IT risks and controls

Transcription

1 Università degli Studi di Roma "Tor Vergata" Master of Science in Business Administration Business Auditing Course IT risks and controls October 2018

2 Agenda I IT GOVERNANCE IT evolution, objectives, roles and process model of an IT governance framework II IT RISK MANAGEMENT Risk context, key elements of an IT Risk management framework, risk and measure examples DISCUSSION about risk identification III IT AUDIT CASE STUDY Approach, planning and results of a real IT audit activity 2

3 Section I IT GOVERNANCE 1. Main references adopted 2. IT evolution 3. IT governance definition and objectives 4. Governance enablers 5. Governance roles 6. Process reference model 3

4 IT governance Main references adopted 4

5 BUSINESS ENABLEMENT IT governance IT evolution

6 IT governance Why IT Governance? 1. High-quality information 2. Business value 3. Operational excellence 4. IT-related risk 5. Cost of IT 6. Compliance 6

7 IT governance the responsibility of the board of directors and executive management. It is an integral part of entrprise governance and consist of the leadership and organisational structures and processes that ensure that the organisation s IT sustains and extends the organisation s strategies and objectives.» 7

8 IT governance Drivers for IT Governance Activities ITGI - Global Status Report on the Governance of Enterprise IT 8

9 IT governance Governance objective

10 IT governance Governance enablers 10

11 IT governance Governance roles 11

12 IT governance Process reference model

13 IT governance 13

14 IT governance 14

15 Section II IT RISK MANAGEMENT 1. Key points of context 2. Risk / IT risk definitions 3. IT risk categories 4. IT risk evaluation 5. IT risk and organisational structures 6. Information items and risk management 7. Risk management process 8. Risk scenario structure and risk factors 9. Risk scenario and response examples 15

16 IT risk management Key points of context 1. IT as a key element for creating value 2. Regulations govern information technology 3. Growing need to manage risks related to IT 4. IT risk management requires to address the full scope of strategic impacts 16

17 IT risk management Risk / IT risk definitions RISK Risk is the combination of the probability of an event and its consequence. Consequences are that enterprise objectives are not met. INFORMATION and related Technologies (IT) RISK IT risk is a business risk, specifically, the business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise. 17

18 IT risk management IT risk and business value BUSINESS VALUE Fail to Gain / Lose Gain / Preserve 18

19 More in particular, what is an IT Risk? IT Building Blocks IT Risk 1. People, skills and competencies 2. Processes Impact Business 3. Information 4. Services, Infrastructure and Applications 19

20 IT risk management IT risk categories 1. IT Benefit / Value Enablement 2. IT Programme and Project Delivery 3. IT Operations and Service Delivery 20

21 IT-related Issues Experienced in the Past 12 Months IT risk management ITGI - Global Status Report on the Governance of Enterprise IT 21

22 IT risk management IT risk evaluation

23 IT risk management IT risk and organisational structures RISK 23

24 IT risk management IT risk and organisational structures Business process owners IT process / service owners 1. Risk evaluation 2. Risk ownership Risk owner - Person or entity with the accountability and authority to manage a risk ISO Risk management Principles and guidelines 24

25 Information items and risk management IT risk management 7. Risk profile 3. Risk universe 1. Risk scenarios 2. Risk analysis results 4. Risk action plan 6. Risk factors 5. Loss events 25

26 IT risk management Risk management process Practices 1. Collect data 2. Analyse risk Main outputs Data on the operating environment relating to risk Data on risk events and contributing factors IT risk scenarios Risk analysis results 3. Mantain a risk profile Aggregated risk profile, including status of risk management actions 4. Articulate risk Risk analysis and risk profile reports for stakeholders 5. Define an action portfolio Project proposals for reducing risk 6. Respond to risk Risk-related incident response plans 26

27 IT risk management Risk scenario structure

28 IT risk management Risk factors Risk factors 1. Internal context 2. External context 28

29 IT risk management Risk factors Category 1. Internal context Risk factor 1. Enterprise goals and objectives 2. Strategic importance of IT for the business 3. Complexity of IT 4. Complexity of the entity 5. Degree of change 6. Change management capability 7. Operating model 8. Strategic priorities 9. Culture of the enterprise 10. Financial capacity 11. Risk management capability 12. IT-related capabilities 29

30 IT risk management Risk factors Category 1. External context Risk factor 1. Market and economic factors 2. Rate of change in the market/product life cycle 3. Industry and competition 4. Geopolitical situation 5. Regulatory environment 6. Technology status and evolution 30

31 IT risk management Risk scenario examples from COBIT Risk Category Risk scenario Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management 3. IT investment decision making 4. IT expertise and skills 5. Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) There is duplication between initiatives There is an IT project budget overrun The wrong software, in terms of cost, performance, features, compatibility, etc., is selected for implementation. There is a lack of or mismatched IT-related skills within IT, e.g., due to new technologies Hardware components were configured erroneously Portable media containing sensitive data (CD, USB drives, portable disks, etc.) is lost/disclosed. The enterprise architecture is complex and inflexible, obstructing further evolution and expansion leading to missed business opportunities. 8. Infrastructure The systems cannot handle transaction volumes when user volumes increase Software Intentional modification of software leading to wrong data or fraudulent actions

32 IT risk management Risk scenario examples from COBIT Risk Category Risk scenario Cobit Ref 10. Business ownership of IT 11. Supplier selection/performance, contractual compliance, termination of service and transfer 12. Regulatory compliance 13. Infrastructure theft or destruction Business does not assume accountability over those IT areas it should, e.g., functional requirements, development priorities, assessing opportunities through new technologies. Support and services delivered by vendors are inadequate and not in line with the SLA. There is non-compliance with regulations, e.g., privacy, accounting, manufacturing Destruction of the data centre (sabotage, etc.) occurs Malware Regularly, there is infection of laptops with malware Logical attacks There is a service interruption due to denial-of-service attack Industrial action Facilities and building are not accessible because of a labour union strike Acts of nature There is flooding

33 IT risk management Risk scenarios by category IT Programme and Project Delivery 15% IT Operations and Service Delivery IT Benefit / Value Enablement 36% RISK SCENARIOS 50% 13% Cybersecurity 87% Others 33

34 IT risk management Risk response examples from COBIT Risk Category Risk responses (Cobit Processes) Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management Prioritise resource allocation. Maintain a standard approach for programme and project management. APO06.02 BAI IT investment decision making Manage stakeholder engagement. BAI IT expertise and skills Plan and track the usage of IT and business human resources. APO Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) Manage contract staff. Ensure traceability of Information events and accountabilities. Define reference architecture. APO07.06 DSS06.05 APO Infrastructure Monitor and scan the technology environment. APO Software Evaluate, prioritise and authorise change requests. BAI

35 IT risk management Risk response examples from COBIT Risk Category Risk responses (Cobit Processes) Cobit Ref 10. Business ownership of IT Monitor and report service levels. APO Supplier selection/performance, contractual compliance, termination of service and transfer Monitor supplier performance and compliance. APO Regulatory compliance Identify external compliance requirements. MEA Infrastructure theft or destruction Manage physical access to IT assets. DSS Malware Monitor the infrastructure for security-related events. DSS Logical attacks Monitor IT infrastructure. DSS Industrial action Identify key IT personnel. APO Acts of nature Exercise, test and review the Business Continuity Plan. DSS

36 DISCUSSION Risk identification 36

37 Discussion Assessing the risk connected to personal data security see a statement of the EU General Data Protection Regulation below which are the risk scenarios to consider among the ones detailed in the following slide? GDPR In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 37

38 Discussion Risk Category Risk scenario Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management 3. IT investment decision making 4. IT expertise and skills 5. Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) 8. Infrastructure 38

39 Discussion Risk Category Risk scenario Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management There is duplication between initiatives There is occasional late IT project delivery by an internal development department. 3. IT investment decision making Redundant software is purchased IT expertise and skills 5. Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) There is a lack of or mismatched IT-related skills within IT, e.g., due to new technologies Hardware components were configured erroneously Portable media containing sensitive data (CD, USB drives, portable disks, etc.) is lost/disclosed There is a failure to adopt and exploit new infrastructure in a timely manner Infrastructure The systems cannot handle transaction volumes when user volumes increase

40 Section III IT AUDIT CASE STUDY 1. IT audit approach 2. Needs of the key players 3. Audit scope and planning 4. Risk assessment 5. Audit areas 6. Methods adopted 7. Audit report and improvement points 8. Key points 40

41 IT audit Case study IT audit approach 1. Overall analysis 2. Effective checks 3. Search of logic vulnerabilities 41

42 IT audit Case study Needs of the key players 1. Management 2. Audit and control functions 3. IT department 42

43 IT audit Case study Audit scope 1. Main foreign branches of a leading company in the industrial sector 2. Company has 20 foreign branches on several continents 43

44 IT audit Case study Information system audited Audited branches Applications: Tenders Design Production Support processes Headquarter 44

45 IT audit Case study Audit planning 1. Preliminary survey 2. Risk assessment 3. Audit plan Documentation analysis Interviews IT systems IT management processes Audit areas Checks 45

46 IT audit Case study Risk assessment PURPOSE 1. Identify and assess IT risk 2. Define the audit program 46

47 IT audit Case study Risk assessment Taylor-made check-list IT Risk assessment process Audit support Real-time results 47

48 IT audit Case study Risk assessment Category Risks L M H IT Architecture The enterprise architecture is complex, obstructing further evolution and not supporting the business priorities There is a lack in IT staff recruiting process There are insufficient IT HR to cover the business requirements. IT expertise and skills There is an overreliance on key IT staff There are insufficient skills to cover the business requirements. Software Information management There is extensive use of end-user computing for important information (ex. Excel), leading to security deficiencies, inaccurate data or increasing costs There is a lack in IT training/support/user's guide for new application software or software release Data are lost, inaccessible or corrupted (e.g. backup media is lost or backups are not checked for effectiveness; data are modified intentionally). IT Project Portfolio Management There is a failure/overbudget/delay in IT project delivery Competing resources are allocated and managed inefficiently and are misaligned to business priorities 48

49 IT audit Case study Risk assessment IT risk category assessment results IT benefit/value enablement risk IT operations and service delivery risk IT programme and project delivery risk 49

50 IT audit Case study Audit areas Area Cobit Ref 1. System administrators DSS Management of users and authorisations DSS Software licensing management BAI Security of IT workstations DSS Electronic signature DSS

51 IT audit Case study Audit area 1 - System Administrators Audits Population / Sample 1 - Identification of administrators Contract documents 2 - Name-registered administrator accounts List of users in the administrators authentication group 3 - Rules of minimum complexity of passwords Settings for authentication of administrator accounts 51

52 IT audit Case study Audit area 2 - Management of User Accounts Audits 1 - Correspondence between user accounts and the employees 2 - Traceability of the requests relating to user accounts 3 - Minimum complexity of passwords 4 - Name-registered accounts Population / Sample List of user accounts and employees / collaborators Procedure adopted for the traceability of the subjectmatter requests Settings for the authentication of user in the centralized authentication system List of user accounts in the centralized authentication system 52

53 IT audit Case study Audit area 3 - Management of access authorizations 1 - Use of the folder Public Audits Population / Sample List of the folders and files contained in the shared folder Public 2 - Shared folders in the PCs Sample of PCs 3 - Adequacy of the authorizations List of the authorization and users for a selected sample of shared folders 53

54 IT audit Case study Audit area 4 - Software Licences Audits Population / Sample 1 - Inventory of software licences Archiving of software setup supports Software licences Sample of PCs and software licences 54

55 IT audit Case study Audit area 5 - Cybersecurity of PCs Audits Population / Sample 1 - Update of antivirus software 2 - Security updates Sample of PCs 3 Installing authorizations 55

56 IT audit Case study Audit area 6 - Electronic signature Audits Population / Sample 1 - Electronic signature devices Signature authorizations Revocation of the electronic certificate - 56

57 IT audit Case study Methods adopted 1. Analysis of company regulations 2. Surveying practices and IT systems 3. Process walk-throughs 4. Verifying IT system 57

58 IT audit Case study Audit report 1. Methods used to plan and carry out the activities 2. Improvement points 3. Suggestions for action 58

59 IT audit Case study Improvement points 1. Contractual definition of System Administrators 2. Use of shared folders 3. Inventory of software in use 4. Traceability of new user requests 59

60 IT audit Case study Critical factors 1. Co-existence of local and central IT systems 2. Outsourced IT administration 3. Temporary nature of the production sites 4. Specific needs of each production site 60

61 IT audit Case study Key points 1. Value of information / dimension of infrastructures 2. IT risk & control policy adoption 61

62 Thank you! Alessandro Salibra Bove Partner 62