SESSION OBJECTIVES

• DISTINGUISH GENERAL CONTROLS FROM APPLICATION CONTROLS AND DISCUSS THEIR IMPORTANCE.

• IDENTIFY RED FLAGS THAT MAY BE AN INDICATION OF GENERAL IT CONTROL DEFICIENCIES

• DISCUSS CATEGORIES AND PROVIDE SPECIFIC EXAMPLES OF IT GENERAL CONTROLS

• PROVIDE SEVERAL IT CONTROL AND SECURITY MODELS RECOGNIZED IN THE INDUSTRY

• PROVIDE A CALL TO ACTION THAT ALL MUST WORK TOGETHER FOR IT TO BE SECURE AND EFFECTIVE

2

SO WHY ARE CONTROLSSO IMPORTANT?

3

COSO PRINCIPLES

4

IMPORTANCE OF GENERAL CONTROLS

•COSO 2013 PRINCIPLE 11 STATES: SELECTS AND DEVELOPS GENERAL

CONTROLS OVER TECHNOLOGY.

•TO SINGLE OUT GENERAL CONTROLS OVER IT FROM ALL OTHER

CONTROL ACTIVITIES SIGNIFIES THEIR IMPORTANCE TO THE ENTIRE

ORGANIZATION. EXPRESSED ANOTHER WAY:

• “IF TOP MANAGEMENT DOES NOT KNOW AND CONTROL WHAT HAPPENS IN THE IT

DEPARTMENT, THEN THEY ARE DELUDING THEMSELVES REGARDING THE

EFFECTIVENESS OF THEIR ENTIRE SYSTEM OF INTERNAL CONTROLS”

5

APPLICATION VS. GENERAL CONTROLSAPPLICATION CONTROLS ARE SIMPLY THE AUTOMATED VERSION OF WHAT

WE HAVE ALWAYS DONE:TRADITONAL AUTOMATED

Locked filing cabinet User ID and Password

Physical segregation of duties Password hierarchies that segregate duties

through screen access

Illegible initials on paper invoices Automated workflow approvals

Manual review, paper forms, footing of inputs Input controls, automatic population of certain

fields, edit checks

Using reports to monitor and control budget System controls that refuse to process

transactions if budget authorization is inadequate.

6

APPLICATION VS. GENERAL CONTROLS•GENERAL CONTROLS REPRESENTS WHAT HAPPENS IN THE IT DEPARTMENT TO

KEEP:

• COMPUTERS CONNECTED.

• DATA BASES HUMMING.

• APPLICATIONS RUNNING AND RELIABLE.

• RESPONSE TIMES FAST.

• INFORMATION TRUSTWORTHY.

• HACKERS AT BAY.

• IN ADDITION, WHEN BAD THINGS HAPPEN, GENERAL CONTROLS ENSURE RAPID

DETECTION, RECOVERY AND REMEDIATION.

7

POLLING QUESTION #1

NEAT, LABELED ELECTRICAL AND NETWORK CABLING

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

8

POLLING QUESTION #2

PAYROLL SYSTEM ONLY PAYS INDIVIDUALS WHO ARE ESTABLISHED IN THE

HUMAN RESOURCE SYSTEM

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

9

POLLING QUESTION # 3SECURITY AWARENESS TRAINING:

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

10

POLLING QUESTION #4ACCESS BY ACCOUNTS PAYABLE STAFF TO ENTER TRANSACTIONS, BUT

ACTUAL PAYMENT MUST BE APPROVED BY A SUPERVISOR:

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

11

POLLING QUESTION #5ACCESS BY DATA BASE ADMINISTRATOR TO THE TEST ENVIRONMENT BUT

CHANGES MADE CANNOT BE MOVED TO PRODUCTION WITHOUT REVIEW AND

APPROVAL:

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

12

POLLING QUESTION #6RECONCILIATION AND AGREEMENT OF GENERAL LEDGER BALANCES TO SUB-

LEDGER BALANCES:

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

13

POLLING QUESTION #7VIRTUAL PRIVATE NETWORK (VPN) SOFTWARE INSTALLED ON A LAPTOP

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

14

POLLING QUESTION # 8

REVIEWING THE CHANGE LOGS REGARDING SCREEN ACCESS FOR ACCOUNTING EMPLOYEES

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

15

POLLING QUESTION # 9

REVIEWING CHANGE LOGS TO DETERMINE CHANGES MADE TO EMPLOYEES HAVING

ADMINISTRATIVE PRIVILEGES FOR THE ACCOUNTING APPLICATION:

A. APPLICATION CONTROL

B. GENERAL CONTROL

C. COULD BE BOTH

D. NEITHER

16

RED FLAG WARNINGS

17

RED FLAGS• EVEN PRIOR TO A CYBER ATTACK OR SIGNIFICANT NETWORK FAILURE, WARNING

SIGNS LIKELY EXIST:

• FREQUENT SYSTEM OUTAGES-A SIGN OF NETWORK FRAGILITY AND SINGLE POINTS OF FAILURE

• LEGACY SUPPORTING LEGACY-OLDER APPLICATIONS THAT REQUIRE OLDER OFTEN VULNERABLE

ANCILLARY PROGRAMS SUCH AS BROWSER, ADOBE ETC.

• LOW IT BUDGETS- WITH TODAY’S INTERCONNECTEDNESS AND INTERDEPENDENCE , IT IS NOT CHEAP AND

CUTTING CORNERS WILL COST YOU IN THE LONG RUN

• LACK OF TRAINING AND CERTIFICATIONS-THE COMPLEXITY AND PACE OF CHANGE MANDATE CONSTANT

TRAINING AND HIRING CERTIFICATIONS AND EXPERIENCE FOR KEY POSITIONS

• INABILITY TO OBTAIN CYBER-INSURANCE- INSURERS HAVE GOTTEN BURNED AND QUITE GOOD AT

ASSESSING RISK DECLINING COVERAGE FOR MANY GOVERNMENTS

• APPLICATION IMPLEMENTATION FAILURES. OVER BUDGET, MISSED DEADLINES, MISSING FUNCTIONALITY

18

GENERAL CONTROLS-

GETTING INTO THE WEEDS

19

IT GENERAL CONTROLS-ADMINISTRATIVE❑ ALIGNMENT WITH STRATEGIC GOALS AND CULTURE

❑ POLICIES

❑ RISK ASSESSMENT

❑ ADMINISTER SECURITY PROGRAM

❑ HIRING AND SCREENING

❑ USER ACCESS PROCESS (NEW USER, TERMINATIONS, CHANGES)

❑ ACCESS AUTHORIZATION

❑ SEGREGATION OF DUTIES

❑ PRINCIPLE OF LEAST PRIVILEGE

❑ EXPECTATIONS OF DUE CARE AND DUE DILIGENCE

❑ LICENSE MANAGEMENT

❑ CHANGE LOG MONITORING AND RECONCILIATION

❑ ASSET INVENTORIES, REPLACEMENT/REFRESH AND DISPOSAL POLICIES

❑ CENTRALIZED VS. DECENTRALIZED DEVICE MANAGEMENT POLICIES

❑ CONTINGENCY PLANNING / BUSINESS CONTINUATION/ DATA BACKUP

❑ ANNUAL AND MULTI-YEAR BUDGETING FOR MAINTENANCE, UPGRADE AND REPLACEMENT AKA-SUSTAINABILITY

B 20

ADMINISTRATIVE CONTROL EXAMPLES• HIRING AND SCREENING

• SEPARATE IT PAY PLAN TO COMPETE WITH PRIVATE SECTOR

• CJIS CERTIFICATION FOR ALL IT EMPLOYEES

• REQUIRING CERTIFICATIONS OR CONDUCTING HANDS ON TEST OF BASIC SKILLS

• SEGREGATION OF DUTIES

• SPECIAL PROTECTIONS AND NO DAILY USE OF ENTERPRISE ADMINISTRATOR PASSWORD AND FUNCTION

• DIVIDING ADMINISTRATIVE DUTIES AND ACCESS AMONG PERSONNEL

• BUDGETING

• DEVELOP A MULTI-YEAR PLAN FOR REFRESHMENT BASED ON ANNUAL INVENTORIES OF HARDWARE AND

LICENSES

21

PLANNED OBSOLESCENCE IS INCESSANT AND INEVITABLE

Budget for it!

22

IT GENERAL CONTROLS-PHYSICAL

❑ FACILITY ACCESS CONTROLS

❑ WORKSTATION CONTROLS

❑ DEVICE AND MEDIA CONTROLS

❑ FACILITY MAINTENANCE

❑ UPS

❑ BACK UP FACILITIES

23

PHYSICAL CONTROLS EXAMPLES

• COMPREHENSIVE ASSESSMENT AND MONITORING OF DATA CENTER AND IDF CLOSETS

• PURPOSE BUILT? IF NO, PROPERLY ADAPTED

• REMOTE MONITORING FOR INTRUSION AND ENVIRONMENT

• PROPERLY SECURED

• UPS AND GENERATORS

• ADEQUATE FOR NEEDS

• ROUTINELY TESTED

24

IT GENERAL CONTROLS-TECHNICAL❑ AUTHENTICATION CONTROLS (PASSWORD, ETC.)

❑ ACCESS CONTROLS (OPERATING SYSTEM, APPLICATION)

❑ AUDIT CONTROLS (MONITORING AND TESTING)

❑ ENCRYPTION CONTROLS

❑ ARCHITECTURE CONTROLS (FIREWALLS, VPN, ETC.)

❑ CONFIGURATION CONTROLS

❑ SYSTEM MONITORING –VULNERABILITY SCANS, INCIDENT ALERTS, INTRUSION

DETECTION AND PREVENTION

25

TECHNICAL CONTROL EXAMPLES

• PASSWORDS-RECOMMENDATIONS ON STRONG PASSWORDS AND CHANGE FREQUENCY ARE CHANGING BUT GOVERNMENT

MUST ALSO COMPLY WITH CJIS, PCI AND OTHER ENTITIES THAT MAY NOT HAVE CAUGHT UP. COMPLEXITY AND MINIMUM

LENGTH OF EIGHT TO TEN CHARACTERS IS COMMON.

• MONITORING-POOR CONFIGURATION OR ARCHITECTURE MAY BE DETECTED THROUGH VULNERABILITY SCANS THAT CAN

ALSO ALERT YOU TO KNOWN HARDWARE OR SOFTWARE WEAKNESSES AND OUT OF DATE PATCHES.

• AVOIDING PASSWORD HASH CACHES-POOR CONFIGURATION OR USE OF CERTAIN PERIPHERALS CAN LEAD TO PASSWORD

HASHES BEING STORED IN THE NETWORK. ALTHOUGH NOT USEABLE IN HASH FORM, SOPHISTICATED SOFTWARE CAN TRY

MILLIONS OF POSSIBLE PASSWORDS TO REVERSE ENGINEER THE HASH BACK TO THE PASSWORD.

• ALERTS-MONITORING SOFTWARE CAN AUTOMATICALLY ALERT IT PERSONNEL WHEN CERTAIN CONDITIONS OCCUR. A

SKILLED, EXPERIENCED CONFIGURERER IS KEY TO AVOIDING TOO MANY FALSE POSITIVES OR NEGATIVES.

26

IT GENERAL CONTROLS-VENDOR MANAGEMENT

❑ IT IS HEAVILY DEPENDENT ON VENDORS FOR SOFTWARE, HARDWARE AND

SERVICES, MAKING STRONG VENDOR MANAGEMENT CRUCIAL

❑ CONTRACT LANGUAGE (CONFIDENTIALITY, OWNERSHIP, REGULATORY AND

LEGAL COMPLIANCE)

❑ PERFORMANCE MONITORING AND ENFORCEMENT

❑ CONTROLS AUDIT, SOC/AT-C 801

❑ VENDOR ACCESS CONTROL

❑ VENDOR COPIES OF CONFIDENTIAL INFORMATION

27

VENDOR MANAGEMENT EXAMPLES

• CENTRAL CONTRACT DATABASE WITH TICKLERS FOR KEY DATES SUCH AS CONTRACT TERM, INSURANCE

RENEWALS, LICENSE RENEWALS ETC.

• USE OF A CONTRACT ATTORNEY SPECIALIZING IN IT TO DRAFT A STANDARD TEMPLATE FOR CONTRACTS

• SOC REPORTS-SEE FOLLOWING SLIDE

• STRONG RFP AND VENDOR VETTING USING MATERIAL AND ADVICE FROM ASSOCIATIONS SUCH AS

TAGITM OR CONSULTANTS.

• BUYING HARDWARE ONLY FROM OEM SUPPLIERS

• USE OF RECOGNIZED BUSINESS PARTNERS WHEN POSSIBLE

28

CHARACTERISTICS OF SOC REPORTS

• A SOC 1 TYPE 2 REPORT WILL BE REPORTING ON A SERVICE ORGANIZATIONS INTERNAL CONTROLS OVER THE GENERATION OF

INFORMATION INCLUDED BY A THIRD PARTY IN ITS FINANCIAL STATEMENTS FOR A SPECIFIED PERIOD OF TIME (I.E. ONE

YEAR)

• TO ISSUE THE REPORT, THE SERVICE AUDITOR WILL NEED TO HAVE PERFORMED TESTING THROUGHOUT THE TIME PERIOD SPECIFIED.

• BY DEFINITION TESTING CANNOT BE DONE AFTER THE PERIOD HAS ENDED AND AS A RESULT SOC 1 TYPE 2 REPORTS ARE TYPICALLY

ISSUED SHORTLY AFTER THE END OF TIME PERIOD (I.E. FOUR TO SIX WEEKS)

• WITH COMPLEX ORGANIZATIONS PROCESSING MILLIONS OF TRANSACTIONS PER YEAR, THE SERVICE AUDITOR WILL INVARIABLY

HAVE SOME FINDINGS (OFTEN CALLED EXCEPTIONS) THAT THEY WILL REPORT AND MANAGEMENT WILL FURNISH A RESPONSE

• EXCEPTIONS DO NOT NECESSARILY MEAN THAT THE SYSTEM OF CONTROLS ARE NOT WORKING EFFECTIVELY AND CAN OCCUR

WITHOUT THE SERVICE AUDITOR MODIFYING THEIR REPORT

• USERS OF SOC REPORTS SHOULD NOTE THE FREQUENCY OF EXCEPTIONS INCLUDING WHETHER THE SAME EXCEPTION IS NOTED IN

MULTIPLE YEARS TO CONSIDER POSSIBLE IMPACTS ON FINANCIAL INFORMATION

29

IT GENERAL CONTROLS-SECURITY❑ PERFORM AN INFORMATION SECURITY RISK ASSESSMENT

❑ SECURITY INCIDENT RESPONSE

❑ SECURITY AWARENESS & TRAINING-EVERY EMPLOYEE WHO HAS ACCESS TO A COMPUTER SHOULD CONSIDER

THEMSELVES A SECURITY TEAM MEMBER

❑ THREAT MONITORING

❑ REGULARLY TEST OR MONITOR EFFECTIVENESS OF CONTROLS

❑ HAVE OUTSIDE PARTY PERFORM PENETRATION TESTING

❑ PERIODICALLY EVALUATE AND ADJUST THE INFORMATION SECURITY PROGRAM

B

30

SERVICE ORGANIZATION CONTROL REPORTS• CATEGORIES OF SOC REPORTS WILL BE A 1 OR 2 BASED ON THE COSO DEFINITION OF THE THREE OBJECTIVES OF ALL

ORGANIZATIONS

• FINANCIAL REPORTING (1)

• COMPLIANCE (2)

• OPERATIONS

• IN ADDITION, SOC REPORTS CAN BE EITHER TYPE 1 OR 2

• TYPE I INCLUDES THE SERVICE AUDITOR'S OPINION ON THE FAIRNESS OF THE PRESENTATION OF THE SERVICE ORGANIZATION'S

DESCRIPTION OF CONTROLS THAT HAD BEEN PLACED IN OPERATION AND THE SUITABILITY OF THE DESIGN OF THE CONTROLS TO

ACHIEVE THE SPECIFIED CONTROL OBJECTIVES AS OF A POINT IN TIME.

• TYPE II STARTS WITH THE INFORMATION CONTAINED IN A TYPE I SERVICE AUDITOR'S REPORT AND ADDS TO IT THE SERVICE

AUDITOR'S OPINION ON WHETHER THOSE CONTROLS WERE OPERATING EFFECTIVELY DURING A SPECIFIED PERIOD OF TIME.

31

MAKING EVERY EMPLOYEE AN IT SECURITY OFFICER▪ INTERNET BASED TUTORIALS FOR ALL EMPLOYEES IS AVAILABLE AT VERY REASONABLE COSTS-OFTEN

STARTING AT LESS THAN $10 PER EMPLOYEE PER YEAR

▪SERVICES CAN RANGE FROM SIMPLE TUTORIALS, TO CREATING BASELINES AND CONDUCTING PHISHING

CAMPAIGNS TO ASSESS AND REDUCE EMPLOYEE GULLIBILITY OVER TIME

▪SOME PROVIDERS:

• WWW.SECURITYMENTOR.COM

• WWW.KNOWBE4.COM

• WWW.MEDIAPRO.COM

• WWW.WOMBATSECURITY.COM

32

LEVERAGING SHARED SERVICES

• TEXAS DEPARTMENT OF INFORMATION RESOURCES (DIR) AWARDED AT&T A MANAGED

SECURITY SERVICES (MSS) CONTRACT:

• AVAILABLE TO ALL GOVERNMENTS IN TEXAS

• OFFERS A MENU OF ALA CARTE SERVICES WITHIN THREE CATEGORIES:

• SECURITY MONITORING AND DEVICE MANAGEMENT

• INCIDENT RESPONSE

• RISK AND COMPLIANCE

• STATE AGENCIES ARE NOW REQUIRED TO PERFORM A CYBERSECURITY ASSESSMENT EVERY

TWO YEARS. LOCAL GOVERNMENTS WOULD BE SMART TO FOLLOW THE MODEL.

33

MY FAVORITE FOUR LETTER WORD-FREE!• THE DEPARTMENT OF HOMELAND SECURITY (WWW.DHS.GOV) OFFERS A VARIETY OF FREE

SERVICES TO STATE AND LOCAL GOVERNMENT

HTTPS://WWW.DHS.GOV/SITES/DEFAULT/FILES/PUBLICATIONS/4_STC-DHS-STATE-OFFERINGS.PDF INCLUDING:

• THE CYBER SECURITY EVALUATION TOOL (CSET) CSET@DHS.GOV AND HTTPS://ICS-CERT.US-

CERT.GOV/ASSESSMENTS

• THE CYBERSECURITY ASSESSMENT AND RISK MANAGEMENT APPROACH NCSD_CIP-CS@DHS.GOV

• THE SANS INSTITUTE IS A COOPERATIVE RESEARCH AND EDUCATION ORGANIZATION

(WWW.SANS.ORG) SPECIALIZING IN IT SECURITY. THE OFFER A VARIETY OF FREE

RESOURCES AND FOR FEE COURSES, CONFERENCES AND CERTIFICATIONS.

• ALSO, INQUIRE OF YOUR CYBER POLICY INSURANCE CARRIER REGARDING

ASSESSMENT RESOURCES OR PRE-IDENTIFIED CONSULTANTS THAT CAN HELP

34

IT CONTROL AND SECURITY MODELS

FIND WHAT WORKS FOR YOU

35

IT FRAMEWORKS• THERE ARE VARIOUS FRAMEWORKS OR GUIDELINES FOR IT MANAGEMENT, THREE COMMONLY USED ARE:

• ITIL (INFORMATION TECHNOLOGY INFORMATION LIBRARY)

• NIST (NATIONAL INSTITUTE FOR STANDARDS AND TECHNOLOGY)

• COBIT (CONTROL OBJECTIVES FOR INFORMATION AND RELATED TECHNOLOGY)

• WHILE ALL CAN BE USEFUL IT IS IMPORTANT TO REMEMBER THAN NONE ARE PRESCRIPTIVE OR

INCLUSIVE . THEY ARE SIMPLY BEST PRACTICE RECOMMENDATIONS AND TRAINING THAT MUST BE

ADAPTED TO YOUR INDIVIDUAL ORGANIZATION.

• THE IMPORTANT THING IS A METHODICAL, COMMITTED, CONTINUAL APPROACH THAT RELIES ON

TRAINING, ENVIRONMENTAL AWARENESS, VIGILANCE AND ADAPTABILITY TO CHANGING

CIRCUMSTANCES.

36

ITIL• SPONSORED BY THE UK GOVERNMENT TO IMPROVE IT PROCESSES

37

NIST FRAMEWORK

• NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY PUBLISHES A HIGHLY RESPECTED FRAMEWORK

38

ISACA CLOSELY FOLLOWS COSO’S LEAD WITH COBIT

• GENERAL INTERNAL CONTROL -

COSO

• INFORMATION TECHNOLOGY

INTERNAL CONTROL – COBIT

• CONTROL OBJECTIVES FOR

INFORMATION & RELATED

TECHNOLOGY (COBIT)

• DEVELOPED BY ISACA -

INFORMATION SYSTEMS AUDIT &

CONTROL ASSOCIATION

39

COBIT FRAMEWORK

40

Governance of Enterprise IT

COBIT 5

IT Governance

COBIT4.0/4.1

Management

COBIT3

Control

COBIT2

An business framework from ISACA, at www.isaca.org/cobit

Audit

COBIT1

COBIT evolution

2005/720001998

Evo

lutio

n o

f sco

pe

1996 2012

Val IT 2.0(2008)

Risk IT(2009)

© 2012 ISACA® All rights reserved.

41

CALL TO ACTION

•JUST AS IT GENERAL CONTROLS EFFECT THE ENTIRE ORGANIZATION,

EFFECTIVE AND SECURE IT CAN NOT HAPPEN SOLELY IN THE IT DEPARTMENT:

• ALL DEPARTMENTS MUST DO THEIR PART WITH REALISTIC EXPECTATIONS, SECURITY AWARENESS AND

PROACTIVE MANAGEMENT AND KNOWLEDGE OF THEIR DEPARTMENT SPECIFIC APPLICATIONS

• FINANCE PLAYS AN ESPECIALLY CRUCIAL ROLE IN CURRENT AND MULTI-YEAR BUDGETING TO ENSURE NEEDED

RESOURCES AND AIDING WITH EXPERTISE AND ADVICE ON CONTROL STRATEGIES

• ALL OF US NEED TO INCREASE OUR UNDERSTANDING OF IT OPERATIONS AND THE ROLE WE PLAY IN ENSURING AN

EFFECTIVE AND SECURE IT OPERATION.

42