book

IT Auditing Using Controls to Protect Information Assets, Third Edition, 3rd Edition

Name: IT Auditing Using Controls to Protect Information Assets, Third Edition, 3rd Edition
ISBN: 9781260453232

by Mike Kegerreis, Mike Schiller, Chris Davis

October 2019

Intermediate to advanced

576 pages

18h 53m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
About the Author
Contents
Acknowledgments
Introduction
Part I Audit Overview
Chapter 1 Building an Effective Internal IT Audit Function
Why Are We Here? (The Internal Audit Department’s Mission)Independence: The Great MythAdding Value Outside of Formal AuditsBusiness Advisory AuditsFour Methods for Business Advisory AuditsEarly InvolvementInformal AuditsKnowledge SharingSelf-AssessmentsContinuous AuditingFinal Thoughts on Adding Value Outside of Formal AuditsRelationship Building: Partnering vs. PolicingLearning to Build PartnershipsThe Role of the IT Audit TeamApplication Auditors (or Integrated Auditors)Data Extraction and Analysis SpecialistsIT AuditorsForming and Maintaining an Effective IT Audit TeamCareer IT AuditorsIT ProfessionalsCareer IT Auditors vs. IT Professionals: Final ThoughtsCo-sourcingMaintaining ExpertiseSources of LearningRelationship with External Auditors and Internal Assurance FunctionsSummary

Chapter 2 The Audit Process
Internal ControlsTypes of Internal ControlsInternal Control ExamplesDetermining What to AuditCreating the Audit UniverseRanking the Audit UniverseDetermining What to Audit: Final ThoughtsThe Stages of an AuditPlanningFieldwork and DocumentationIssue Discovery and ValidationSolution DevelopmentReport Drafting and IssuanceIssue TrackingStandardsSummary
Part II Auditing Techniques
Chapter 3 Auditing Entity-Level Controls
BackgroundTest Steps for Auditing Entity-Level ControlsKnowledge BaseMaster Checklist
Chapter 4 Auditing Cybersecurity Programs
BackgroundSteps for Auditing Cybersecurity ProgramsKnowledge BaseMaster Checklist
Chapter 5 Auditing Data Centers and Disaster Recovery
BackgroundData Center Auditing EssentialsPhysical Security and Environmental ControlsSystem and Site ResiliencyData Center OperationsDisaster PreparednessTest Steps for Auditing Data CentersNeighborhood and External Risk FactorsPhysical Access ControlsEnvironmental ControlsPower and ElectricityFire SuppressionData Center OperationsSystem ResiliencyData Backup and RestorationDisaster Recovery PlanningKnowledge BaseMaster Checklists
Chapter 6 Auditing Networking Devices
BackgroundNetwork Auditing EssentialsProtocolsOSI ModelRouters and SwitchesLANs, VLANs, WANs, and WLANsFirewallsAuditing Switches, Routers, and FirewallsGeneral Network Equipment Audit StepsAdditional Switch Controls: Layer 2Additional Router Controls: Layer 3Additional Firewall ControlsAdditional Controls for Wireless Network GearTools and TechnologyKnowledge BaseMaster Checklists
Chapter 7 Auditing Windows Servers
BackgroundWindows Auditing EssentialsCommand-Line TipsEssential Command-Line ToolsCommon CommandsServer Administration ToolsPerforming the AuditTest Steps for Auditing WindowsInitial StepsAccount ManagementPermissions ManagementNetwork Security and ControlsSecurity Monitoring and Other General ControlsTools and TechnologyKnowledge BaseMaster Checklist
Chapter 8 Auditing Unix and Linux Operating Systems
BackgroundUnix and Linux Auditing EssentialsKey ConceptsFile System Layout and NavigationFile System PermissionsUsers and AuthenticationNetwork ServicesTest Steps for Auditing Unix and LinuxAccount ManagementPermissions ManagementNetwork Security and ControlsSecurity Monitoring and Other General ControlsTools and TechnologyNetwork Vulnerability ScannersNMAPMalware Detection ToolsTools for Validating Password StrengthHost-Based Vulnerability ScannersShell/Awk/etcKnowledge BaseMaster Checklists
Chapter 9 Auditing Web Servers and Web Applications
BackgroundWeb Auditing EssentialsOne Audit with Multiple ComponentsPart 1: Test Steps for Auditing the Host Operating SystemPart 2: Test Steps for Auditing Web ServersPart 3: Test Steps for Auditing Web ApplicationsAdditional Steps for Auditing Web ApplicationsTools and TechnologyKnowledge BaseMaster Checklists
Chapter 10 Auditing Databases
BackgroundDatabase Auditing EssentialsCommon Database VendorsDatabase ComponentsNoSQL Database SystemsTest Steps for Auditing DatabasesInitial StepsOperating System SecurityAccount ManagementPermissions ManagementData EncryptionSecurity Log Monitoring and ManagementTools and TechnologyAuditing ToolsMonitoring ToolsEncryption ToolsKnowledge BaseMaster Checklist
Chapter 11 Auditing Big Data and Data Repositories
BackgroundBig Data and Data Repository Auditing EssentialsTest Steps for Auditing Big Data and Data RepositoriesKnowledge BaseMaster Checklist
Chapter 12 Auditing Storage
BackgroundStorage Auditing EssentialsKey Storage ComponentsKey Storage ConceptsTest Steps for Auditing StorageInitial StepsAccount ManagementStorage ManagementEncryption and Permissions ManagementSecurity Monitoring and Other General ControlsKnowledge BaseMaster Checklists
Chapter 13 Auditing Virtualized Environments
BackgroundCommercial and Open-Source ProjectsVirtualization Auditing EssentialsTest Steps for Auditing VirtualizationInitial StepsAccount Management and Resource Provisioning/DeprovisioningVirtual Environment ManagementSecurity Monitoring and Additional Security ControlsKnowledge BaseHypervisorsToolsMaster Checklists
Chapter 14 Auditing End-User Computing Devices
BackgroundPart 1: Auditing Windows and Mac Client SystemsWindows and Mac Auditing EssentialsTest Steps for Auditing Windows and Mac Client SystemsTools and TechnologyKnowledge BasePart 2: Auditing Mobile DevicesMobile Device Auditing EssentialsTest Steps for Auditing Mobile DevicesAdditional ConsiderationsTools and TechnologyKnowledge BaseMaster Checklists
Chapter 15 Auditing Applications
BackgroundApplication Auditing EssentialsTest Steps for Auditing ApplicationsInput ControlsInterface ControlsAudit Trails and Security MonitoringAccount ManagementPermissions ManagementSoftware Change ControlsBackup and RecoveryData Retention and Classification and User InvolvementOperating System, Database, and Other Infrastructure ControlsMaster Checklists
Chapter 16 Auditing Cloud Computing and Outsourced Operations
BackgroundCloud Computing and Outsourced Operations Auditing EssentialsIT Systems, Software, and Infrastructure OutsourcingIT Service OutsourcingOther Considerations for IT Service OutsourcingThird-Party Reports and CertificationsTest Steps for Auditing Cloud Computing and Outsourced OperationsInitial StepsVendor Selection and ContractsAccount Management and Data SecurityOperations and GovernanceLegal Concerns and Regulatory ComplianceTools and TechnologyKnowledge BaseMaster Checklist
Chapter 17 Auditing Company Projects
BackgroundProject Auditing EssentialsHigh-Level Goals of a Project AuditBasic Approaches to Project AuditingWaterfall and Agile Software Development MethodologiesSeven Major Parts of a Project AuditTest Steps for Auditing Company ProjectsOverall Project ManagementProject Startup, Requirements Gathering, and Initial DesignDetailed Design and System DevelopmentTestingImplementationTrainingProject Wrap-UpKnowledge BaseMaster Checklists
Chapter 18 Auditing New/Other Technologies
BackgroundNew/Other Technology Auditing EssentialsGeneralized FrameworksBest PracticesTest Steps for Auditing New and Other TechnologiesInitial StepsAccount ManagementPermissions ManagementNetwork Security and ControlsSecurity Monitoring and Other General ControlsMaster Checklists
Part III Frameworks, Standards, Regulations, and Risk Management
Chapter 19 Frameworks and Standards
Introduction to Internal IT Controls, Frameworks, and StandardsCOSOCOSO Definition of Internal ControlKey Concepts of Internal ControlInternal Control–Integrated FrameworkEnterprise Risk Management–Integrated FrameworkRelationship Between Internal Control and Enterprise Risk Management PublicationsIT GovernanceIT Governance Maturity ModelCOBITITILITIL ConceptsISO 27001ISO 27001 ConceptsNIST Cyber Security FrameworkNSA INFOSEC Assessment MethodologyNSA INFOSEC Assessment Methodology ConceptsPre-assessment PhaseOnsite Activities PhasePost-assessment PhaseFrameworks and Standards TrendsKnowledge Base
Chapter 20 Regulations
An Introduction to Legislation Related to Internal ControlsRegulatory Impact on IT AuditsHistory of Corporate Financial RegulationThe Sarbanes-Oxley Act of 2002SOX’s Impact on Public CorporationsCore Points of the SOX ActSOX’s Impact on IT DepartmentsSOX Considerations for Companies with Multiple LocationsImpact of Third-Party Services on SOX ComplianceSpecific IT Controls Required for SOX ComplianceThe Financial Impact of SOX Compliance on CompaniesGramm-Leach-Bliley ActGLBA RequirementsFederal Financial Institutions Examination CouncilGeneral Data Protection RegulationAdditional Privacy RegulationsCalifornia Security Breach Information Act (SB 1386)California Consumer Privacy ActCanadian Personal Information Protection and Electronic Documentation ActPrivacy Law TrendsHealth Insurance Portability and Accountability ActHIPAA Privacy and Security RulesThe HITECH ActHIPAA’s Impact on Covered EntitiesEU Commission and Basel IIBasel II Capital AccordPayment Card Industry Data Security StandardPCI Impact on the Payment Card IndustryOther Regulatory TrendsKnowledge Base
Chapter 21 Risk Management
Benefits of Risk ManagementRisk Management from an Executive PerspectiveQuantitative vs. Qualitative Risk AnalysisQuantitative Risk AnalysisElements of RiskPractical ApplicationAddressing RiskCommon Causes for InaccuraciesQuantitative Risk Analysis in PracticeQualitative Risk AnalysisIT Risk Management Life CyclePhase 1: Identify Information AssetsPhase 2: Quantify and Qualify ThreatsPhase 3: Assess VulnerabilitiesPhase 4: Remediate Control GapsPhase 5: Manage Residual RiskThird-Party RiskRisk IdentificationRisk AssessmentRemediationMonitoring and ReportingSummary of FormulasKnowledge Base
Index

Overview

Secure Your Systems Using the Latest IT Auditing Techniques

Fully updated to cover leading-edge tools and technologies, IT Auditing: Using Controls to Protect Information Assets, Third Edition explains, step by step, how to implement a successful, enterprise-wide IT audit program. New chapters on auditing cybersecurity programs, big data and data repositories, and new technologies are included. This comprehensive guide describes how to assemble an effective IT audit team and maximize the value of the IT audit function. In-depth details on performing specific audits are accompanied by real-world examples, ready-to-use checklists, and valuable templates. Standards, frameworks, regulations, and risk management techniques are also covered in this definitive resource.

• Build and maintain an internal IT audit function with maximum effectiveness and value
• Audit entity-level controls and cybersecurity programs
• Assess data centers and disaster recovery
• Examine switches, routers, and firewalls
• Evaluate Windows, UNIX, and Linux operating systems
• Audit Web servers and applications
• Analyze databases and storage solutions
• Review big data and data repositories
• Assess end user computer devices, including PCs and mobile devices
• Audit virtualized environments
• Evaluate risks associated with cloud computing and outsourced operations
• Drill down into applications and projects to find potential control weaknesses
• Learn best practices for auditing new technologies
• Use standards and frameworks, such as COBIT, ITIL, and ISO
• Understand regulations, including Sarbanes-Oxley, HIPAA, and PCI
• Implement proven risk management practices

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

CRISC Certified in Risk and Information Systems Control All-in-One Exam Guide, Second Edition, 2nd Edition

Publisher Resources

ISBN: 9781260453232

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills