Information Asset Security and Control

Any data, system, network, and other communication structure that helps in achieving business goals is known as an information asset. Hence, securing an information asset is one of the key objectives of an organization.

The following topics will be covered in this chapter:

• Information asset security frameworks, standards, and guidelines
• Privacy principles
• Physical access and environmental controls
• Identity and access management
• Biometrics

By the end of this chapter, you will have learned how to keep intact any information assets’ confidentiality, integrity, and availability (CIA).

Information Asset Security Frameworks, Standards, and Guidelines

An information security framework is a set of documented policies, procedures, and processes that define how information is managed in an organization. There are two prime objectives of the framework:

• Lower risk and vulnerability
• Protect the enterprise by guarding the CIA of critical and sensitive information

Auditing the Information Security Management Framework

An IS auditor should consider the following aspects for auditing the information security management framework:

• Review the adequacy and approvals for various policies, procedures, and standards.
• Review security training and awareness programs and procedures. Determine the effectiveness of the program. It is advisable to interact with a few employees and evaluate their level of awareness.
• Determine whether proper ownership has been assigned for critical processes, systems, and data. The IS auditor should determine whether...

Privacy Principles

Privacy is the right of an individual to demand the utmost care of their personal information that has been shared with any organization or individual. Individuals can demand that the use of their information is appropriate, legal, and only for the specific purpose for which the information was obtained.

The Information Systems Audit and Control Association (ISACA) describes several privacy principles that can be considered as a framework for privacy audits. The following are some of them:

• Organizations should obtain appropriate consent before the transfer of personal information to another jurisdiction.
• Organizations should specify the purposes for which personal information is collected.
• Organizations are required to retain personal information only as long as necessary.
• Organizations should have appropriate security safeguards for protecting personal information.
• Organizations should have an appropriate process for reporting compliance...

Physical Access and Environmental Controls

Physical controls aim to protect information system processing facilities through physical mediums, such as locks, fences, closed-circuit TV (CCTV), and devices that are installed to physically restrict access to a facility or hardware.

Similarly, environmental controls refer to measures taken to protect systems, buildings, and related supporting infrastructure against threats associated with their physical environment. Physical and environmental safeguards are often overlooked but are very important in protecting information. You will go through each of them in more detail in the following sections.

Environmental Controls

An IS auditor should consider the following aspects of environmental controls.

The following are four types of power failure:

• Blackout: Blackout indicates a complete loss of power.
• Brownout: Severely reduced voltage, which may place strain on electronic equipment or may even lead to permanent damage...

Identity and Access Management

An IS auditor should review the logical access control of the organization with the prime objective of determining whether access is granted and controlled as per approved authorizations. As a CISA aspirant, you are expected to understand the concepts of identity and access management.

Logical access controls are a set of tools and protocols with the following objectives and purposes:

• Identification: Identification refers to the process of identifying a user or entity attempting to access a system, network, or resource. It involves providing a unique identifier or username to distinguish one individual from another. For example, when you enter your username or email address while logging into a website, you are providing identification information.
• Authentication: Authentication is the process of verifying the identity of a user or entity. It ensures that the person or entity claiming to be a particular user is indeed who they say they...

Biometrics

Biometric verification is a process through which a person can be uniquely identified and authenticated by verifying one or more of their biological features. Examples of these biometric identifiers include a palm print, hand geometry, fingerprints, retina and iris patterns, voice, and DNA.

Biometrics Accuracy Measure

The accuracy of a biometric system determines how well a system meets the objective. Accuracy measures determine the success factor of the biometric system. In this section, you will learn about a few biometrics accuracy measures.

False Acceptance Rate (FAR)

This is the rate of acceptance of a false person (that is, an unauthorized person). If biometrics allows access to an unauthorized person, then it is referred to as false acceptance.

False Rejection Rate (FRR)

This is the rate of rejection of the correct person (that is, an authorized person).

If biometrics does not allow access to an authorized person, then it is referred to as false...

Summary

In this chapter, you studied in detail the various frameworks and standards for information assets, different access control parameters, and biometrics-related risks and controls.

You learned about relevant skills to conduct an audit in accordance with the IS audit standards and a risk-based IS audit strategy, as well as evaluating potential opportunities and threats associated with emerging technologies, regulations, and industry practices.

The following are some important topics you covered in this chapter:

• Logical access controls are the most effective way to safeguard critical data within information processing facilities. Logical access controls are technical controls, such as authentication, encryption, firewalls, and IDSs, which are very difficult to bypass by a layperson.
• It is the responsibility of the appointed owner to ensure that their data and systems have appropriate security arrangements. System owners may delegate routine security responsibilities...

Chapter Review Questions

Before you proceed to Chapter 10, Network Security and Control, it is recommended that you solve the practice questions from this chapter first. These chapter review questions have been carefully crafted to reinforce the knowledge you have gained throughout this chapter. By engaging with these questions, you will solidify your understanding of key topics, identify areas that require further study, and build your confidence before moving on to new concepts in the next chapter.

Note

A few of the questions may not be directly related to the topics in the chapter. They aim to test your general understanding of information systems concepts instead.

The following image shows an example of the practice questions interface.

Figure 9.1: CISA practice questions interface

To access the end-of-chapter questions from this chapter, follow these steps:

1. Open your web browser and go to https://packt.link/y5nCV. You will see the...