Risk Management and SOX History

Risk Management - AUDCIS US SOX History

• Twenty years ago, financial reporting scandals eroded investor confidence.
• The Sarbanes-Oxley Act (SOX) of 2002 aimed to restore trust.
• SOX 404 primarily focuses on internal controls over financial reporting (ICFR).

Evaluation of Design and Operating Effectiveness

• Section 404(a) mandates annual evaluation of internal controls.
• Management documents control procedures and testing.
• Results publicly reported in Form 10-K.

Attestation Over Effectiveness of Internal Controls

• Section 404(b) requires auditor attestation of ICFR.

Enterprise Risk Management

• Identifying vulnerabilities in achieving business objectives.
• Implementing countermeasures to reduce risk.
• Definition of Risk: Uncertainty of an event affecting objective attainment.
• Uncertainty: Lack of information about impact and timing of an event.

Risk Treatment

• Risk Avoidance: Stopping a project.
• Risk Transfer: Outsourcing a project.
• Risk Reduction: Outsourcing part of a project.
• Risk Sharing: Outsourcing part of a project

Enterprise Risk Management Responsibility

• Business Process Owners: Apply risk treatment to achieve business objectives.
• Internal Audit: Assess risk treatment applied by business process owners.
• Those Charged with Governance: Oversee compliance with legal and regulatory expectations, stakeholder management and resource-provision.
• External Audit: Provide assurance to legislative and regulatory bodies.

Reportorial Requirements

• Material Weakness: Potential for a financial misstatement.

Information Security Principle

• Confidentiality: Restrictions against unauthorized access and disclosure.
• Integrity: Restrictions against improper modification or destruction.
• Availability: Protection against untimely and unreliable access.

Fraud Risk Factors

• Motivation: Incentives and pressures driving perpetrator actions.
• Rationalization: Justification for the perpetrator's actions.
• Opportunity: Methods for the perpetrator to commit fraud, e.g., poor internal controls.

Vulnerabilities, Threats, and Attacks

• Risk: Uncertainty affecting objective achievement.
• Uncertainty: Lack of information about impact and timing.
• Vulnerability: Result of flaws in a system.
• Threat: System flaw that's exploited by malicious action.
• Attack: Intentional malicious action to access, damage, or delay an asset.
• IT Risk: Lack of information impacting and timing an event due to a system flaw.

Example of Vulnerabilities

• Authenticity: Verifying content hasn’t changed in transit
• Nonrepudiation: Verifying origin or receipt of a message
• Accountability: Trackable actions of an entity
• Network Availability: Timely and reliable IT resource access

Perpetrators May Use and Their Controls

• Unauthorized hardware/software.
• Untrusted wireless network.
• Use of unsecured network.
• Untrusted devices.

Types of Attacks

• Malware (malicious software).
• Viruses: Software activated to cause damage.
• Trojans: Viruses hidden in legitimate software.
• Worms: Viruses that replicate on their own.
• Spyware: Secretly collects sensitive data.
• Ransomware: Demands payment to recover data.

Social Engineering

• Exploitation of human behavior to gain physical/security access.
• Tailgating/piggybacking: Tagging along behind employees.
• Eavesdropping: Listening to private communications.
• Shoulder surfing: Physically spying on someone.
• Brute Force: Trial-and-error password cracking.
• Keylogging: Recording every keystroke.
• Credential stuffing: Re-using stolen credentials.
• Kerberoasting: Brute force attack on authentication systems.
• Downgrading: Forcing into less secure environments.
• Phishing: Enticing victims to share info.
• Spear phishing: Targeted phishing attacks.
• WHaling: Attacking top-level executives.
• Smishing: Phishing via text messages.
• Vishing: Phishing via phone calls.
• Spoofing: Disguising as a trusted source.
• Honeytrap: Luring victims into traps.
• Domain spoofing: Disguises use of a known organization's email.
• ARP spoofing: Disguising use of a known organization protocol.
• Pretexting: False scenarios to gain trust.
• Quid pro quo: Exchanging services for sensitive data
• Man-in-the-middle: Altering communications between parties.
• Session hijacking: Changing IP address to access a server.
• Pass-the-Hash: Using stolen info.
• DNS tunneling: Using DNS to bypass firewalls.
• Denial-of-service (DoS): Flooding networks with malicious requests.
• Distributed denial-of-service (DDoS): Using multiple compromised computers to launch attacks.
• Zero-day exploits: Exploiting vulnerabilities before patches.
• Deepfakes: Al-generated forgeries to cause damage to reputation and sway political landscapes.
• Adversarial AI/ML: Exploiting AI/ML models by introducing inaccuracies.

Physical and Environmental Controls

• Information asset protections (physical).
• Fire and Humidity hazards.
• Disaster recovery plan.
• Recovery time objectives (RTO).
• Recovery point objective (RPO).
• Emergency evacuation plan.
• Fire suppression system.

Virtualization

• Virtualization (on-prem server): Increase efficiency by allowing multiple OSs to coexist on one hardware.
• Cloud Computing (third-party or backup server): On-demand access to computing resources.

Emerging Technologies

• Private Branch Exchange (PBX).
• Peer-to-Peer.
• Voice over Internet Protocol (VoIP).
• Wireless networks.
• Instant messaging (IM).
• Digital signatures.
• Mobile (Edge) Computing.
• Bring your own device (BYOD).
• Internet of Things (IoT).
• Cloud Computing (sharing computing resources).

Cloud Models

• Private Cloud: Solely for one organization.
• Community Cloud: Shared by several organizations.
• Public Cloud: Available to the general public.
• Hybrid Cloud: Composition of two or more clouds for data portability.

IT Forensics

• Process of identifying, preserving, analyzing, and reporting digital evidence.