Preparation  for Audits is Critical

All auditors know that preparation and planning for an audit is essential to running a smooth audit. It's also essential for the client to prepare because they are always asked for information, data and reports that they need to dig up and that are sometimes hard to get. A little planning can make things easier for both auditor and client.

The auditor can help with the client's planning activities. While its true that the client should know, after a couple of audits, what the auditor will want, nevertheless it is a sad fact of life that they don't always keep track of it and so every audit becomes a scramble to answer the auditors' requests.

Therefore the auditors need to provide the client with advance notice of their needs. While this is fundamental, it is sometimes overlooked, and especially in IT audits, can lead to frustrating delays in the audit and frustration for all involved. For more on this topic, click here.

Cyber War

There's a new role for IS Auditors - Helping to prevent a global cyber war. it's no secret that hacker organizations and cyber terrorists have gone global and that countries are increasingly vulnerable to attacks that could disable many of their key infrastructure elements, like transportation, media, etc.

This is a risk that needs to be addressed and is being addressed by major departments and organizations responsible for national security. Many of the traditional techniques of IS Auditors, such as risk and threat analysis are fundamental to implementing the necessary preventative measures. Check out the linked set of articles, and in particular the security video at the bottom of the linked page.

The ISACA Knowledge Center

ISACA has a Knowledge Center on its website of which some who are involved in IS Assurance may not be aware. Here is the link. The Knowledge Center contains a wealth of information about over 100 topics that can be searched on the site. It also enables members to discuss with other members such topics, their experiences and IS Assurance generally. it's a useful resource for IS Assurance Professionals.

The Internet Fraud Alert Center


"Microsoft has spearheaded the formation of the Internet Fraud Alert center, to be managed by the National Cyber-Forensics & Training Alliance. The coalition aims to combat cybercrime, malware, fraud and the misuse of personal data. The data-protection group will serve as a specific process for reporting discoveries of stolen data caches." See this website for more.

		ISACA's Virtual Seminar and Tradeshow is Tomorrow
		Time is running out to register for ISACA's Vrtual Seminar and Tradeshow:  Building a Better GRC Program.   When: TOMORROW (Tuesday, 22 June 2010), 9:00am – 4:00pm (EDT) (13:00 GMT) Where:  Your computer Register now! Learn how to get the most out of your GRC strategy by aligning business and corporate governance of IT, and earn up to 4 CPE hours by attending this FREE educational event. At this online, all-day event you can participate in educational sessions presented by knowledgeable speakers. Plus, you can explore the exhibit hall in between sessions where you can visit exhibitor booths, and interact with sponsors, other ISACA members, and ISACA staff. Click here for tips on registering, checking your system, and to contact support.
		Register Now	Share Via:

Reporting Lost Credit Cards

When credit card numbers are lost or compromised, there needs to be a way to report them to banks and outlets so they won't be used illegally. In the past, a program called Cardcops has been used for this purpose.

Microsoft is now promoting the use of a new program, which it hopes will be successful because of its speed in reporting, which is often important in cases of fraud. See this write-up on the new program.

Cloud Security - A New Approach to Risk Management

The advent of cloud computing has caused security professionals to revisit their risk assessment profiles. There is more risk, this is clear, and therefore there needs to be a closer evaluation of which risks are acceptable and which are not. That;s one difference caused by the cloud.

But it runs a lot deeper than that. Cloud computing means that the enterprises are outsourcing the basic infrastructure to an outside party, therefore they no longer control the infrastructure. Many of the traditional security measures focus on the infrastructure. Also, the ability of the user enterprise to test the system is often limited.

This new environment means that there must be more attention paid to the applications being used. Which in turn means the security professionals need to have a greater understanding of their business and how those needs translate into applications deployment.

This is a challenging arena, and many of the answers are being worked out. Recently, at the RSA Conference in San Francisco, a panel addressed these issues. A transcript and podcast of the discussion can be found on this website.