HAPTER 7

1. HAPTER 7 Information Systems Controls for Systems Reliability Part 1: Information Security

2. INTRODUCTION • Questions to be addressed in this chapter: • How does security affect systems reliability? • What are the four criteria that can be used to evaluate the effectiveness of an organization’s information security? • What is the time-based model of security and the concept of defense-in-depth? • What types of preventive, detective, and corrective controls are used to provide information security? • How does encryption contribute to security and how do the two basic types of encryption systems work?

3. INTRODUCTION • One basic function of an AIS is to provide information useful for decision making. In order to be useful, the information must be reliable, which means: • It provides an accurate, complete, and timely picture of the organization’s activities. • It is available when needed. • The information and the system that produces it is protected from loss, compromise, and theft.

4. INTRODUCTION • The five basic principles that contribute to systems reliability: SYSTEMS RELIABILITY

5. INTRODUCTION • The five basic principles that contribute to systems reliability: • Security SYSTEMS RELIABILITY • Access to the system and its data is controlled. SECURITY

6. INTRODUCTION • The five basic principles that contribute to systems reliability: • Security • Confidentiality SYSTEMS RELIABILITY CONFIDENTIALITY • Sensitive information is protected from unauthorized disclosure. SECURITY

7. INTRODUCTION • The five basic principles that contribute to systems reliability: • Security • Confidentiality • Privacy SYSTEMS RELIABILITY • Personal information about customers collected through e-commerce is collected, used, disclosed, and maintained in an appropriate manner. CONFIDENTIALITY PRIVACY SECURITY

8. INTRODUCTION • The five basic principles that contribute to systems reliability: • Security • Confidentiality • Privacy • Processing integrity SYSTEMS RELIABILITY • Data is processed: • Accurately • Completely • In a timely manner • With proper authorization CONFIDENTIALITY PROCESSING INTEGRITY PRIVACY SECURITY

9. INTRODUCTION • The five basic principles that contribute to systems reliability: • Security • Confidentiality • Online privacy • Processing integrity • Availability SYSTEMS RELIABILITY CONFIDENTIALITY PROCESSING INTEGRITY PRIVACY AVAILABILITY • The system is available to meet operational and contractual obligations. SECURITY

10. INTRODUCTION • Note the importance of security in this picture. It is the foundation of systems reliability. Security procedures: • Restrict system access to only authorized users and protect: • The confidentiality of sensitive organizational data. • The privacy of personal identifying information collected from customers. SYSTEMS RELIABILITY CONFIDENTIALITY PROCESSING INTEGRITY PRIVACY AVAILABILITY SECURITY

11. INTRODUCTION • Security procedures also: • Provide for processing integrity by preventing: • Submission of unauthorized or fictitious transactions. • Unauthorized changes to stored data or programs. • Protect against a variety of attacks, including viruses and worms, thereby ensuring the system is available when needed. SYSTEMS RELIABILITY CONFIDENTIALITY PROCESSING INTEGRITY PRIVACY AVAILABILITY SECURITY

12. INTRODUCTION • This chapter provides a broad introduction to the topic of information systems security. • Anyone interested in a career in information systems security would need to undertake additional detailed study. • Chapter 8 will discuss controls relevant to the other four reliability principles.

13. INTRODUCTION • The press carries many stories about information security incidents including: • Denial of service attacks • Fraud • Loss of trade secrets • Identity theft • Accountants and IS professionals need to understand basic principles of information security in order to protect their organizations and themselves.

14. COBIT and Trust Services • Control Objectives for Information Technology (COBIT) • Information systems controls required for achieving business and governance objectives Adequate Controls

15. COBIT and Trust Services • COBIT IT resources: • Applications • Information • Infrastructures • People

16. COBIT and Trust Services • COBIT information criteria: • Effectiveness • Efficiency • Confidentiality • Integrity • Availability • Compliance • Reliability

17. COBIT and Trust Services • COBIT domains: • Basic management activities for IT • Help organize 34 generic IT controls

18. COBIT and Trust Services

19. COBIT and Trust Services

20. COBIT and Trust Services

21. COBIT and Trust Services

22. COBIT and Trust Services

23. COBIT and Trust Services

24. COBIT and Trust Services

25. COBIT and Trust Services

26. FUNDAMENTAL INFORMATION SECURITY CONCEPTS • There are three fundamental information security concepts that will be discussed in this chapter: • Security as a management issue, not a technology issue. • The time-based model of security. • Defense in depth.

27. FUNDAMENTAL INFORMATION SECURITY CONCEPTS • There are three fundamental information security concepts that will be discussed in this chapter: • Security as a management issue, not a technology issue. • The time-based model of security. • Defense in depth.

28. SECURITY AS A MANAGEMENT ISSUE • Though information security is a complex technical subject, security is first and foremost a top management issue, not an IT issue.

29. SECURITY AS A MANAGEMENT ISSUE • Management is responsible for the accuracy of various internal reports and financial statements produced by the organization’s IS. • SOX Section 302 requires that the CEO and CFO certify the accuracy of the financial statements. • SOX Section 404 requires that the annual report include a report on the company’s internal controls. Within this report, management acknowledges their responsibility for designing and maintaining internal controls and assessing their effectiveness. • Security is a key component of the internal control and systems reliability to which management must attest. • As identified in the COSO model, management’s philosophy and operating style are critical to an effective control environment.

30. SECURITY AS A MANAGEMENT ISSUE • The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability: • Develop and document policies. • Effectively communicate those policies to all authorized users. • Design and employ appropriate control procedures to implement those policies. • Monitor the system, and take corrective action to maintain compliance with the policies. • Top management involvement and support is necessary to satisfy each of the preceding criteria.

31. SECURITY AS A MANAGEMENT ISSUE • The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability: • Develop and document policies. • Effectively communicate those policies to all authorized users. • Design and employ appropriate control procedures to implement those policies. • Monitor the system, and take corrective action to maintain compliance with the policies. • COBIT section PO 6 identifies the CIO as responsible for ensuring that information policies and controls are defined and communicated to all employees.

32. SECURITY AS A MANAGEMENT ISSUE • Policy development • It’s more exciting to react to security issues than to prevent them. • However, it is important to develop a comprehensive set of security policies before designing and implementing specific control procedures. • Helps ensure that the security products you ultimately purchase protect each IS resource. • Developing a comprehensive set of security policies begins with taking an inventory of information systems resources, including: • Hardware • Software • Databases

33. SECURITY AS A MANAGEMENT ISSUE • Once the resources have been identified, they need to be valued in order to select the most cost-effective control procedures. • Not easy—particularly in valuing information itself. • Management at the highest level needs to be involved because they have a broader understanding of the organization’s mission and goals that will enable them to better assess the dollar impact caused by loss or disclosure of information resources.

34. SECURITY AS A MANAGEMENT ISSUE • The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability: • Develop and document policies. • Effectively communicate those policies to all authorized users. • Design and employ appropriate control procedures to implement those policies. • Monitor the system, and take corrective action to maintain compliance with the policies. • Top management involvement and support is necessary to satisfy each of the preceding criteria.

35. SECURITY AS A MANAGEMENT ISSUE • Effective communication of policies • Security policies must be communicated to and understood by employees, customers, suppliers, and other authorized users. • Needs to be more than having people sign off that they’ve received and read a written document. • Employees should have regular reminders about security policies and training in how to comply. • Training and communication will only be taken seriously if management provides active support and involvement. • Sanctions must also be associated with these violations, again requiring management support for enforcement.

36. SECURITY AS A MANAGEMENT ISSUE • The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability: • Develop and document policies. • Effectively communicate those policies to all authorized users. • Design and employ appropriate control procedures to implement those policies. • Monitor the system, and take corrective action to maintain compliance with the policies. • Top management involvement and support is necessary to satisfy each of the preceding criteria.

37. SECURITY AS A MANAGEMENT ISSUE • Design and employ appropriate control procedures • Control frameworks such as COBIT and Trust Services identify a variety of specific control procedures and tools that can be used to mitigate various security threats. • Options differ in terms of cost and effectiveness. • Determining the optimal level of investment in security involves evaluating cost-benefit trade-offs. • Systems personnel have knowledge about the technical merits of each alternative, as well as the risk of various threats. • Management insight is needed in identifying potential costs and ensuring that all relevant organizational factors are considered. • COBIT stresses that the CEO and CFO are accountable for ensuring that the organization has implemented a thorough risk assessment program

38. SECURITY AS A MANAGEMENT ISSUE • The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability: • Develop and document policies. • Effectively communicate those policies to all authorized users. • Design and employ appropriate control procedures to implement those policies. • Monitor the system, and take corrective action to maintain compliance with the policies. • Top management involvement and support is necessary to satisfy each of the preceding criteria.

39. SECURITY AS A MANAGEMENT ISSUE • Monitor and take remedial action • Security is a moving target. • Technology advances create new threats and alter the risks associated with existing threats. • Effective control involves a continuous cycle of: • Developing policies to address identified threats; • Communicating those policies to all employees; • Implementing specific control procedures to mitigate risk; • Monitoring performance; and • Taking corrective action in response to problems.

40. SECURITY AS A MANAGEMENT ISSUE • Corrective actions often involve the modification of existing cycles, and the cycle starts all over. • Senior management must be involved to ensure that security policies remain consistent with and support the organization’s business strategy.

41. FUNDAMENTAL INFORMATION SECURITY CONCEPTS • There are three fundamental information security concepts that will be discussed in this chapter: • Security is a management issue, not a technology issue. • The time-based model of security. • Defense in depth.

42. TIME-BASED MODEL OF SECURITY • Given enough time and resources, any preventive control can be circumvented. • Consequently, effective control requires supplementing preventive procedures with: • Methods for detecting incidents; and • Procedures for taking corrective remedial action. • Detection and correction must be timely, especially for information security, because once preventive controls have been breached, it takes little time to destroy, compromise, or steal the organization’s economic and information resources.

43. TIME-BASED MODEL OF SECURITY • The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. • All three types of controls are necessary: • Preventive • Limit actions to those in accord with the organization’s security policy and disallows all others.

44. TIME-BASED MODEL OF SECURITY • The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. • All three types of controls are necessary: • Preventive • Detective • Identify when preventive controls have been breached.

45. TIME-BASED MODEL OF SECURITY • The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. • All three types of controls are necessary: • Preventive • Detective • Corrective • Repair damage from problems that have occurred. • Improve preventive and detective controls to reduce likelihood of similar incidents.

46. TIME-BASED MODEL OF SECURITY • The time-based model evaluates the effectiveness of an organization’s security by measuring and comparing the relationship among three variables: • P = Time it takes an attacker to break through the organization’s preventive controls. • D = Time it takes to detect that an attack is in progress. • C = Time to respond to the attack. • These three variables are evaluated as follows: • If P > (D + C), then security procedures are effective. • Otherwise, security is ineffective.

47. TIME-BASED MODEL OF SECURITY • The model provides management with a means to identify the most cost-effective approach to improving security by comparing the effects of additional investments in preventive, detective, or corrective controls.

48. TIME-BASED MODEL OF SECURITY • EXAMPLE: For an additional expenditure of $25,000, the company could take one of four measures: • Measure 1 would increase P by 5 minutes. • Measure 2 would decrease D by 3 minutes. • Measure 3 would decrease C by 5 minutes. • Measure 4 would increase P by 3 minutes and reduce C by 3 minutes. • Because each measure has the same cost, which do you think would be the most cost-effective choice? (Hint: Your goal is to have P exceed [D + C] by the maximum possible amount.)

49. The most cost-effective choice would therefore be Measure 4, because for the same money, it creates a greater distance between the time it takes a perpetrator to break into a system and the time it takes the company to detect and thwart the attack. TIME-BASED MODEL OF SECURITY • You may be able to solve this problem by eyeballing it. If not, one way to solve it is to assume some initial values for P, D, and C. • So let’s assume that P = 15 min., D = 5 min., and C = 8 min. • At our starting point, P – (D + C) = 15 – (5 + 8) = 2 min. • With Measure 1, P is increased by 5 minutes: • 20 – (5 + 8) = 7 min. • With Measure 2, D is decreased by 3 minutes: • 15 – (2 + 8) = 5 min. • With Measure 3, C is decreased by 5 min. • 15 – (5 + 3) = 7 min. • With Measure 4, P is increased by 3 minutes and C is reduced by 3 min. • 18 – (5 + 5) = 8 min.

50. FUNDAMENTAL INFORMATION SECURITY CONCEPTS • There are three fundamental information security concepts that will be discussed in this chapter: • Security is a management issue, not a technology issue. • The time-based model of security. • Defense in depth.