CISA: Certified Information Systems Auditor Study Guide

Introduction xix
Assessment Test xlii

Chapter 1 Secrets of a Successful Auditor 1
Understanding the Demand for IS Audits 2
Executive Misconduct 3
More Regulation Ahead 5
Basic Regulatory Objective 7
Governance Is Leadership 8
Three Types of Data Target Different Uses 9
Audit Results Indicate the Truth 10
Understanding Policies, Standards, Guidelines, and Procedures 11
Understanding Professional Ethics 14
Following the ISACA Professional Code 14
Preventing Ethical Conflicts 16
Understanding the Purpose of an Audit 17
Classifying General Types of Audits 18
Determining Differences in Audit Approach 20
Understanding the Auditor s Responsibility 21
Comparing Audits to Assessments 21
Differentiating between Auditor and Auditee Roles 22
Applying an Independence Test 23
Implementing Audit Standards 24
Where Do Audit Standards Come From? 25
Understanding the Various Auditing Standards 27
Specific Regulations Defining Best Practices 31
Audits to Prove Financial Integrity 34
Auditor Is an Executive Position 35
Understanding the Importance of Auditor Confidentiality 35
Working with Lawyers 36
Working with Executives 37
Working with IT Professionals 37
Retaining Audit Documentation 38
Providing Good Communication and Integration 39
Understanding Leadership Duties 39
Planning and Setting Priorities 40
Providing Standard Terms of Reference 41
Dealing with Conflicts and Failures 42
Identifying the Value of Internal and External Auditors 43
Understanding the Evidence Rule 43
Stakeholders: Identifying Whom You Need to Interview 44
Understanding the Corporate Organizational Structure 45
Identifying Roles in a Corporate Organizational Structure 45
Identifying Roles in a Consulting Firm Organizational Structure 47
Summary 49
Exam Essentials 49
Review Questions 52

Chapter 2 Governance 57
Strategy Planning for Organizational Control 61
Overview of the IT Steering Committee 64
Using the Balanced Scorecard 69
IT Subset of the BSC 74
Decoding the IT Strategy 74
Specifying a Policy 77
Project Management 79
Implementation Planning of the IT Strategy 90
Using COBIT 94
Identifying Sourcing Locations 94
Conducting an Executive Performance Review 99
Understanding the Auditor s Interest in the Strategy 100
Overview of Tactical Management 100
Planning and Performance 100
Management Control Methods 101
Risk Management 105
Implementing Standards 108
Human Resources 109
System Life ]Cycle Management 111
Continuity Planning 111
Insurance 112
Overview of Business Process Reengineering 112
Why Use Business Process Reengineering 113
BPR Methodology 114
Genius or Insanity? 114
Goal of BPR 114
Guiding Principles for BPR 115
Knowledge Requirements for BPR 116
BPR Techniques 116
BPR Application Steps 117
Role of IS in BPR 119
Business Process Documentation 119
BPR Data Management Techniques 120
Benchmarking as a BPR Tool 120
Using a Business Impact Analysis 121
BPR Project Risk Assessment 123
Practical Application of BPR 125
Practical Selection Methods for BPR 127
Troubleshooting BPR Problems 128
Understanding the Auditor s Interest in Tactical Management 129
Operations Management 129
Sustaining Operations 130
Tracking Actual Performance 130
Controlling Change 131
Understanding the Auditor s Interest in Operational Delivery 131
Summary 132
Exam Essentials 132
Review Questions 134

Chapter 3 Audit Process 139
Understanding the Audit Program 140
Audit Program Objectives and Scope 141
Audit Program Extent 143
Audit Program Responsibilities 144
Audit Program Resources 144
Audit Program Procedures 145
Audit Program Implementation 146
Audit Program Records 146
Audit Program Monitoring and Review 147
Planning Individual Audits 148
Establishing and Approving an Audit Charter 151
Role of the Audit Committee 151
Preplanning Specific Audits 153
Understanding the Variety of Audits 154
Identifying Restrictions on Scope 156
Gathering Detailed Audit Requirements 158
Using a Systematic Approach to Planning 159
Comparing Traditional Audits to Assessments and Self ]Assessments 161
Performing an Audit Risk Assessment 162
Determining Whether an Audit Is Possible 163
Identifying the Risk Management Strategy 165
Determining Feasibility of Audit 167
Performing the Audit 167
Selecting the Audit Team 167
Determining Competence and Evaluating Auditors 168
Ensuring Audit Quality Control 170
Establishing Contact with the Auditee 171
Making Initial Contact with the Auditee 172
Using Data Collection Techniques 174
Conducting Document Review 176
Understanding the Hierarchy of Internal Controls 177
Reviewing Existing Controls 179
Preparing the Audit Plan 182
Assigning Work to the Audit Team 183
Preparing Working Documents 184
Conducting Onsite Audit Activities 185
Gathering Audit Evidence 186
Using Evidence to Prove a Point 186
Understanding Types of Evidence 187
Selecting Audit Samples 187
Recognizing Typical Evidence for IS Audits 188
Using Computer ]Assisted Audit Tools 189
Understanding Electronic Discovery 191
Grading of Evidence 193
Timing of Evidence 195
Following the Evidence Life Cycle 195
Conducting Audit Evidence Testing 198
Compliance Testing 198
Substantive Testing 199
Tolerable Error Rate 200
Recording Test Results 200
Generating Audit Findings 201
Detecting Irregularities and Illegal Acts 201
Indicators of Illegal or Irregular Activity 202
Responding to Irregular or Illegal Activity 202
Findings Outside of Audit Scope 203
Report Findings 203
Approving and Distributing the Audit Report 205
Identifying Omitted Procedures 205
Conducting Follow ]up (Closing Meeting) 205
Summary 206
Exam Essentials 207
Review Questions 210

Chapter 4 Networking Technology Basics 215
Understanding the Differences in Computer Architecture 217
Selecting the Best System 221
Identifying Various Operating Systems 221
Determining the Best Computer Class 224
Comparing Computer Capabilities 227
Ensuring System Control 228
Dealing with Data Storage 230
Using Interfaces and Ports 235
Introducing the Open Systems Interconnection Model 237
Layer 1: Physical Layer 240
Layer 2: Data ]Link Layer 240
Layer 3: Network Layer 242
Layer 4: Transport Layer 248
Layer 5: Session Layer 249
Layer 6: Presentation Layer 250
Layer 7: Application Layer 250
Understanding How Computers Communicate 251
Understanding Physical Network Design 252
Understanding Network Cable Topologies 253
Bus Topologies 254
Star Topologies 254
Ring Topologies 255
Meshed Networks 256
Differentiating Network Cable Types 258
Coaxial Cable 258
Unshielded Twisted ]Pair (UTP) Cable 259
Fiber ]Optic Cable 260
Connecting Network Devices 260
Using Network Services 263
Domain Name System 263
Dynamic Host Configuration Protocol 265
Expanding the Network 266
Using Telephone Circuits 268
Network Firewalls 271
Remote VPN Access 276
Using Wireless Access Solutions 280
Firewall Protection for Wireless Networks 284
Remote Dial ]Up Access 284
WLAN Transmission Security 284
Achieving 802.11i RSN Wireless Security 287
Intrusion Detection Systems 288
Summarizing the Various Area Networks 291
Using Software as a Service (SaaS) 292
Advantages 292
Disadvantages 293
Cloud Computing 294
The Basics of Managing the Network 295
Automated LAN Cable Tester 295
Protocol Analyzers 295
Remote Monitoring Protocol Version 2 297
Summary 298
Exam Essentials 298
Review Questions 301

Chapter 5 Information Systems Life Cycle 307
Governance in Software Development 308
Management of Software Quality 310
Capability Maturity Model 310
International Organization for Standardization 312
Typical Commercial Records Classification Method 316
Overview of the Executive Steering Committee 317
Identifying Critical Success Factors 318
Using the Scenario Approach 318
Aligning Software to Business Needs 319
Change Management 323
Management of the Software Project 323
Choosing an Approach 323
Using Traditional Project Management 324
Overview of the System Development Life Cycle 327
Phase 1: Feasibility Study 331
Phase 2: Requirements Definition 334
Phase 3: System Design 339
Phase 4: Development 343
Phase 5: Implementation 354
Phase 6: Postimplementation 361
Phase 7: Disposal 363
Overview of Data Architecture 364
Databases 364
Database Transaction Integrity 368
Decision Support Systems 369
Presenting Decision Support Data 370
Using Artificial Intelligence 370
Program Architecture 371
Centralization vs. Decentralization 372
Electronic Commerce 372
Summary 374
Exam Essentials 374
Review Questions 376

Chapter 6 System Implementation and Operations 381
Understanding the Nature of IT Services 383
Performing IT Operations Management 385
Meeting IT Functional Objectives 385
Using the IT Infrastructure Library 387
Supporting IT Goals 389
Understanding Personnel Roles and Responsibilities 389
Using Metrics 394
Evaluating the Help Desk 396
Performing Service ]Level Management 397
Outsourcing IT Functions 398
Performing Capacity Management 399
Using Administrative Protection 400
Information Security Management 401
IT Security Governance 401
Authority Roles over Data 402
Data Retention Requirements 403
Document Physical Access Paths 404
Personnel Management 405
Physical Asset Management 406
Compensating Controls 408
Performing Problem Management 409
Incident Handling 410
Digital Forensics 412
Monitoring the Status of Controls 414
System Monitoring 415
Document Logical Access Paths 416
System Access Controls 417
Data File Controls 420
Application Processing Controls 421
Log Management 423
Antivirus Software 424
Active Content and Mobile Software Code 424
Maintenance Controls 427
Implementing Physical Protection 430
Data Processing Locations 432
Environmental Controls 432
Safe Media Storage 440
Summary 442
Exam Essentials 442
Review Questions 444

Chapter 7 Protecting Information Assets 449
Understanding the Threat 450
Recognizing Types of Threats and Computer Crimes 452
Identifying the Perpetrators 454
Understanding Attack Methods 458
Implementing Administrative Protection 469
Using Technical Protection 472
Technical Control Classification 472
Application Software Controls 474
Authentication Methods 475
Network Access Protection 488
Encryption Methods 489
Public ]Key Infrastructure 496
Network Security Protocols 502
Telephone Security 507
Technical Security Testing 507
Summary 509
Exam Essentials 509
Review Questions 511

Chapter 8 Business Continuity and Disaster Recovery 517
Debunking the Myths 518
Myth 1: Facility Matters 519
Myth 2: IT Systems Matter 519
From Myth to Reality 519
Understanding the Five Conflicting Disciplines Called Business Continuity 520
Defining Disaster Recovery 521
Surviving Financial Challenges 522
Valuing Brand Names 522
Rebuilding after a Disaster 523
Defining the Purpose of Business Continuity 524
Uniting Other Plans with Business Continuity 527
Identifying Business Continuity Practices 527
Identifying the Management Approach 529
Following a Program Management Approach 531
Understanding the Five Phases of a Business Continuity Program 532
Phase 1: Setting Up the BC Program 532
Phase 2: The Discovery Process 535
Phase 4: Plan Implementation 560
Phase 5: Maintenance and Integration 562
Understanding the Auditor Interests in BC/DR Plans 563
Summary 564
Exam Essentials 564
Review Questions 566

Appendix Answers to Review Questions 571

Index 591