版權(quán)說明：本文檔由用戶提供并上傳，收益歸屬內(nèi)容提供方，若內(nèi)容存在侵權(quán)，請進行舉報或認領(lǐng)
文檔簡介
Informationsystemsauditing2015YingQianContentITbasicsInternetandwebtechnologyInformationTechnologyBasicsThemostbasicformofinformationtechnologyInputProcessOutput
IPOInputKeyboardSensorOutputFileReportProcessingprogramsPersonalComputer’sIPOInput:KeyboardMouseTouchscreenDiskdriverOutputTouchscreenDiskdriverPrinterProcessing:CPUMotherboardRAMROMMemoryRequirementofISConfidentialitywhohasaccesstothehardware,logicalorphysical?
WhohasaccesstothedataandIntegrityWhocanmakechangestothedata?
Who’sreviewingthosechangestothedatatoseeifthechangewasauthorized?
Availabilitydataand/orsystemisavailablewhenitisneededITauditor’sconcernoverhardwareDoesthevendorstillsupportthehardwareorhasitreachedEOL(end-of-life)andisunsupported?Ifitbreaksitcan’tbefixedThehardwarehasBIOS(BasicInputOutputSystem)whichisbeingupdatedbythevendor,typicallytosupportnewfunctionsand/orfeatures.
IstheBIOScurrent,andistheBIOSprotected?”
Whydoyouaskifitisprotected?
ITauditor’sconcernoversoftwareProtectedfrommaliciousmischief.Unauthorizedsoftwarechangelackofchangemanagementlackofreconciliation(waitaminutethat’sthefinancialauditorsjob)separationofdutiesITauditor’sconcernoverdistributedsystemandc/stechnologyHowtoensureconfidentialityofthedatawhenthedataistransmitted?
Howdoyouensureintegrityofthedatabeingtransmittedhowtomakesurethelocalsystemisavailableifthehomeofficesystemgoesdown?
ITauditor’sconcernoverremoteaccessWasremoteaccessapproved?Isremoteaccessviaanencryptedcommunicationlink?Isthelaptopprotected(keylock,harddiskencryption)?Isthereascreensaverandisitpasswordprotected?Istwo-factorauthenticationrequiredtoaccessthenetwork?Isnetworkaccessrestrictedfromknownlocations?Ifmodemsareusediscall-backemployed?ITsystemmaintenanceArethesystemsbeingmaintainedandarepatchesbeingappliedinatimelymanner?
Whatisthesecuritythatsurroundssystemmaintenance?Cananyoneupdatetheanti-virusdefinitionfile?
Whocheckstoseeifthisisdone,assumingthattheend-useristheoneresponsibleforupdatingthe.datfile?
Themostbasicandfundamentalquestionofall,“DoallandIrepeatALLchangesgothroughchangemanagement?”InternetandWebTechnologyDMZnetworkaDMZordemilitarizedzone(sometimesreferredtoasaperimeternetwork)isaphysicalorlogicalsubnetworkthatcontainsandexposesanorganization'sexternal-facingservicestoalargeranduntrustednetwork,usuallytheInternet.ThepurposeofaDMZistoaddanadditionallayerofsecuritytoanorganization'slocalareanetwork(LAN);anexternalnetworknodeonlyhasdirectaccesstoequipmentintheDMZ,ratherthananyotherpartofthenetwork.Thenameisderivedfromtheterm"demilitarizedzone",anareabetweennationstatesinwhichmilitaryoperationisnotpermitted.ServicesintheDMZWebserversMailserversFTPserversVoIPserversProxyserverwithintheDMZCompliancewithlegalstandardsandmonitoringreasons,someenterprisesinstallaproxyserverwithintheDMZ.Obligesinternalusers(usuallyemployees)tousetheproxyserverforInternetaccess.ReducedInternetaccessbandwidthrequirementssincesomewebcontentmaybecachedbytheproxyserver.Simplifiesrecordingandmonitoringofuseractivities.Centralizedwebcontentfiltering.RelatedrisksIncorrectrouter/firewallconfigurations(notaccordingtoorganizationspecifications)Inadequateconfigurations(donotworkasdesigned)Abilityforremoteuserstobypasstheborderrouterandfirewallandgetdirectaccesstothedatabaseserver(e.g.viaamodeminstalledforsupport)AbilitytospooftheinternalIPAddressandbypassthewebserverInternaluserswhohavemaliciousintentandbybeinginternaldonotgothroughthefirewalland/orborderrouterSystemadministratorshavingunlimiteddirectaccesstothedatabaseDevelopersnotbeingadequatelytrainedinsecurecodingtechniquesforwebapplicationdevelopmentinsiderabusesCollusionbetweenaninsiderandanoutsider(towit,I(outsider)placeanorderfor3new53”colorTVs,andmypartner(insider)goesinandadjuststheitempricefromseveralthousanddollarsto$0.33each.
WhentheorderisinvoicedIpay$0.99for3new53”colorTVs.Unauthorizedaccessbyinsider(maybeIchangethedeliverylocationtobemyapartment,in
溫馨提示
- 1. 本站所有資源如無特殊說明，都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請下載最新的WinRAR軟件解壓。
- 2. 本站的文檔不包含任何第三方提供的附件圖紙等，如果需要附件，請聯(lián)系上傳者。文件的所有權(quán)益歸上傳用戶所有。
- 3. 本站RAR壓縮包中若帶圖紙，網(wǎng)頁內(nèi)容里面會有圖紙預(yù)覽，若沒有圖紙預(yù)覽就沒有圖紙。
- 4. 未經(jīng)權(quán)益所有人同意不得將文件中的內(nèi)容挪作商業(yè)或盈利用途。
- 5. 人人文庫網(wǎng)僅提供信息存儲空間，僅對用戶上傳內(nèi)容的表現(xiàn)方式做保護處理，對用戶上傳分享的文檔內(nèi)容本身不做任何修改或編輯，并不能對任何下載內(nèi)容負責(zé)。
- 6. 下載文件中如有侵權(quán)或不適當(dāng)內(nèi)容，請與我們聯(lián)系，我們立即糾正。
- 7. 本站不保證下載資源的準(zhǔn)確性、安全性和完整性, 同時也不承擔(dān)用戶因使用這些下載資源對自己和他人造成任何形式的傷害或損失。
最新文檔
- 2025年海口貨運從業(yè)資格證模擬考試答案大全
- 2025還未簽訂勞動合同時遇糾紛可找仲裁
- 2025金融租賃資金信托合同
- 2025年貴港a2貨運從業(yè)資格證考試
- 上海視覺藝術(shù)學(xué)院《電分析化學(xué)》2023-2024學(xué)年第一學(xué)期期末試卷
- 上海師范大學(xué)天華學(xué)院《材料現(xiàn)代測試技術(shù)》2023-2024學(xué)年第一學(xué)期期末試卷
- 公司述職報告范文個人
- 課題申報書：供需匹配視角下數(shù)據(jù)要素協(xié)同優(yōu)化的機制與路徑研究
- 課題申報書：高職院?！半p師型”教師專業(yè)發(fā)展的制度環(huán)境優(yōu)化研究
- 課題申報書：輔導(dǎo)員對大學(xué)生高質(zhì)量就業(yè)的作用機制發(fā)揮研究-基于就業(yè)觀念塑造的視角
- 制度-xxxxx有限公司反商業(yè)賄賂管理制度
- 零基礎(chǔ)的住宅和城市設(shè)計智慧樹知到答案章節(jié)測試2023年同濟大學(xué)
- 2022年湖北省武漢市中考英語試卷及答案
- casio-5800p程序集錦（卡西歐5800編程計算機）
- 酒店安全整改報告
- 陳淑惠中文網(wǎng)絡(luò)成癮量表
- 先找財源還是先找人源財源源
- 黑布林英語 Can I play閱讀課件
- 《智能家居系統(tǒng)設(shè)計開題報告（含提綱）》
- GA/T 1175-2014軟件相似性檢驗技術(shù)方法
- 拒絕毒品珍愛生命
評論
0/150
提交評論