book

CISA – Certified Information Systems Auditor Study Guide - Third Edition

Name: CISA – Certified Information Systems Auditor Study Guide - Third Edition
Author: Hemang Doshi
ISBN: 9781835882863

by Hemang Doshi

October 2024

Intermediate to advanced

356 pages

9h 6m

English

Packt Publishing

Read now

Unlock full access

CISA – Certified Information Systems Auditor Study Guide
Third EditionContributorsAbout the AuthorAbout the Reviewers Foreword
Preface
Who This Book Is ForWhat This Book CoversHow to Get the Most out of This BookRecorded LecturesOnline Practice ResourcesDownload the Color ImagesConventions UsedGet in TouchShare Your ThoughtsDownload a Free PDF Copy of This Book
Chapter 1: Audit Planning
Making the Most Out of This Book – Your Certification and BeyondThe Contents of an Audit CharterKey Aspects for the CISA ExamAudit PlanningBenefits of Audit PlanningSelection Criteria for the Audit ProcessReviewing Audit PlanningIndividual Audit AssignmentsAudit ProcessKey Aspects for the CISA ExamBusiness Process Applications and ControlsE-CommerceElectronic Data Interchange (EDI)Point of Sale (POS)Electronic BankingElectronic Funds Transfer (EFT)Image ProcessingArtificial Intelligence and Expert SystemsKey Aspects from the CISA Exam PerspectiveTypes of ControlsPreventive ControlsDetective ControlsCorrective ControlsDeterrent ControlsThe Difference Between Preventive and Deterrent ControlsCompensating ControlsControl ObjectivesControl MeasuresKey Aspects for the CISA ExamRisk-Based Audit PlanningWhat Is Risk?Understanding Vulnerability and ThreatsUnderstanding Inherent Risk and Residual RiskAdvantages of Risk-Based Audit PlanningAudit RiskRisk-Based Auditing ApproachRisk AssessmentsRisk Response MethodologyKey Aspects for the CISA ExamTypes of Audits and AssessmentsInternal IS Audit FunctionRequirement for a Separate IS Audit FunctionGovernance of an IS Audit FunctionReporting Structure of an IS Audit FunctionManagement of IS Audit ResourcesIS Audit Objective Should be Aligned with the Overall Business ObjectiveKey Aspects for the CISA Exam PerspectiveManaging Third-Party IS Auditors and Other ExpertsRegulatory and Other Requirements for OutsourcingDue DiligenceAppointment Procedures and Best PracticesContracts, Service-Level Agreements, and Non-Disclosure AgreementsMonitoring the PerformanceKey Aspects for the CISA Exam PerspectiveCode of EthicsSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 2: Audit Execution
Audit Project ManagementAudit ObjectivesAudit PhasesKey Aspects for the CISA ExamAudit testing and Sampling methodologySampling TypesStatistical SamplingNon-Statistical SamplingAttribute SamplingVariable SamplingStop-or-Go SamplingDiscovery SamplingSampling RiskOther Sampling TermsThe Confidence CoefficientLevel of RiskExpected Error RateTolerable Error RateSample MeanSample Standard DeviationCompliance versus Substantive TestingThe Differences between Compliance Testing and Substantive TestingExamples of Compliance Testing and Substantive TestingThe Relationship between Compliance Testing and Substantive TestingKey Aspects for the CISA ExamAudit Evidence Collection TechniquesReliability of EvidenceIndependence of the Evidence ProviderQualifications of the Evidence ProviderObjectivity of the EvidenceTiming of the EvidenceEvidence-Gathering TechniquesFraud, Irregularities, and Illegal ActsKey Aspects for the CISA ExamData AnalyticsCAATsPrecautions While Using CAATContinuous Auditing and MonitoringIntegrated Test FacilitySystem Control Audit Review FileSnapshot TechniqueAudit HookContinuous and Intermittent SimulationKey Aspects for the CISA ExamReporting and Communication TechniquesExit InterviewAudit ReportingAudit Report ObjectivesAudit Report StructureFollow-Up ActivitiesKey Aspects for the CISA ExamControl Self-AssessmentPrecautions While Implementing CSAAn IS Auditor’s Role in CSAKey Aspects for the CISA ExamAgile AuditingDictionary Meaning of AgileUnderstanding Agile AuditingBenefits of Agile AuditingTraditional Auditing vis-à-vis Agile AuditingKey Aspects for the CISA ExamQuality Assurance of Audit ProcessesOversight by Audit CommitteeContinuous Education and Updating of IS AuditorsPerformance Monitoring of IS Audit FunctionsContinuous ImprovementAccreditation/Certification of the IS Audit FunctionKey Aspects for the CISA ExamUse of AI in the Audit ProcessHow Does AI Work in Auditing?Benefits of Using AI in Audit ProcessesRisks of Using AI in Audit ProcessesUse Cases of AI in the Audit ProcessBest Practices for Using AI in Audit ProcessSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 3: IT Governance
EGITEGIT ProcessesThe Differences Between Governance and ManagementEGIT Good PracticesEffective Information Security GovernanceIS Auditor’ Role in EGITKey Aspects for the CISA ExamIT-Related FrameworksIT Standards, Policies, and ProceduresPoliciesStandardsProceduresGuidelinesInformation Security PolicyContents of the Information Security PolicyInformation Security Policy UsersInformation Security Policy AuditInformation Security Policy ReviewTop-Down and Bottom-Up Approaches to Policy DevelopmentThe Top-Down ApproachThe Bottom-Up ApproachThe Best ApproachKey Aspects for the CISA ExamOrganizational StructureRelationship Between the IT Strategy Committee and the IT Steering CommitteeDifferences Between the IT Strategy Committee and the IT Steering CommitteeKey Aspects for the CISA ExamEnterprise ArchitectureEnterprise Security ArchitectureOpen System ArchitectureKey Aspects for the CISA ExamEnterprise Risk ManagementRisk Management Process StepsAsset IdentificationIdentification of Threats and VulnerabilitiesEvaluation of ImpactCalculation of RiskRisk ResponseRisk Analysis MethodsQualitativeSemi-quantitativeQuantitativeRisk TreatmentKey Aspects for the CISA ExamMaturity ModelLaws, Regulations, and Industry Standards Affecting the OrganizationAn IS Auditor’s Role in Determining Adherence to Laws and RegulationsKey Aspects for the CISA ExamData Privacy Program and PrinciplesPrivacy-Related RegulationsPrivacy PrinciplesImportant Privacy-Related TerminologyAuditing a Privacy ProgramKey Aspects for the CISA ExamData Governance and Data ClassificationBenefits of Data ClassificationResponsibility for Data ClassificationConsideration of Legal and Regulatory RequirementsKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 4: IT Management
IT Resource ManagementHuman Resource ManagementHiringTrainingScheduling and Time MonitoringDuring EmploymentTermination PoliciesIT ManagementFinancial ManagementKey Aspects for the CISA ExamIT Service Provider Acquisition and ManagementEvaluation Criteria for OutsourcingSteps for OutsourcingOutsourcing – Risk Reduction OptionsProvisions for Outsourcing ContractsRole of IS Auditors in Monitoring Outsourced ActivitiesGlobalization of IT FunctionsOutsourcing and Third-Party Audit ReportsMonitoring and Review of Third-Party ServicesKey Aspects for the CISA ExamIT Performance Monitoring and ReportingDevelopment of Performance MetricsEffectiveness of Performance MetricsTools and Techniques for Performance MeasurementSix SigmaLean Six SigmaIT Balanced ScorecardKPIsBenchmarkingBPRRoot Cause AnalysisLife Cycle Cost-Benefit AnalysisKey Aspects for the CISA ExamQuality Assurance and Quality Management in ITQuality AssuranceQuality ManagementImportance of Quality ManagementKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 5: Information Systems Acquisition and Development
Project Management StructureProject Roles and ResponsibilitiesBoard of DirectorsIT Strategy CommitteeProject Steering CommitteeProject SponsorSystem Development ManagementProject Cost Estimation MethodsSoftware Size Estimation MethodsProject Evaluation MethodsProject Objectives, OBS, and WBSThe Role of the IS Auditor in Project ManagementKey Aspects for the CISA ExamBusiness Case and Feasibility AnalysisBusiness CasesFeasibility AnalysisThe IS Auditor’s Role in Business Case DevelopmentSystem Development MethodologiesSDLC ModelsTraditional WaterfallV-Shaped ModelSDLC PhasesPhase 1 – Feasibility StudyPhase 2 – RequirementsPhase 3 – Software Selection and AcquisitionPhase 4 – DevelopmentPhase 5 – Testing and ImplementationPhase 6 – Post-ImplementationSoftware Development MethodsAgile DevelopmentPrototypingRADObject-Oriented System DevelopmentComponent-Based DevelopmentSoftware Reengineering and Reverse EngineeringKey Aspects for the CISA ExamControl Identification and DesignCheck DigitsParity BitsChecksumsForward Error ControlData Integrity PrinciplesLimit ChecksAutomated System BalancingSequence ChecksDecision Support SystemsDecision TreesKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 6: Information Systems Implementation
Testing MethodologyUnit TestingIntegration TestingSystem TestingFinal Acceptance TestingRegression TestingSociability TestPilot TestingParallel TestingWhite-Box TestingBlack-Box TestingAlpha TestingBeta TestingTesting ApproachTesting PhasesKey Aspects for the CISA ExamSystem MigrationParallel ChangeoverPhased ChangeoverAbrupt ChangeoverKey Aspects for the CISA ExamPost-Implementation ReviewKey Aspects for the CISA ExamConfiguration and Release ManagementRelease ManagementConfiguration ManagementBaseline ControlKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 7: Information Systems Operations
Understanding Common Technology ComponentsTypes of ServersUniversal Serial BusUSBs – RisksUSBs – Security ControlsRadio-Frequency IdentificationRFID – RisksRFID – Security ControlsIT Asset ManagementPerformance ReportsAvailability ReportsUtilization ReportsAsset Management ReportsHardware Error ReportsJob SchedulingEnd-User Computing and Shadow ITKey Aspects for the CISA ExamSystem Performance ManagementNucleus (Kernel) FunctionsUtility ProgramsParameter Setting for the Operating SystemRegistryActivity LoggingSoftware Licensing IssuesSource Code ManagementCapacity ManagementKey Aspects for the CISA ExamProblem and Incident ManagementNetwork Management ToolsKey Aspects for the CISA ExamChange Management, Configuration Management, and Patch ManagementChange Management ProcessEmergency Change ManagementBackout ProcessThe Effectiveness of a Change Management ProcessPatch ManagementConfiguration ManagementKey Aspects for the CISA ExamIT Service-Level ManagementDatabase Management ProcessAdvantages of Database ManagementDatabase StructuresHierarchical Database ModelNetwork Database ModelRelational Database ModelObject-Oriented Database ModelDatabase NormalizationDatabase Checks and ControlsSegregation of DutiesKey Aspects for the CISA ExamOperational Log ManagementImportance of Log ManagementTypes of LogsLog Management Life CycleEffective Data CollectionProtection of Log DataIntegration with SIEM SystemsKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 8: Business Resilience
Business Impact AnalysisKey Aspects for the CISA ExamData Backup and RestorationTypes of Backup StrategyStorage Capacity for Each Backup SchemeRestoration Capability for Each Backup StrategyAdvantages and Disadvantages of Each Backup MethodologyKey Aspects for the CISA ExamSystem ResiliencyApplication Resiliency – ClusteringTelecommunication Network ResiliencyAlternative RoutingDiverse RoutingBusiness Continuity PlanSteps of the BCP Life CycleContents of the BCPResponsibility for Declaring a DisasterA Single PlanBackup Procedure for Critical OperationsThe Involvement of Process Owners in the BCPBCP and Risk AssessmentsTesting the BCPKey Aspects for the CISA ExamDisaster Recovery PlanThe BCP versus the DRPThe Relationship Between the DRP and the BIACosts Associated with Disaster RecoveryData BackupDRP of a Third-Party Service ProviderResilient Information AssetsService Delivery ObjectiveKey Aspects for the CISA ExamDRP – Test MethodsChecklist ReviewStructured Walk-ThroughTabletop TestSimulation TestParallel TestFull Interruption TestKey Aspects for the CISA ExamRecovery Time Objective (RTO) and Recovery Point Objective (RPO)RTORPORTO and RPO for Critical SystemsRTO and RPO and Maintenance CostsRTO, RPO, and Disaster ToleranceKey Aspects for the CISA ExamAlternate Recovery SitesMirrored SiteHot SiteWarm SiteCold SiteMobile SiteReciprocal AgreementSummaryExam Readiness DrillHOW TO GET STARTED

Chapter 9: Information Asset Security and Control
Information Asset Security FrameworksAuditing the Information Security Management FrameworkKey Aspects for the CISA ExamPhysical Access and Environmental ControlsEnvironmental ControlsAlarm ControlsWater and Smoke DetectorsFire Suppression SystemsWater-Based Sprinkler (WBS)Dry Pipe SprinklerHalon SystemsCarbon Dioxide SystemsPhysical Access ControlBolting Door LocksCombination Door Locks (Cipher Locks)Electronic Door LocksBiometric Door LocksDeadman DoorsIdentification BadgesCCTV CamerasWorkstation LocksNo Sign BoardsKey Aspects for the CISA ExamIndustrial Control SystemsIdentity and Access ManagementAccess Control CategoriesSteps for Implementing Logical Access ControlsControl EffectivenessDefault Deny Policy – Allow-All PolicyDegaussing (Demagnetizing)Naming ConventionAuthentication FactorsSingle Sign-OnAdvantages of SSODisadvantages of SSOZero TrustPrivileged Access ManagementDirectory ServicesIdentity as a Service (IdaaS)Benefits of IdaaSRisks of IdaaSDigital Rights Management (DRM)Benefits of DRMFederated Identity Management (FIM)Benefits of FIMKey Aspects for the CISA ExamBiometricsBiometrics Accuracy MeasureFalse Acceptance Rate (FAR)False Rejection Rate (FRR)Cross-Error Rate (CER) or Equal Error Rate (EER)Control over the Biometric ProcessTypes of Biometric AttacksKey Aspects for the CISA ExamSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 10: Network Security and Control
Networking and Endpoint DevicesOpen System Interconnection (OSI) LayersNetworking DevicesRepeatersHubs and SwitchesBridgesRoutersGatewayNetwork Devices and the OSI LayerNetwork Physical MediaFiber-Optic CablesTwisted Pair (Copper Circuit)Infrared and Radio (Wireless)Identifying the Risks of Physical Network MediaAttenuationElectromagnetic Interference (EMI)CrosstalkNetwork DiagramNetwork ProtocolsDynamic Host Configuration ProtocolTransport Layer Security and Secure Socket LayerTransmission Control Protocol and User Data ProtocolSecure Shell and TelnetNetwork Attached Storage (NAS)Content Delivery Network (CDN)Network Time Protocol (NTP)How Does NTP Work?Network SegmentationHow Does Network Segmentation Work?Key Aspects for the CISA ExamFirewall Types and ImplementationTypes of FirewallsPacket-Filtering RouterStateful InspectionCircuit-LevelApplication-LevelWhat Is a Bastion Host?What Is a Proxy?Types of Firewall ImplementationDual-Homed FirewallScreened-Host FirewallScreened-Subnet Firewall (Demilitarized Zone)The Firewall and the Corresponding OSI layerNext-Generation Firewall (NGFW)How Does an NGFW Work?Unified Threat Management (UTM)How Does UTM Work?Key Aspects for the CISA ExamVPNVPNs – Technical AspectsTypes of VPNVPNs – Security RisksKey Aspects for the CISA ExamVoice over Internet Protocol (VoIP)SBCsKey Aspects for the CISA ExamWireless NetworksEnabling MAC FilteringEnabling EncryptionDisabling a Service Set Identifier (SSID)Disabling DHCPUse of Dynamic Encryption KeysUse of a Randomly Generated Pre-Shared Key (PSK)Common Attack Methods and Techniques for a Wireless NetworkWardrivingWar WalkingWarchalkingKey Aspects for the CISA ExamEmail SecurityKey Aspects for the CISA ExamData Loss PreventionTypes of DLPHow DLP Software OperatesBenefits of DLP SoftwareKey Aspects for the CISA ExamSummaryExam Readiness Drill – Chapter Review QuestionsHOW TO GET STARTED
Chapter 11: Public Key Cryptography and Other Emerging Technologies
Public Key CryptographySymmetric Encryption versus Asymmetric EncryptionEncryption KeysConfidentialityAuthenticationNon-RepudiationIntegrityThe Hash of the MessageCombining Symmetric and Asymmetric MethodsQuantum CryptographyBenefits of Quantum CryptographyHomomorphic EncryptionBenefits of Homomorphic EncryptionDomain Name System Security Extensions (DNSSEC)Benefits of DNSSECKey Aspects from the CISA Exam PerspectivePKIPKI TerminologyProcesses Involved in PKIRole of a CARole of a RACA versus RAKey Aspects for the CISA ExamCloud ComputingCloud Computing – Deployment ModelsThe Private CloudThe Public CloudThe Community CloudThe Hybrid CloudTypes of Cloud ServicesIaaSPaaSSaaSCloud Computing – the IS Auditor’s RoleVirtualizationVirtual CircuitsHow Do Virtual Circuits Work?Virtual Local Area Network (VLAN)How Do VLANs Work?Virtual Storage Area Network (VSAN)ContainerizationMobile ComputingInternet of ThingsSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 12: Security Event Management
Security Awareness Training and ProgramsParticipantsSecurity Awareness MethodsSocial Engineering AttacksEvaluating the Effectiveness of Security ProgramsKey Aspects for the CISA ExamInformation System Attack Methods and TechniquesKey Aspects for the CISA ExamSecurity Testing Tools and TechniquesTerminal ControlsLogin IDs and PasswordsAuthorization ProcessAutomatic LogoffAccount LockoutControls on Bypassing Software and UtilitiesLog Capturing and MonitoringTime SynchronizationNetwork Penetration TestsAspects to Be Covered within the Scope of Penetration TestingTypes of Penetration TestsRisks Associated with Penetration TestingThreat IntelligenceKey Aspects for the CISA ExamSecurity Monitoring Tools and TechniquesIDSComponents of an IDSNetwork-Based and Host-Based IDSsLimitations of the IDSTypes of IDSPlacement of IDSsIPSHoneypots and HoneynetsKey Aspects for the CISA ExamIncident Response ManagementComputer Security Incident Response TeamKey Aspects for the CISA ExamEvidence Collection and ForensicsChain of CustodyIdentificationPreservationAnalysisPresentationKey Elements of Computer ForensicsData ProtectionData AcquisitionImagingExtractionInterrogationIngestion/NormalizationReportingProtection of EvidenceSummaryExam Readiness DrillHOW TO GET STARTED
Chapter 13: Accessing the Online Practice Resources
How to Access These MaterialsPurchased from Packt Store (packtpub.com)Packt+ SubscriptionPurchased from Amazon and Other SourcesSTEP 1STEP 2STEP 3STEP 4STEP 5Troubleshooting TipsShare FeedbackBack to the Book
Why subscribe?
Other Books You May EnjoyShare Your ThoughtsDownload a Free PDF Copy of This Book

Content preview from CISA – Certified Information Systems Auditor Study Guide - Third Edition

1 Audit Planning

An information system (IS) audit is a systematic examination and evaluation of an organization’s IT infrastructure, policies, and practices. It aims to ensure that the organization’s ISs are secure, efficient, and aligned with business objectives. IS audits cover a wide range of areas, including data integrity, cybersecurity measures, compliance with regulations, and the overall effectiveness of IT controls. By conducting these audits, organizations can identify vulnerabilities, mitigate risks, and improve their IT governance to support sustainable growth and safeguard sensitive information.

The history of IS audits traces back to the mid-20th century, when computers began transforming business operations. Initially, audits ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

CISA Certified Information Systems Auditor Study Guide

Publisher Resources

ISBN: 9781835882863

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

CISA – Certified Information Systems Auditor Study Guide - Third Edition

by Hemang Doshi

1

Audit Planning

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.