Frameworks and Standards

Transcription

1 Frameworks and Standards Chris Davis and Mike Schiller. IT Auditing: Using Controls to Protect Information Assets (second edition) Autumn, 2011 Prepared by Nataliia Semenenko

2 Content Why do we need frameworks and standards? COSO COBIT ITIL ISO2001 NSA INFOSEC Assessment Methodology

3 Introduction Late XX century: Maturing of Information Technologies (IT). Developing methods for managing operations by IT departments within different organizations.

4 COSO A Committee of Sponsoring Organizations: Internal Control Integrated Framework (1992) Enterprise Risk Management Integrated Framework (2004)

5 COSO: Internal Control Integrated Framework Effectiveness of operations Reliability of financial reporting Compliance with applicable laws and regulations

6 COSO: Internal Control Integrated Framework It is a tone of the organization, influencing the control consciousness of its people.

7 COSO: Internal Control Integrated Framework Identification and analysis of relevant risks.

8 COSO: Internal Control Integrated Framework Policies and procedures that help to ensure that management directives are carried out.

9 COSO: Internal Control Integrated Framework Pertinent information must be identified, captured and communicated between people.

10 COSO: Internal Control Integrated Framework A process that assess the quality if the system s performance over time.

11 COSO: Enterprise Risk Management Integrated Framework Categories of organization s objectives: Strategic Operations Reporting Compliance

12 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

13 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

14 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

15 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

16 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

17 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

18 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

19 COSO: Enterprise Risk Management Integrated Framework Components: Internal environment Objective settings Event identification Risk assessment Risk response Control activities Information and communication Monitoring

20 COSO Internal Control Integrated Framework is the basis for existing rules, regulations and laws. At the same time, it is an integral part of Enterprise Risk Management which forms the additional tools for management.

21 COBIT Control Objectives for Information and Related Technology divides its primary control objectives into four domains: Plan and organize Acquire and implement Deliver and support Monitor and evaluate

22 COBIT framework

23 ITIL and ISO2001 ITIL: The IT Infrastructure Library is a collection of the good practices for IT management that is concentrated on aligning IT services with the demands of business. ISO formally specifies a management system that is intended to bring information security under explicit management control.

24 NSA INFOSEC Assessment Methodology Baselines assessment activities Breaks information security into three phases Each phase contains mandatory activities; Assessments consist of only documentation review, interviews and observation No testing

25 NSA INFOSEC Assessment Methodology Pre-assessment phase On-site activities Post-assessment phase

26 Conclusions There is no single set of standards and frameworks that could cover needs of business all over the world as its practices and requirements differ in different part of the globe.

27 Thank you for attention!