1 / 36

Session 21

Session 21. Personal Information Protection and Electronic Documents Act Payment Card Industry standard Web Trust Sys Trust. Personal Information Protection and Electronic Documents Act.

boone
Download Presentation

Session 21

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Session 21 • Personal Information Protection and Electronic Documents Act • Payment Card Industry standard • Web Trust • Sys Trust CSE 4482, 2009

  2. Personal Information Protection and Electronic Documents Act • Governs the collection, use and disclosure of personal information in a manner that balances the right of privacy of all individuals • Requires each organization to designate a responsible officer CSE 4482, 2009

  3. Personal Information • Information about a person that originates from the person, e.g., social insurance number given to an employer, age. • Does not include business information generated for a person, e.g., salary within the employer’s possession or grade within the school’s possession. CSE 4482, 2009

  4. PIPEDA Principles • Accountability – needs a chief privacy officer • Identifying purpose • Consent • Limiting collection CSE 4482, 2009

  5. PIPEDA Principles • Limiting use, retention and disclosure. • Accuracy • Safeguards • Openness CSE 4482, 2009

  6. PIPEDA Principles • Individual access • Challenge CSE 4482, 2009

  7. Web Trust • A Web site assurance service developed by American Institute of Certified Public Accountants (AICPA) and Canadian Institute of Chartered Accountants (CICA) • Reviews have been on large e-commerce sites to gain customer confidence CSE 4482, 2009

  8. Main Web Trust Principles • The Availability Principle addresses accessibility to the defined system, products, or services as advertised or committed by contract, service-level, or other agreements. • The Security Principle requires an entity to meet high standards for the protection of the system components from unauthorized access, both logical and physical. CSE 4482, 2009

  9. Main Web Trust Principles • Processing Integrity Principle requires an entity to meet high standards for the completeness, accuracy, timeliness, and authorization of system processing including the processing of electronic commerce transactions. All three principles must be satisfied. CSE 4482, 2009

  10. Secondary Web Trust Principles • Confidentiality – no unauthorized viewing • Privacy – confidentiality of personal info CSE 4482, 2009

  11. Web Trust Review • The reviewer has to be licensed by AICPA or CICA . • The outcome of the review consists of a report and the Web Trust seal if the client passes the selected criteria. The seal can be placed on the Web site. The seal is accompanied by a report of controls with an audit opinion from the reviewer. CSE 4482, 2009

  12. Control Criteria • Management of the web site develops criteria (objectives) to satisfy each main principle and each selected secondary principle. • Each control criterion is supported by control activities (procedures), which can be manual or automated. CSE 4482, 2009

  13. Web Trust Seal • Auditor (reviewer) provides an opinion on the effectiveness (including comprehensiveness) of control activities for each criterion and the comprehensiveness of the criteria for each principle. CSE 4482, 2009

  14. Process of a Web Trust Review • E-commerce company decides to pursue a Web Trust seal. • E-commerce company engages an accounting firm to do the review. • E-commerce company selects the optional principles. CSE 4482, 2009

  15. Process of a Web Trust Review • E-commerce company develops control criteria for each principle. • E-commerce company develops control procedures for each criterion. • Accounting firm assess adequacy of control procedures for each criterion and adequacy of criteria for each principle. CSE 4482, 2009

  16. Process of Web Trust Review • Accounting firm conducts testing. • Accounting firm provides audit opinion. • If opinion is unqualified, accounting firm creates a seal and send to a certificate authority for digital signature to authenticate. CSE 4482, 2009

  17. Process of a Web Trust Review • Accounting firm sends the signed seal and audit report to the client. The audit report is hosted in www.webtrust.org. • E-commerce company puts the seal on the web site. CSE 4482, 2009

  18. SysTrust • A system assurance service developed by American Institute of Certified Public Accountants (AICPA) and Canadian Institute of Chartered Accountants (CICA) • Reviews have been on new systems in an organization or systems shared by a number of partner organizations CSE 4482, 2009

  19. Main SysTrust Principles • Availability • Security • Processing integrity Must be covered to get an unqualified opinion. CSE 4482, 2009

  20. Secondary SysTrust Principles • Confidentiality • Privacy CSE 4482, 2009

  21. Control Criteria • Management of the web site develops criteria (objectives) to satisfy each main principle and each selected secondary principle. • Each control criterion is supported by control activities (procedures), which can be manual or automated. CSE 4482, 2009

  22. Sys Trust Seal • Auditor (reviewer) provides an opinion on the effectiveness (including comprehensiveness) of control activities for each criterion and the comprehensiveness of the criteria for each principle. CSE 4482, 2009

  23. Components of System • Infrastructure • Software • People • Procedures • Data CSE 4482, 2009

  24. SysTrust Review • The reviewer has to be licensed by AICPA or CICA • The review is reported with an opinion against management’s assertion about the system CSE 4482, 2009

  25. SysTrust Users • Management • Customers • Trading partners • Financial statement auditors CSE 4482, 2009

  26. SysTrust Users • Internal and legislative auditors • Software vendors • Service providers CSE 4482, 2009

  27. SysTrust Report • An opinion on management’s asserted controls. • Opinion does not cover system description, although system description is often included in the report. But if reviewer knows that system description is misleading, s/he should not issue an opinion on the controls. • Opinion covers the reporting period of not more than one year. CSE 4482, 2009

  28. Drivers for SysTrust Review • The potential conflict of interest between the system operator and system user or owner. • The complexity of systems, requiring expertise to conduct an audit that would provide a reasonable degree of assurance about their conformity with system reliability principles and criteria. CSE 4482, 2009

  29. Drivers for SysTrust Review • The remoteness of users from systems requiring an independent objective representative to observe the system on their behalf. • The consequences of system unreliability. • The four conditions above may contribute individually to the need for assurance services related to the reliability of an entity’s key information system(s) and they may also interact to increase the need for such assurance. CSE 4482, 2009

  30. Symptoms of System Unreliability Frequent system failures Failure to prevent unauthorized access Loss of data integrity Serious maintenance problems CSE 4482, 2009 CITM 595, Fall 2007, D Chan

  31. Process of a Sys Trust Review • System hosting organization decides to pursue a Sys Trust Review. • System hosting organization hires an accounting firm. • System hosting organization selects optional principles, develops control criteria and control procedures. CSE 4482, 2009

  32. Process of a Sys Trust Review • Accounting firm assesses the adequacy of control criteria and procedures. • Accounting firm conducts testing. • Accounting firm provides report to system hosting organization. • System hosting organization shares report with user organizations. CSE 4482, 2009

  33. Payment Card Industry (PCI) Security Standard Developed by the PCI Security Council formed by major card issuers like Visa, MasterCard and American Express. Requires agent financial institutions and major merchants (over 6 million transactions annually) to have an annual external audit for compliance. Failure to comply can lead to a fine of $500,000. CSE 4482, 2009

  34. PCI Standards 1.Install and maintain a firewall to protect cardholder data 2. Do not use vendor supplied defaults for system passwords and other security parameters. 3. Protect stored cardholder data. 4. Encrypt transmission of cardholder data across the Internet CSE 4482, 2009

  35. PCI Standards 5. Use regularly updated anti-virus software 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business on a need-to-know basis 8. Assign a unique ID to each person with computer access CSE 4482, 2009

  36. PCI Standards 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security CSE 4482, 2009

More Related