss plans for the 9.2 upgrade including.

Overview This session is aimed at both PeopleSoft Financials users and Security Administrators. We will discuss plans for the 9.2 upgrade including.
Identity, Governance and Administration as forefront of IT Security model: European and North American Experience Vladislav Shapiro Director of Identity.

Identity, Governance and Administration as forefront of IT Security model: European and North American Experience Vladislav Shapiro Director of Identity.
Information Systems Audit Program (cont.). PHYSICAL SECURITY CONTROLS.

Information Systems Audit Program (cont.). PHYSICAL SECURITY CONTROLS.
Auditing Computer Systems

Auditing Computer Systems
9 - 1 Computer-Based Information Systems Control.

9 - 1 Computer-Based Information Systems Control.
MSIA 711 1 Introduction to Information Systems Security Training and Policy Week 1 Live Session Presentation.

MSIA Introduction to Information Systems Security Training and Policy Week 1 Live Session Presentation.
The Islamic University of Gaza

The Islamic University of Gaza
OMB Circular A-123 – Management’s Responsibility for Internal Control Policy Applicability Sources of Information Assessment, Documentation and Reporting.

OMB Circular A-123 – Management’s Responsibility for Internal Control Policy Applicability Sources of Information Assessment, Documentation and Reporting.
Security Controls – What Works

Security Controls – What Works
Chapter 5 IT Processes Presented by Dr. Mohamed Sammouda.

Chapter 5 IT Processes Presented by Dr. Mohamed Sammouda.
Data Security Issues in IR Eileen Driscoll Institutional Planning and Research Cornell University

Data Security Issues in IR Eileen Driscoll Institutional Planning and Research Cornell University
Managing the Information Technology Resource Jerry N. Luftman

Managing the Information Technology Resource Jerry N. Luftman
Security Management IACT 918 July 2004 Gene Awyzio SITACS University of Wollongong.

Security Management IACT 918 July 2004 Gene Awyzio SITACS University of Wollongong.
Internal Control Concepts A Guide for Deans, Directors, and Department Chairs.

Internal Control Concepts A Guide for Deans, Directors, and Department Chairs.
ITS Offsite Workshop 2002 PolyU IT Security Policy PolyU IT/Computer Systems Security Policy (SSP) By Ken Chung Senior Computing Officer Information Technology.

ITS Offsite Workshop 2002 PolyU IT Security Policy PolyU IT/Computer Systems Security Policy (SSP) By Ken Chung Senior Computing Officer Information Technology.
Factors to be taken into account when designing ICT Security Policies

Factors to be taken into account when designing ICT Security Policies
Overview of IS Auditing n Need for control and Audit of Computers –Org cost of data loss –cost of incorrect decision –Value of hardware, software, personnel.

Overview of IS Auditing n Need for control and Audit of Computers –Org cost of data loss –cost of incorrect decision –Value of hardware, software, personnel.
Auditing 81.3550 Auditing & Automated Systems Chapter 22 Auditing & Automated Systems Chapter 22.

Auditing Auditing & Automated Systems Chapter 22 Auditing & Automated Systems Chapter 22.
Network security policy: best practices

Network security policy: best practices
Security Architecture Dr. Gabriel. Security Database security: –degree to which data is fully protected from tampering or unauthorized acts –Full understanding.

Security Architecture Dr. Gabriel. Security Database security: –degree to which data is fully protected from tampering or unauthorized acts –Full understanding.

Similar presentations

Ads by Google