Chapter 16 Controlling Computer-Based Information Systems Part II

Chapter 16 Controlling Computer-Based Information Systems, Part II

Organizational Structure Internet & Intranet Operating System Data Management Internet & Intranet Systems Development EDI Trading Partners Systems Maintenance Personal Computers Applications Computer Center Security General Control Framework for CBIS Risks

Internet and Intranet Risks from Subversive Threats • These acts include: – unauthorized interception of a message – gaining unauthorized access to an organization’s network – a denial-of-service attack from a remote location

Dual-Homed Firewall

Controlling Risks from Subversive Threats • Denial-of-service (DOS) attacks – Security software searches for connections which have been half-open for a period of time. • Encryption – Computer program transforms a clear message into a coded (cipher) text form using an algorithm.

Controlling Risks from Subversive Threats • Encryption – A computer program transforms a clear message into a coded (ciphertext) form using an algorithm. – Encryption can be used for transmitted data and for stored data.

Data Encryption Standard Technique Key Cleartext Message Encryption Program Key Ciphertext Communication System

Public and Private Key Encryption Message A Message B Message C Multiple people may have the public key (e. g. , subordinates). Ciphertext Public Key is used for encoding messages. Ciphertext Typically one person or a small number of people have the private key (e. g. , a supervisor). Message A Message D Ciphertext Private Key is used for decoding messages. Message B Message C Message D

Controlling Risks from Subversive Threats • Digital signature: electronic authentication technique that ensures that the transmitted message originated with the authorized sender and that it was not tampered with after the signature was applied • Digital certificate: like an electronic identification card that is used in conjunction with a public key encryption system to verify the authenticity of the message sender

Electronic Data Interchange (EDI) Risks • Authorization – automated and absence of human intervention • Access – need to access EDI partner’s files • Audit trail – paperless and transparent (automatic) transactions

Electronic Data Interchange (EDI) Controls • Authorization – use of passwords and VANs to ensure valid partner • Access – software to specify what can be accessed and at what level • Audit trail – control log records the transaction’s flow through each phase of the transaction processing

EDI System without Controls Company A Company B (Vendor) Sales Order System Application Purchases Software System EDI Translation Software Direct Connection Communications Software Application Software

EDI System with Controls Company B (Vendor) Company A Application Purchases Software System EDI Translation Software Communications Software limits vendor’s (Company B) Company A’s mailbox access to company A’s database Audit trail of transactions between trading partners Transaction Log Sales Order System Application Software EDI Translation Software Communications Software Other Mailbox VAN Other Mailbox Company B’s mailbox Use of VAN to enforce use of passwords and valid partners

Personal Computer (PC) Controls • PCs… – are relatively simple to use – are frequently controlled and used by end users – usually employ interactive (v. batch) data processing – typically run commercial software applications – allow users to develop their own applications • PCs, in contrast to servers and mainframes, have weak operating systems. – makes them easy to use – but results in minimal security and weak controls

Access Risks in the PC Environment • PCs typically weak in controlling access data files • Techniques to prevent theft or tampering of data: – data encryption - must decode even if stolen – disk locks - software or physical locks to prevent booting from A:

Inadequate Segregation of Duties • In PC environments, employees often have access to multiple applications that process incompatible transactions. • Controls: – increased supervision – detailed management reports – more frequent independent verification

PC Backup Controls • PC end-users often fail to appreciate the importance of backup procedures until it is too late. • Back up mechanisms: – tape--high capacity (3. 2 gb, inexpensive) – CD--about 650 mb (>450 floppies) – dual internal hard drives (high capacity) – dual external hard drives (>12 gb) – USB memory attachments (portable, >64 mb)

Application Controls • Narrowly focused exposures within a specific system, for example: – – – – accounts payable cash disbursements fixed asset accounting payroll sales order processing cash receipts general ledger

Application Controls • Risks within specific applications • Can affect manual procedures (e. g. , entering data) or embedded procedures • Convenient to look at in terms of: – input stage – processing stage – output stage INPUT PROCESSING OUTPUT

Application Controls Input • Goal of input controls - inputted data are valid, accurate, and complete • Source document controls – use prenumbered source documents – auditing missing source documents • Data coding controls – transcription errors – check digits GIGO

Application Controls Input • Batch controls - used to reconcile the output produced by the system with the input originally entered into the system • Based on different types of batch totals: – total number of records – total dollar value – hash totals - sum of non-financial numbers

Application Controls Input • Validation controls - intended to detect errors in transaction data before the data are processed – field interrogation - data in individual fields; for example, missing data, data type, range – record interrogation - interrelationship of data in fields of a record – file interrogation - the correct file; for example, internal and external labels compared, version, dates

Transaction Log to Preserve the Audit Trail

Application Controls Output • Goal of output controls is to ensure that system output is not lost, misdirected, or corrupted, and that privacy is not violated. • In the following flowchart, there are exposures at every stage.