ITS462 The IT Governance Comprises Procedures & Regulations

ITS 462 CSU The IT Governance Comprises Procedures & Regulations Discussion

Provide a 250 word minimum answer to each question as well as 2 follow up questions.  

You are a CIO for a Fortune 500 company. The company has had a series of cybersecurity breaches in the last couple of years and is concerned that sensitive data on the network is at risk. You need to hire an outside contractor to perform an audit of the IT environment. Discuss what kind of skills an IT auditor should have to properly access the security and integrity of the network and systems in your environment. What kind of questions might you ask the auditor or auditing team during the hiring process? As CIO, what concerns might you have about the audit and its related activities? Keep in mind, you want the audit to be a thorough and honest assessment of the network infrastructure security.

Based on what you have learned from this week’s readings, discuss the role that IT governance plays in IT audit. How does IT governance differ from corporate governance? Are there any similarities between the two concepts? In your opinion, what do you think is the biggest challenge when it comes to auditing governance?

The Module 3 reading covers the CISA stages of the audit process. A CISA is expected to have a thorough understanding of the entire audit process. Choose two of the 10 stages (listed below), and in your own words describe each chosen stage and its importance to the overall auditing process. Discuss any challenges related to each chosen stage and how you would deal with them. How might success or failure of the stage impact the success or failure of the audit?

Audit planning

Scheduling audits

Assuring competence of auditors and audit team leader

1. Selecting appropriate audit team

Assigning roles and responsibilities

1. Conducting audits

Maintaining audit program records

Monitoring performance and effectiveness

Tracking complaints

Reporting to top management on overall achievements

1. According to the Section 4.3 Introducing the Open Systems Interconnection Model in the UCertify reading, as an IT auditor you are expected to have a fundamental understanding the Open System Interconnection (OSI) model. Discuss how an auditor might use this knowledge to identify weaknesses in policies, missing standards, and problems in procedures. In your opinion, how important do you think it is for an auditor have a fundamental understanding of the OSI model? Or do you think the OSI model has no impact or little significance on the success of an IT audit? Explain why or why not.

Discuss the purpose of the System Development Life Cycle (SDLC). Include in your response some of the challenges related to SDLC process. Based on your own experience or research, do you think that most organizations are properly following the best practices when it comes to the SDLC process? Why or why not?

1. Cyber security threats are a common occurrence and most organizations are at risk due to failures in administrative, physical, and logical controls specific to daily operations. Research a security incident that has occurred in the last three years that was result of failure in one of the operational controls discussed in this module’s Required Readings. Based on what you have learned about IT operational control best practices, what would you, as an IT auditor, recommend improving to prevent the same security failure from happening again.
2. Many successful network attacks begin as the result of a phishing attack. Phishing uses social engineering techniques to send fake emails to unsuspecting victims that contain a link to the criminal's fake website. This often results in the victim giving up critical information such as user ID and password, social security number, and credit card and bank information. Based on what you learned in this module and through your own research, explain how this type of attack can leave an organization exposed to other security breaches and discuss what organizations should be doing to minimize the risk of phishing attacks. Other than phishing, in your opinion what is the what most serious cyber security threat to users and businesses?
3. Describe the differences between disaster recovery and a business continuity plan (BCP). Also, discuss the issues and challenges that many organizations encounter when it comes to disaster recovery and business continuity. What are possible solutions?