Information Systems Control - Chapter 8

These controls provide directions to employees to follow and limit potential damage or loss, focusing on achieving a specific outcome.

A plan designed to ensure an organization can continue operating in the event of a disaster or disruption.

A set of procedures to recover from a disruption or incident.

Making copies of data to protect against loss.

Restoring a system to a working state.

Restarting a computer or system.

Changing an input value to test a system's response.

Reporting violations of security policies or procedures.

An emergency power-off switch should be easily accessible and protected from unauthorized access.

Redundant power links should be available at the data center to ensure continuous operation even if one power supply fails.

Water detectors should be placed in areas prone to water damage, such as beneath raised floors, near drain holes, and equipment storage.

To minimize the risk of flooding, the location should not be in a basement or on the ground floor of a multi-story building.

Water damage can be prevented by using waterproof materials for ceilings, walls, and floors, and having a good drainage system.

Dust can damage storage devices and cause read/write errors.

Eating, drinking, and smoking should be prohibited in the information processing facility to minimize the risk of contaminating equipment.

Physical access controls are measures to protect tangible resources and data stored on physical media.

Controls aim to prevent, detect, correct, direct, or influence a system's activities to meet objectives.

Controls categorized based on their nature, such as: Preventive (stopping issues before they occur), Detective (identifying issues that have already happened), Corrective (fixing problems once identified), Directive (guiding actions within the system), and Environmental (creating a favorable environment for good practices).

IS resources (Information System) are the assets used to process and manage information, encompassing hardware, software, data, networks, staff, and procedures.

Controls are implemented to safeguard IS resources from unauthorized access and use. Physical Access controls protect against physical tampering or intrusion, while Logical Access controls regulate user access to data and systems.

A Framework provides a structured approach to manage a system; it defines roles, responsibilities, and procedures. An Application Control Framework focuses on specific applications, while a Management Control Framework oversees the system's overall management.

From an auditor's perspective, controls ensure reliability and accuracy of information, effectiveness of operations, and compliance with relevant laws.

Control activities are the actions taken to ensure controls work effectively. Information Technology Control Activities focus on technology-related aspects, while Physical Activities are tangible actions taken to safeguard resources.

Case studies like ABC Multispecialty Hospital demonstrate the importance of controls in real-world organizations. Their use of software for financial transactions highlights the need for robust controls to protect sensitive data.

Controls implemented to protect communication channels and data transmission, including physical security measures and error detection mechanisms.

Controls aimed at safeguarding the physical components of the communication system, like servers and network devices, from damage or unauthorized access.

Controls used for detecting and correcting errors in data transmission over communication lines.

Controls implemented to ensure the accuracy, completeness, and proper format of the data delivered to users.

Controls used during data processing to catch and correct errors, ensuring data integrity is maintained.

Strong authentication methods like Biometric Authentication and Digital Certificates used to secure access to systems based on risk assessment.

The operating system enforces the use of complex passwords to improve system security.

System utilities are programs that manage critical functions of the operating system, like adding or removing users. Access is restricted to administrators.

A system feature that alerts authorities when an individual is being forced to perform unauthorized actions.

Automated logout of a user if the terminal remains inactive for a set time to prevent unauthorized access.

Limits access to systems outside specific time slots, preventing unauthorized entry.

Application-specific menus that restrict access to system functions based on user roles to control information access.

Controlling access to applications and modules used to access, process, and communicate information.

Controls implemented by management to ensure the organization's IT systems function correctly and meet strategic business objectives.

A framework designed to assess the effectiveness of IT controls within an organization. It looks at the management's role in setting up, maintaining, and reviewing these controls.

The practice of safeguarding information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Protecting access to information systems through methods like passwords, multi-factor authentication, and user permissions.

A combination of physical and logical security measures that protect an organization's information systems.

Encrypting sensitive data carried on portable computers to protect it from unauthorized access.

Using advanced authentication methods like fingerprint, iris scans, and smart cards to ensure access to information systems is only granted to authorized individuals.