Technology Systems Auditing

Discover the role of governance in organizations and learn how governance guides processes and shapes the way we operate in technology systems auditing.

Align IT and information security governance with organizational goals to ensure secure, efficient operations; auditors monitor layered governance to prevent misalignment and adapt to changing factors.

IT governance brings value to the business and manages risk by integrating mandates, standards, policies, laws, and regulations across federal, state, local, and cross-border contexts with a multidisciplinary team.

Governance defines ethical behaviors by company directors to preserve the organization's value, including intellectual property, beyond money, by distributing rights and responsibilities among decision makers and establishing committees.

Explore the governance relationship structure by examining stakeholder value, strategic positioning, risk and performance management, and how alignment supports security within the organization.

Engage in the governance process as an auditor and adapt to authority levels. Apply high-level IT expertise to thoroughly assess, validate, and report on systems, delivering value.

Offer governance recommendations to senior management, establish ongoing monitoring with a regular schedule and reporting technology, and assess security, incident response, and compliance to demonstrate system performance.

Align governance with enterprise goals to optimize operations, create margin and safety, and seize opportunities. Apply governance to manage finite IT and information security resources and reduce risk.

Report issues to senior management promptly and clearly, and support enterprise IT strategy through strategy and steering committees to keep information security on track as changes require testing and rollout.

Preserve the CIA triad: confidentiality, integrity, and availability, by governing corporate information assets through information security guidance. Secure sponsorship from executive leadership to provide legitimacy, resources, and clear direction.

Explore information security governance as a holistic, organization-wide approach that preserves CIA, integrates security with administrative and physical controls, and defines board and executive accountability for risk and legality.

Strengthen information security governance to manage regulatory exposure during transitions such as mergers or divestitures. Provide assurance of policy compliance through regular audits, reducing risk and uncertainty.

Governance acts as the foundation for resource allocation and data decision making. It governs how we monitor and collect data and ensures decisions are based on correctly interpreted information.

Align security governance with business and organizational objectives, monitor risk management, optimize resource use, and report what is known, what is obtained, and what is not obtained.

Explore the administrative side of security by examining how policies, procedures, and risk interconnect to guide auditing practices.

Explore IT governance, policies, procedures, and a risk management process aligned with organizational goals; learn diverse risk analysis methods to assess enterprise risk across different systems.

Define policy as a high-level document of intent and commitment to security, outlining philosophy, strategy, justification, and a pyramid where the top policy guides subordinate policies with limited deviations.

Reassess information security policies to reflect remote work, VPN usage, and bring-your-own-device risks. Avoid change for change's sake; align with current laws, governance, and the current environment.

Develop an information security policy document that defines inline terms, sets mandatory standards, and outlines risk assessment, control testing, and cross references for consistent, compliant security.

Establish and maintain a regular review schedule for information security policy documents, ensuring last updated and last reviewed dates are recorded to prove ongoing validity.

Engage in management reviews of policy documents by collecting feedback on verbiage and law changes, tracking changes with justification. Evaluate compliance, results, and impact through status reports and trend analysis.

After completing the management review, identify improvements, adjustments, and corrections that truly address issues, and separate concerns as questions for management needing more information.

Translate policy into concrete steps with procedures, showing how to carry out security tasks and tests to verify the system works as intended.

Make procedures available to users, train them to use them fluently, seek third party reviews to ensure objectivity and keep them up to date with CMI capability maturity model integration.

Examine the five risk management approaches—avoid, mitigate, transfer, accept, and eliminate—and see how they apply to phishing awareness, antivirus controls, and compliance within your risk appetite.

Identify and classify risk types, assess threats and vulnerabilities, and analyze impact through a business impact analysis, then present an overall risk view and evaluate controls to actively manage threats.

Explore risk management levels, from the operational level for day‑to‑day tasks to the project level during implementation, and how work progresses toward the operational level.

Explore IT governance and personnel management by examining how people influence governance decisions and impact project processes throughout the lifecycle.

Examine personnel management for securing processes and assets, insourcing and outsourcing decisions, and change, quality, and performance management to maintain standards and manage risk.

Explore how training and continuing education safeguard security and reduce risk, while effective scheduling, vacations, reporting, and evaluations optimize personnel management and maintain coverage.

Compare insourcing versus outsourcing of information systems functions and explore hybrid and cloud hosting models. Assess security implications, data hosting, and response times in outsourced environments.

Collaborate with steering committees to evaluate insourcing and outsourcing strategies, assess governance impact, and analyze risks, pros and cons as auditors, then redefine risk standards to ensure safe, effective implementation.

Understand insourcing, outsourcing, and hybrid models, and master contracts, service level agreements, and cross-border regulations to manage third-party service delivery and subcontracting responsibly.

Explore change management as a governance process to propose, test, approve, and track modifications, with senior sponsorship, so you know what changed, who changed it, and why.

Leverage integrated tools like SharePoint to track changes, centralize communication, and involve the right people for feedback and multi-level sign-offs in change management.

Explore how a quality management system, including iso 9001, uses documents, manuals, and records to ensure a safe, compliant end product. See how procurement and legal requirements shape quality governance.

Audit quality management systems to ensure effective practice and proper documentation aligned with standards like ISO 9001, applying government-driven controls that define critical functions and require consistent, documented practices.

Explore organizational quality management to create a predictable, stable environment that minimizes risk, achieves measurable performance, and aligns with ISO standards through gap analysis and corrective planning.

Explore how performance management uses reports and metrics across IT and information security to assess environments and people, establish meaningful baselines, ensure accountability, and drive improvements.

Explore organizational quality management through data collection and reporting to monitor performance, outages, log files, and environment health, leveraging built-in and third-party network monitoring tools.

Align governance with business goals by integrating information security and IT programs, develop environment-specific policies and risk procedures, and use multi-person reviews for change approvals.

Learn how to operate, maintain, and support deployed systems by applying project management basics, deciding between in-house or third-party software development, and managing infrastructure development and acquisition.

Identify the basics of project management within technology systems auditing, establishing structure and processes to shepherd and maintain projects effectively.

Define project management as a structured set of tools and techniques that balance time, money, and people to deliverables through phases and a start-to-finish lifecycle, governed by a project charter.

Describe the project management structure from initiation to closure, detailing planning, coordination, execution, monitoring, and discontinuity controls. Explain cyclical and upgrade cycles in IT infrastructure and manufacturing contexts.

The lecture demonstrates a project governance org chart for a specific project, including steering committee, system development and user project committees, power users, and security officers.

Explore how timeline, cost, and what we have to deliver interact in project management, and how scope and resources influence deadlines and the balance of time and money.

In technology systems auditing, this practical project management focuses on five phases—initiation, planning, managing, controlling, and closing—to meet milestones, manage resources, and smooth processes.

Explore Topic B as it examines key aspects of the project management process related to self development and the acquisition of new software for the organization under audit.

In-house software development combines off-the-shelf components with tools like Visual Studio, SQL Server, and Oracle to create custom web and Android apps, guided by systems development lifecycle and agile practices.

Explore how the waterfall technique, SDLC, and the verification and validation (V) model shape business application development, and clarify the concept of line of business applications.

Explore the traditional SDLC approach, from feasibility and cost-benefit analysis to requirements, design and selection, development, configuration, testing, deployment, and post-implementation maintenance.

The SDLC helps minimize software risks by defining goals, tracking performance, and ensuring the system meets user needs, while securing cross-unit support and ongoing review.

Explore alternative development methods beyond the waterfall model and learn how newer software models address evolving modern development challenges, sometimes outperforming traditional approaches in specific situations.

Identify alternative development methods and explain how they fit within the SDLC and the business application development, operations, and planning phases.

Break tasks into bite-sized chunks to enable rapid prioritization, resource reallocation, and just-in-time planning. Empower small, cross-functional teams to design, develop, and test with a supporting product manager.

Prototyping defines a basic operational model to demonstrate a proof of concept, enabling quick adjustments and evolution toward production with modern tools.

Prototype by building a model or skeleton, recognizing prototyping is not a one-size-fits-all solution, then design around it and polish into a finished product.

Rapid application development emphasizes prototyping and CASE tools to balance usability and functionality, delivering simple, usable systems while leaders manage time and empower experienced teams to move quickly.

Explore rapid application development through four stages: define the concept, create design, develop, and deploy. See how it compresses steps for speed and quality from high level concept to deployment.

Explore other development methods like CORBA and RMI, and examine reverse engineering as a broad development approach to analyze software for learning and new design, with legal considerations.

Explore infrastructure development and asset acquisition, including vetting email, database, domain control, and web servers, to ensure they fit the ecosystem and are acceptable.

Analyze current infrastructure and define goals, acquire, install, and maintain needed components, and plan a staged migration to reduce total cost of ownership while preserving data confidentiality and availability.

Analyze architecture documents to ensure the infrastructure reflects the network of applications and is up to date, then define functional requirements including central authentication and develop a proof of concept.

Identify sourcing options (off-the-shelf, in-house, or third-party components), estimate delivery and float time, plan installation across platforms with troubleshooting and testing, and aim for reliable, least disruptive integration with security.

Define hardware and software acquisition for a Windows-based environment, addressing mobility, encryption, data processing concerns, and the trade-off between adaptability and security.

Maintain information systems through configuration management, enforcing authorized change control and documenting changes. Address unauthorized changes, emergencies, and short-term exemptions while ensuring consistent configurations across systems.

Explore various change management standards, with example names and publication dates, to reference when addressing changes.

Explore change management standards in technology systems auditing, comparing change requests with RFQ-driven RC practices and other approaches for effective change governance.

Explore how application controls safeguard data confidentiality, integrity, and availability by ensuring data remains consistent, is not inappropriately manipulated, and is reliably available when needed.

Map information flow across system components and diagram touchpoints to identify where protections succeed or fail. Document inconsistencies and assess compliance and cost-effective improvements to ensure data protection.

Use input controls to validate and sanitize incoming data, ensuring only correctly formatted, usable data enters the system and front-end and server-side checks prevent errors.

Learn to implement data validation checks that verify range, length, and format for addresses and phone numbers, balance thoroughness with performance, and ensure data meets system accuracy requirements.

Explore data validation checks by inspecting a database for table contents and potential duplicates, illustrating how validation ensures data quality and consistency.

Explore output controls, including real-time validation, logging insights, and post-event analysis, and ensure data integrity with digital signatures and format checks that meet requirements.

Explore project management, compliance, and the roles they play in auditing technology systems. Learn how software and hardware, SDLC and agile processes shape requirements analysis and consistent implementation.

Audit the technical side by reviewing network models and how networks work. Build business resilience and continuity to operate during disruptions and recover quickly.

Explore network models and how they fit into technology systems, clarifying why these models matter for auditing and decision making.

Explore networking models and their layers, focus on what the model is doing, and how the industry group agrees upon improving the integration of systems.

Explore the advantages of reference models with seven discrete layers that define responsibilities, standardize interfaces, and enable interoperability, auditing, and verification of hardware, software, and applications.

Explore the OSI model and the network stack layers, and see how reproducible designs enable interoperability and interaction between client, server, and host systems.

Strengthen reliability by leveraging the tcp/ip suite to verify communications, ensuring transmitted data reaches the remote recipient within network protocols and the Ossi model.

Explore high-level network infrastructure concepts and how they affect resilience, stability, and security of an organization, prioritizing business needs over technical minutiae. Focus on practical implications for resilience and security.

Explore different network types by size and coverage, from pan to can to wan. Learn how data moves across lans and wlans using high-speed wired connections for reliability.

Explore network topology by distinguishing physical and logical architectures, comparing bus, star, and ring designs, their deterministic vs non-deterministic traffic, and how breaks affect connectivity.

Learn how virtual private networks secure remote access and site-to-site connections by encapsulating data, authenticating packages, and securely transmitting over the public internet.

Explore wireless specifications across 802.11 standards, plus 802.15 Bluetooth and Zigbee, and 802.16 WiMAX, focusing on frequency, speed, and security features.

Apply risk reduction to business continuity and disaster recovery, integrate Energreen concepts from earlier chapters, and establish a safety net to restore operations after incidents.

Align business continuity planning and disaster recovery to keep operations running at a minimal level after incidents and restore services using existing data and processes.

Explore definitions of business continuity planning and disaster recovery, and apply impact analysis as well as quantitative and qualitative risk analyses to determine essential services and bring systems back online.

Build a compliant business continuity plan by establishing policies aligned with regulations, performing impact and criticality analysis, classifying operations from nonsensitive to essential, and training, testing, monitoring, and auditing regularly.

Classify incidents using a predefined scheme to convey severity and trigger the appropriate response, with agreed criteria for major crises based on impact, duration, and affected users.

Identify potential disruptions through business impact analysis, gather data via interviews and questionnaires, and prioritize impacts to strengthen protection and quickly restore critical systems.

Explore disaster recovery and business continuity through MTD, RPO, and RTO, with practical backup strategies and outage scenarios to minimize data loss and downtime.

Implement recovery strategies that combine preventive, corrective, and detective controls, using passwords and two-factor authentication, threat removal or avoidance, and monitoring to minimize the likelihood and impact.

Take a closer look at the recovery process in technology systems and explore how recovery steps support resilience in technology systems auditing.

Explore how recovery works by categorizing strategies into business recovery, facilities, supply chains, basic resources, utilities, and people to restore operations after disasters.

Identify essential resources and assets, assess how long they can be unavailable and the potential impact, and reuse risk analysis data to categorize assets for business recovery.

Assess facilities, materials, and supplies after an incident to determine damage and required recovery actions. Plan for alternate facilities, remote work, and stocked spares for critical equipment and telecommunications.

Identify facilities, materials, and supplies as critical assets, and keep both digital and hard-copy documentation nearby to ensure continuity, including transportation logistics for supporting equipment.

Explore data recovery strategies for incidents, including local and remote backups, on-site and off-site, cloud options, forensics outsourcing, and software escrow contracts.

Prepare for disasters by staging equipment, training, and drills to ensure readiness. Define the disaster declaration process, assign responsibilities, and formalize service level agreements with outside providers and internal teams.

Identify who should join the disaster recovery team by mapping skills, leadership, and department stakeholders, and predefine roles through incident modeling and staffing.

Identify and implement business continuity plan components that recover operations, establish minimum performance levels, and define contingency and disaster recovery plans with robust communications and post-mortem reviews.

Explore raid as a system-level protection against hard drive failures, comparing software and hardware implementations, their costs, performance, and hot-swapping capabilities for high availability and disaster recovery.

Discover how business insurance provides coverage for software, facilities, damaged equipment, and documentation, offering an extra layer of protection for various situations.

Test your business continuity plan by planning, conducting, and documenting results to reveal gaps, assess effectiveness, and determine necessary adjustments; repeat regularly as part of ongoing audits.

Assess BCP/DR plans using checklist, structured walkthroughs, and simulations to verify coverage. Advance to parallel and full interruption tests to validate incident response while balancing risk and planning.

Auditors review how the BCP and disaster recovery plan fit the organization, assess readiness, training, and equipment, and verify legal and organizational requirements across all BCP processes and documents.

Explore organizations that support disaster recovery and business continuity, and learn how agencies like FEMA provide free online courses to help you become familiar with continuity initiatives.

Examine business continuity management (BCM) guidance, focusing on HIPER, and learn how to apply it to your organization, while comparing to guidance from the Federal Energy Regulatory Commission.

Review network models, technical issues, and the standards that shape disaster and business continuity. Explore business continuity, disaster recovery, testing, training, and planning for failure to recover from incidents.

Protect information assets by safeguarding data, the organization's most valuable resource after people, with five topics showing how to apply protection or restrict access.

Explore protecting data from a high-level perspective and outline the key components of data protection as the course's first topic.

Secure data by obtaining senior management endorsement and establishing policies with a responsible planning owner. Pair technology with education, ensure compliance through testing and monitoring, and plan for incidents.

Identify the roles involved in technology systems auditing and explain how large organizations delegate policy review to specialized officers, such as a chief policy officer, to manage extensive policies.

Map information assets by criticality and value, assess cost of loss and redevelopment, assign ownership and access rights, document classifications, and reclassify assets to ensure appropriate protection.

Leverage existing roles to define access rules and permissions, outlining who can interact with objects and what physical and logical access they require.

Explore topic b: threats and vulnerabilities, and understand what these concepts mean to us in technology systems auditing, framing the discussion in a fresh perspective.

Identify four attack categories (unstructured and structured threats, internal and external origins) and understand their characteristics, risks, and response implications in technology systems auditing.

Explore exposures and vulnerabilities through examples such as asynchronous attacks, denial of service, data leakage, logic bombs, piggybacking, and rounding-down salami attacks, while noting real-world variety.

Identify exposure points and vulnerabilities, including viruses, malware, trapdoors, and back doors that bypass security. Understand how back doors may be planted by developers or Trojan malware.

Explore wireless exposures and vulnerabilities, including war driving to map networks and sniff traffic, and learn how weak encryption and autonomous worms can cause performance drops.

Explore access controls in technology systems, examining devices, procedures, and physical items that mediate or regulate access between a subject and an object.

Identify how access control systems determine who (subject) accesses which object and at what level, ensuring a user can view or modify data in a given scenario.

Define authenticated identities and strengthen access controls with multi-factor authentication, auditing, and secure single sign-on, while avoiding weak passwords and insecure credential transmission.

Enforce a strong password policy with long alphanumeric passwords, multifactor authentication, and regular changes, plus 12+ password history, one password per user account, and two admin accounts with elevated access.

Use authentication mechanisms to prove identity before granting access. Rely on strong passwords, tokens, cards, or biometrics together with encryption to protect confidentiality and integrity in storage and transmission.

After identification and authentication, this lecture shows building a token that represents your groups and access. It covers dynamic authorization, accounting, and radius and tacacs services.

Protect data at rest, in transit, and in use, including hard copies, with drive encryption and permissions for storage, IP sets and VPN for transit, and shredding for disposal.

Audit and monitor LAN security by keeping logs, tracking incidents, and reassessing the security model to mitigate network risks with effective, coordinated controls.

Explore client-server security in distributed systems, covering cloud and local access, USB and optical media controls, site surveys for rogue access points, and strong authentication to defend all risk points.

Firewalls regulate access between trusted zones, from packet filtering to stateful and application firewalls, with unified threat management and tradeoffs in performance and fault tolerance.

Compare intrusion detection systems and intrusion prevention systems, showing how IDS passively detects intrusions while IPS actively blocks attacks, requiring monitoring and fine tuning.

Deploy honeypots as decoys that look attractive yet plausible, lure attackers, detect intrusions early, deflect them away, and pull resources behind the wall before threats escalate.

Explore encryption in depth within technology systems auditing, covering encryption types, modalities, and the minutia auditors must know to ensure protective functions in systems.

Encryption preserves confidentiality and integrity, supports authentication and anti-replay protection, protects data at rest and in use, but does not address availability.

Learn how encryption mechanisms fit various scenarios, using confidentiality algorithms, data integrity via hashing such as MD5 and SHA-1/2, and authentication through RSA digital signatures to verify origin.

Compare symmetric and asymmetric encryption, noting symmetric uses a shared key and asymmetric uses public and private keys. Emphasize key distribution, performance trade-offs, and RSA/DES in practice.

Explore auditing practices and learn how these methods fit into the broader technology systems auditing framework, highlighting essential tools and considerations for effective audits.

Choose an auditing framework and review administrative, physical, and technical controls, ensuring training, access governance, documentation, and employee lifecycle are audited in line with legal and regulatory requirements.

Audit logical access to identify risks and assess controls that protect data. Leverage existing expertise and familiarize with the environment to audit information systems effectively.

Conduct penetration testing by using attacker tools with client permission to uncover system weaknesses and report remedial recommendations. Explore black box, white box, and gray box approaches.

Begin penetration testing by aligning with client needs and regulatory constraints, then review three key methodologies emphasized in the course, noting that more exist.

Apply a structured computer forensics process to uncover and gather evidence from data storage and memory, distinguishing courtroom standards from internal investigations.

Review security controls to protect data from compromise, examining encryption, access controls, threats, and system stability. Assess auditing practices, pen testing, and forensics to detect, remediate, and prove cyber incidents.