Accounting Information
Systems
CHAPTER 8
INFORMATION SYSTEM CONTROLS for SYSTEMS RELIABILITY
Part 1: Information Security
SUGGESTED ANSWERS TO DISCUSSION QUESTIONS
8.1 Explain why an organization would want to use all of the following information
security controls: firewalls, intrusion prevention systems, intrusion detection
systems, and a CIRT.
Using this combination of controls provides defense-in-depth. Firewalls and intrusion
prevention systems are preventive controls. Intrusion detection systems are used to
identify problems and incidents. The purpose of a Computer Incident Response Team
(CIRT) is to respond to and mediate problems and incidents. According to the time-based
model of security, information security is adequate if the firewalls and intrusion
prevention systems can delay attacks from succeeding longer than the time it takes the
intrusion detection system to identify that an attack is in progress and for the CIRT to
respond.
8.2 What are the advantages and disadvantages of having the person responsible for
information security report directly to the chief information officer (CIO), who has
overall responsibility for all aspects of the organization’s information systems?
It is important for the person responsible for security (the CISO) to report to senior
management. Having the person responsible for information security report to a member
of the executive committee such as the CIO, formalizes information security as a top
management issue.
One potential disadvantage is that the CIO may not always react favorably to reports
indicating that shortcuts have been taken with regard to security, especially in situations
where following the recommendations for increased security spending could result in
failure to meet budgeted goals. Therefore, just as the effectiveness of the internal audit
function is improved by having it report to someone other than the CFO, the security
function may also be more effective if it reports to someone who does not have
responsibility for information systems operations.
8-1
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Ch. 8: Information System Controls for Systems Reliability
8.3 Reliability is often included in service level agreements (SLAs) when outsourcing.
The toughest thing is to decide how much reliability is enough. Consider an
application like e-mail. If an organization outsources its e-mail to a cloud provider,
what is the difference between 95%, 99%, 99.99%, and 99.9999% reliability?
The differences in promised reliability levels over the course of a year in terms of days
when the e-mail system may not work are:
95% reliability = 18.25 days
99% reliability = 3.65 days
99.99% reliability = .0365 days or approximately 52.56 minutes
99.9999% reliability = .000365 days or less than one minute
8.4 What is the difference between authentication and authorization?
Authentication and authorization are two related controls designed to restrict access to an
organization’s information systems and resources.
The objective of authentication is to verify the claimed identity of someone attempting to
obtain access.
The objective of authorization is to limit what an authenticated user can do once they
have been given access.
8.5 What are the limitations, if any, of relying on the results of penetration tests to
assess the overall level of security?
Penetration testing provides a rigorous way to test the effectiveness of an organization’s
computer security by attempting to break into the organization’s information system.
Internal audit and external security consulting team perform penetration tests in which
they try to compromise a company’s system. Some outside consultants claim that they
can get into 90 percent or more of the companies they attack. This is not surprising, given
that it is impossible to achieve 100% security. Thus, one limitation of penetration testing
is that it almost always shows that there are ways to break into the system.
The more important analysis, however, is evaluating how difficult it was to break in and
the cost-effectiveness of alternative methods for increasing that level of difficulty.
Another limitation is that failure to break in may be due to lack of skill by the tester.
Finally, penetration testing typically focuses on unauthorized access by outsiders; thus, it
does not test for security breaches from internal sources.
8-2
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Accounting Information
Systems
8.6 Security awareness training is necessary to teach employees “safe computing”
practices. The key to effectiveness, however, is that it changes employee behavior.
How can organizations maximize the effectiveness of their security awareness
training programs?
Top management support is always essential for the success of any program an entity
undertakes. Thus, top management support and participation in security awareness
training is essential to maximize its impact on the employees and managers of the firm.
Effective instruction and hands-on active learning techniques help to maximize training.
“Real life” example should be used throughout the training so that employees can view or
at least visualize the exposures and threats they face as well as the controls in place to
address the exposures and threats. Role-playing has been shown to be an effective
method to maximize security awareness training especially with regard to social
engineering attack training.
Training must also be repeated periodically, at least several times each year, to reinforce
concepts and update employees about new threats.
It is also important to test the effectiveness of such training.
Including security practices and behaviors as part of an employee’s performance
evaluation is also helpful as it reinforces the importance of security.
8.7 What is the relationship between COSO, COBIT, and the AICPA’s Trust Services
frameworks?
COSO is a broad framework that describes the various components of internal control. It
does not, however, provide any details about IT controls.
COBIT is a framework for IT governance and control.
The AICPA’s Trust Services framework is narrower in scope than COBIT, focusing only
on those IT controls (security, confidentiality, privacy, processing integrity, and
availability) that relate directly to systems reliability.
8-3
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Accounting Information
Systems
SUGGESTED SOLUTIONS TO THE PROBLEMS
8.1 Match the following terms with their definitions:
Term Definition
__d__ 1. Vulnerability a. Code that corrects a flaw in a program.
__s__ 2. Exploit b. Verification of claimed identity.
__b__ 3. Authentication c. The firewall technique that filters
traffic by comparing the information in
packet headers to a table of established
connections.
__m__ 4. Authorization d. A flaw or weakness in a program.
__f__ 5. Demilitarized zone (DMZ) e. A test to determine the time it takes to
compromise a system.
__t__ 6. Deep packet inspection f. A subnetwork that is accessible from
the Internet but separate from the
organization’s internal network.
__o__ 7. router g. The device that connects the
organization to the Internet.
__j__ 8. social engineering h. The rules (protocol) that govern routing
of packets across networks.
__k__ 9. firewall i. The rules (protocol) that govern the
division of a large file into packets and
subsequent reassembly of the file from
those packets.
__n__ 10. hardening j. An attack that involves deception to
obtain access.
__l__ 11. CIRT k. A device that provides perimeter
security by filtering packets.
__a__ 12. patch l. The set of employees assigned
responsibility for resolving problems
and incidents.
___u_ 13. virtualization m. Restricting the actions that a user is
permitted to perform.
__i__ 14. Transmission Control
Protocol (TCP)
n. Improving security by removal or
disabling of unnecessary programs and
features.
8-4
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Accounting Information
Systems
_q___ 15. static packet filtering o. A device that uses the Internet Protocol
(IP) to send packets across networks.
__g__ 16. border router p. A detective control that identifies
weaknesses in devices or software.
__p__ 17. vulnerability scan q. A firewall technique that filters traffic
by examining the packet header of a
single packet in isolation.
__e__ 18. penetration test r. The process of applying code supplied
by a vendor to fix a problem in that
vendor’s software.
_r___ s. patch management
s. Software code that can be used to take
advantage of a flaw and compromise a
system.
_v___ t. cloud computing
t. A firewall technique that filters traffic
by examining not just packet header
information but also the contents of a
packet.
u. The process of running multiple
machines on one physical server.
v. An arrangement whereby a user
remotely accesses software, hardware,
or other resources via a browser.
8.2 Install and run the latest version of the Microsoft
Baseline Security Analyzer on your home computer or laptop. Write a report
explaining the weaknesses identified by the tool and how to best correct them.
Attach a copy of the MBSA output to your report.
Solution: will vary for each student. Examples of what to expect (from a computer
running Windows 7 follow:
8-5
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Accounting Information
Systems
1. The first section should identify the computer (not shown below) and the status of
security updates:
8-6
© 2010 Pearson Education, Inc. Publishing as Prentice Hall
Accounting Information
Systems
2. Next is a section about user accounts and Windows settings:
