it audit methodologies it audit methodoloies. it audit methodologies cobit bs 7799 - code of...

IT Audit Methodologies

IT Audit Methodoloies

IT Audit MethodologiesCobiTBS 7799 - Code of Practice (CoP)BSI - IT Baseline Protection ManualITSECCommon Criteria (CC)


IT Audit Methodologies - URLsCobiT: www.isaca.orgBS7799: www.bsi.org.uk/disc/BSI: www.bsi.bund.de/gshb/english/menue.htmITSEC:www.itsec.gov.ukCC: csrc.nist.gov/cc/


Main Areas of UseIT AuditsRisk AnalysisHealth Checks (Security Benchmarking)Security ConceptsSecurity Manuals / Handbooks


Security DefinitionConfidentialityIntegrity

CorrectnessCompleteness

Availability


CobiTGovernance, Control & Audit for ITDeveloped by ISACAReleases

CobiT 1: 199632 Processes271 Control Objectives

CobiT 2: 199834 Processes302 Control Objectives


CobiT - Model for IT Governance36 Control models used as basis:

Business control models (e.g. COSO)IT control models (e.g. DTI‘s CoP)

CobiT control model covers:Security (Confidentiality, Integrity, Availability)Fiduciary (Effectiveness, Efficiency, Compliance,

Reliability of Information)IT Resources (Data, Application Systems,

Technology, Facilities, People)


CobiT - Framework


CobiT - Structure4 Domains

PO - Planning & Organisation11 processes (high-level control objectives)

AI - Acquisition & Implementation6 processes (high-level control objectives)

DS - Delivery & Support13 processes (high-level control objectives)

M - Monitoring4 processes (high-level control objectives)


PO - Planning and Organisation PO 1 Define a Strategic IT Plan PO 2 Define the Information Architecture PO 3 Determine the Technological Direction PO 4 Define the IT Organisation and Relationships PO 5 Manage the IT Investment PO 6 Communicate Management Aims and Direction PO 7 Manage Human Resources PO 8 Ensure Compliance with External Requirements PO 9 Assess Risks PO 10 Manage Projects PO 11 Manage Quality


AI - Acquisition and ImplementationAI 1 Identify SolutionsAI 2 Acquire and Maintain Application SoftwareAI 3 Acquire and Maintain Technology ArchitectureAI 4 Develop and Maintain IT ProceduresAI 5 Install and Accredit SystemsAI 6 Manage Changes


DS - Delivery and Support DS 1 Define Service Levels DS 2 Manage Third-Party

Services DS 3 Manage Performance and

Capacity DS 4 Ensure Continuous Service DS 5 Ensure Systems Security DS 6 Identify and Attribute Costs DS 7 Educate and Train Users


DS 8 Assist and Advise IT

Customers

DS 9 Manage the Configuration

DS 10 Manage Problems and

Incidents

DS 11 Manage Data

DS 12 Manage Facilities

DS 13 Manage Operations

M - MonitoringM 1 Monitor the ProcessesM 2 Assess Internal Control AdequacyM 3 Obtain Independent AssuranceM 4 Provide for Independent Audit


CobiT - IT Process MatrixInformation Criteria

EffectivenessEfficiencyConfidentialit

yIntegrityAvailabilityComplianceReliability


IT Resources People Applications Technology Facilities Data

IT Processes

Microsoft Excel-Tabelle

CobiT - SummaryMainly used for IT audits, incl. security aspectsNo detailed evaluation methodology describedDeveloped by international organisation (ISACA)Up-to-date: Version 2 released in 1998Only high-level control objectives describedDetailed IT control measures are not documentedNot very user friendly - learning curve!Evaluation results not shown in graphic form


CobiT - SummaryMay be used for self assessmentsUseful aid in implementing IT control systemsNo suitable basis to write security handbooksCobiT package from ISACA: $ 100.--3 parts freely downloadable from ISACA siteSoftware available from Methodware Ltd., NZ

(www.methodware.co.nz)

CobiT Advisor 2nd edition: US$ 600.--


BS 7799 - CoPCode of Practice for Inform. Security Manag.Developed by UK DTI, BSI: British StandardReleases

CoP: 1993BS 7799: Part 1: 1995BS 7799: Part 2: 1998

Certification & Accreditation scheme (c:cure)


BS 7799 - Security Baseline Controls10 control categories32 control groups109 security controls10 security key controls


BS 7799 - Control CategoriesInformation security policySecurity organisationAssets classification & controlPersonnel securityPhysical & environmental securityComputer & network management


BS 7799 - Control CategoriesSystem access controlSystems development & maintenanceBusiness continuity planningCompliance


BS7799 - 10 Key ControlsInformation security policy documentAllocation of information security responsibilitiesInformation security education and trainingReporting of security incidentsVirus controls


BS7799 - 10 Key ControlsBusiness continuity planning processControl of proprietary software copyingSafeguarding of organizational recordsData protectionCompliance with security policy


BS7799 - SummaryMain use: Security Concepts & Health ChecksNo evaluation methodology describedBritish Standard, developed by UK DTICertification scheme in place (c:cure)BS7799, Part1, 1995 is being revised in 1999Lists 109 ready-to-use security controlsNo detailed security measures describedVery user friendly - easy to learn


BS7799 - SummaryEvaluation results not shown in graphic formMay be used for self assessmentsBS7799, Part1: £ 94.--BS7799, Part2: £ 36.--BSI Electronic book of Part 1: £ 190.-- + VATSeveral BS7799 c:cure publications from BSICoP-iT software from SMH, UK: £349+VAT

(www.smhplc.com)


BSI (Bundesamt für Sicherheit in der Informationstechnik)IT Baseline Protection Manual

(IT- Grundschutzhandbuch )Developed by German BSI (GISA: German

Information Security Agency)Releases:

IT security manual: 1992IT baseline protection manual: 1995New versions (paper and CD-ROM): each year


BSI - Approach


BSI - ApproachUsed to determine IT security measures for

medium-level protection requirementsStraight forward approach since detailed risk

analysis is not performedBased on generic & platform specific security

requirements detailed protection measures are constructed using given building blocks

List of assembled security measures may be used to establish or enhance baseline protection


BSI - StructureIT security measures

7 areas34 modules (building blocks)

Safeguards catalogue6 categories of security measures

Threats catalogue5 categories of threats


BSI - Security Measures (Modules)Protection for generic componentsInfrastructureNon-networked systemsLANsData transfer systemsTelecommunicationsOther IT components


BSI - Generic Components3.1 Organisation

3.2 Personnel

3.3 Contingency Planning

3.4 Data Protection


BSI - Infrastructure4.1 Buildings

4.2 Cabling

4.3 Rooms

4.3.1 Office

4.3.2 Server Room

4.3.3 Storage Media Archives

4.3.4 Technical Infrastructure Room

4.4 Protective cabinets

4.5 Home working place


BSI - Non-Networked Systems5.1 DOS PC (Single User)

5.2 UNIX System

5.3 Laptop

5.4 DOS PC (multiuser)

5.5 Non-networked Windows NT computer

5.6 PC with Windows 95

5.99 Stand-alone IT systems


BSI - LANs6.1 Server-Based Network

6.2 Networked Unix Systems

6.3 Peer-to-Peer Network

6.4 Windows NT network

6.5 Novell Netware 3.x

6.6 Novell Netware version 4.x

6.7 Heterogeneous networks


BSI - Data Transfer Systems7.1 Data Carrier Exchange

7.2 Modem

7.3 Firewall

7.4 E-mail


BSI - Telecommunications8.1 Telecommunication system

8.2 Fax Machine

8.3 Telephone Answering Machine

8.4 LAN integration of an IT system via ISDN


BSI - Other IT Components9.1 Standard Software

9.2 Databases

9.3 Telecommuting


BSI - Module „Data Protection“ (3.4)Threats -Technical failure:

T 4.13 Loss of stored dataSecurity Measures - Contingency planning:

S 6.36 Stipulating a minimum data protection conceptS 6.37 Documenting data protection proceduresS 6.33 Development of a data protection concept

(optional)S 6.34 Determining the factors influencing data

protection (optional)S 6.35 Stipulating data protection procedures (optional)S 6.41 Training data reconstruction

Security Measures - Organisation:S 2.41 Employees' commitment to data protectionS 2.137 Procurement of a suitable data backup systemIT Audit Methodoloies

BSI - Safeguards (420 safeguards)S1 - Infrastructure ( 45 safeguards)S2 - Organisation (153 safeguards)S3 - Personnel ( 22 safeguards)S4 - Hardware & Software ( 83 safeguards)S5 - Communications ( 62 safeguards)S6 - Contingency Planning ( 55 safeguards)


BSI - S1-Infrastructure (45 safeguards)S 1.7 Hand-held fire extinguishers

S 1.10 Use of safety doors

S 1.17 Entrance control service

S 1.18 Intruder and fire detection devices

S 1.27 Air conditioning

S 1.28 Local uninterruptible power supply [UPS]

S 1.36 Safekeeping of data carriers before and after dispatch


BSI - Security Threats (209 threats)T1 - Force Majeure (10 threats)T2 - Organisational Shortcomings (58 threats)T3 - Human Errors (31 threats)T4 - Technical Failure (32 threats)T5 - Deliberate acts (78 threats)


BSI - T3-Human Errors (31 threats)T 3.1 Loss of data confidentiality/integrity as a result of

IT user error

T 3.3 Non-compliance with IT security measures

T 3.6 Threat posed by cleaning staff or outside staff

T 3.9 Incorrect management of the IT system

T 3.12 Loss of storage media during transfer

T 3.16 Incorrect administration of site and data access rights

T 3.24 Inadvertent manipulation of data

T 3.25 Negligent deletion of objectsIT Audit Methodoloies

BSI - SummaryMain use: Security concepts & manualsNo evaluation methodology describedDeveloped by German BSI (GISA)Updated version released each yearLists 209 threats & 420 security measures34 modules cover generic & platform specific

security requirements


BSI - SummaryUser friendly with a lot of security detailsNot suitable for security risk analysisResults of security coverage not shown in graphic

formManual in HTML format on BSI web serverManual in Winword format on CD-ROM

(first CD free, additional CDs cost DM 50.-- each)

Paper copy of manual: DM 118.--

Software ‚BSI Tool‘ (only in German): DM 515.--


ITSEC, Common CriteriaITSEC: IT Security Evaluation CriteriaDeveloped by UK, Germany, France, Netherl. and

based primarily on USA TCSEC (Orange Book)

ReleasesITSEC: 1991ITSEM: 1993 (IT Security Evaluation Manual)UK IT Security Evaluation & Certification scheme:

1994


ITSEC, Common CriteriaCommon Criteria (CC)Developed by USA, EC: based on ITSECISO International StandardReleases

CC 1.0: 1996CC 2.0: 1998ISO IS 15408: 1999


ITSEC - MethodologyBased on systematic, documented approach for

security evaluations of systems & productsOpen ended with regard to defined set of security

objectivesITSEC Functionality classes; e.g. FC-C2CC protection profiles

Evaluation steps:Definition of functionalityAssurance: confidence in functionality


ITSEC - FunctionalitySecurity objectives (Why)

Risk analysis (Threats, Countermeasures)Security policy

Security enforcing functions (What)technical & non-technical

Security mechanisms (How)Evaluation levels


ITSEC - AssuranceGoal: Confidence in functions & mechanismsCorrectness

Construction (development process & environment)Operation (process & environment)

EffectivenessSuitability analysisStrength of mechanism analysisVulnerabilities (construction & operation)


CC - Security Concept


CC - Evaluation Goal


CC - Documentation


CC Part 1Introduction and Model Introduction to

Approach

Terms and Model

Requirements forProtection Profiles (PP)and Security Targets (ST)

CC Part 2Functional Requirements

Functional Classes

Functional Families

FunctionalComponents

Detailed Requirements

CC Part 3Assurance Requirements

Assurance Classes

Assurance Families

Assurance Components

Detailed Requirements

Evaluation AssuranceLevels (EAL)

CC - Security Requirements


Functional Requirements

for defining security behavior of the IT product or system:

implemented requirements become security functions

Assurance Requirements

for establishing confidence in Security Functions:

correctness of implementation effectiveness in satisfying

objectives

CC - Security Functional Classes


NameAuditCommunicationsCryptographic SupportUser Data ProtectionIdentification & AuthenticationSecurity ManagementPrivacyProtection of TOE Security FunctionsResource UtilizationTOE (Target Of Evaluation) AccessTrusted Path / Channels

ClassFAUFCOFCSFDPFIAFMTFPRFPTFRUFTAFTP

CC - Security Assurance Classes


NameConfiguration Management

Delivery & OperationDevelopmentGuidance DocumentsLife Cycle SupportTestsVulnerability AssessmentProtection Profile EvaluationSecurity Target EvaluationMaintenance of Assurance

ClassACMADOADVAGDALCATEAVAAPEASEAMA

CC - Eval. Assurance Levels (EALs)

IT Audit Methodoloies*TCSEC = “Trusted Computer Security Evaluation Criteria” --”Orange Book”

NameFunctionally TestedStructurally TestedMethodically Tested & CheckedMethodically Designed, Tested & ReviewedSemiformally Designed & TestedSemiformally Verified Design & TestedFormally Verified Design & Tested

EALEAL1EAL2EAL3EAL4EAL5EAL6EAL7

*TCSEC

C1C2B1B2B3A1

ITSEC, CC - SummaryUsed primarily for security evaluations and not for

generalized IT audits Defines evaluation methodologyBased on International Standard (ISO 15408)Certification scheme in placeUpdated & enhanced on a yearly basisIncludes extensible standard sets of security

requirements (Protection Profile libraries)


Comparison of Methods - CriteriaStandardisationIndependenceCertifiabilityApplicability in practiceAdaptability


Comparison of Methods - CriteriaExtent of ScopePresentation of ResultsEfficiencyUpdate frequencyEase of Use


Comparison of Methods - Results


CobiT3.43.32.72.83.33.11.93.03.12.3

StandardisationIndependenceCertifyabilityApplicability in practiceAdaptabilityExtent of ScopePresentation of ResultsEfficiencyUpdate frequencyEase of Use

BS 77993.33.63.33.02.82.92.22.82.42.7

BSI3.13.53.03.13.32.72.63.03.42.8

ITSEC/CC

3.93.93.72.53.02.61.72.52.82.0

Scores between 1 (low) and 4 (high) - Scores for CobiT, BS7799, BSI from ISACA Swiss chapter; score for ITSEC/CC form H.P. Winiger

CobiT - Assessment


BS 7799 - Assessment


BSI - Assessment


ITSEC/CC - Assessment


Use of Methods for IT AuditsCobiT: Audit method for all IT processesITSEC, CC: Systematic approach for evaluationsBS7799, BSI: List of detailed security measures to

be used as best practice documentationDetailed audit plans, checklists, tools for technical

audits (operating systems, LANs, etc.)What is needed in addition:

Audit concept (general aspects, infrastructure audits, application audits)
