IT risks and controls

Transcription

1 Università degli Studi di Roma "Tor Vergata" Master of Science in Business Administration Business Auditing Course IT risks and controls October 2017

2 Agenda I IT GOVERNANCE IT evolution, objectives, roles and process model of an IT governance framework II IT RISK MANAGEMENT Risk context, key elements of an IT Risk management framework, risk and measure examples III IT AUDIT CASE STUDY Approach, planning and results of a real IT audit activity IV NEW EU PRIVACY REGULATION RISK APPROACH The new regulation risk based approach and applicable risk scenario examples 2

3 Section I IT GOVERNANCE 1. Main references adopted 2. IT evolution 3. IT governance definition and objectives 4. Governance enablers 5. Governance roles 6. Process reference model 3

4 IT governance Main references adopted 4

5 BUSINESS ENABLEMENT IT governance IT evolution

6 IT governance Why IT Governance? 1. High-quality information 2. Business value 3. Operational excellence 4. IT-related risk 5. Cost of IT 6. Compliance 6

7 IT governance the responsibility of the board of directors and executive management. It is an integral part of entrprise governance and consist of the leadership and organisational structures and processes that ensure that the organisation s IT sustains and extends the organisation s strategies and objectives.» 7

8 IT governance Drivers for IT Governance Activities ITGI - Global Status Report on the Governance of Enterprise IT 8

9 IT governance Governance objective

10 IT governance Governance enablers 10

11 IT governance Governance roles 11

12 IT governance Process reference model

13 IT governance 13

14 IT governance 14

15 Section II IT RISK MANAGEMENT 1. Key points of context 2. Risk / IT risk definitions 3. IT risk categories 4. IT risk evaluation 5. IT risk and organisational structures 6. Information items and risk management 7. Risk management process 8. Risk scenario structure and risk factors 9. Risk scenario and response examples 15

16 IT risk management Key points of context 1. IT as a key element for creating value 2. Regulations govern information technology 3. Growing need to manage risks related to IT 4. IT risk management requires to address the full scope of strategic impacts 16

17 IT risk management IT risk levels MoR - Management of Risk - Office of Government Commerce (UK) 17

18 IT-related Issues Experienced in the Past 12 Months IT risk management ITGI - Global Status Report on the Governance of Enterprise IT 18

19 IT risk context Global Risks Report 2017 The Global Risks Landscape

20 IT risk management Risk / IT risk definitions RISK Risk is the combination of the probability of an event and its consequence. Consequences are that enterprise objectives are not met. INFORMATION and related Technologies (IT) RISK IT risk is a business risk, specifically, the business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise. 20

21 IT risk management IT risk categories 1. IT Benefit / Value Enablement 2. IT Programme and Project Delivery 3. ITOperations and Service Delivery 21

22 IT risk management IT risk evaluation

23 IT risk management IT risk and business value BUSINESS VALUE Fail to Gain / Lose Gain / Preserve 23

24 IT risk management IT risk and organisational structures RISK 24

25 IT risk management IT risk and organisational structures Business process owners IT process / service owners 1. Risk evaluation 2. Risk ownership Risk owner - Person or entity with the accountability and authority to manage a risk ISO Risk management Principles and guidelines 25

26 Information items and risk management IT risk management 7. Risk profile 3. Risk universe 1. Risk scenarios 2. Risk analysis results 4. Risk action plan 6. Risk factors 5. Loss events 26

27 IT risk management Risk management process Practices 1. Collect data 2. Analyse risk Main outputs Data on the operating environment relating to risk Data on risk events and contributing factors IT risk scenarios Risk analysis results 3. Mantain a risk profile Aggregated risk profile, including status of risk management actions 4. Articulate risk Risk analysis and risk profile reports for stakeholders 5. Define an action portfolio Project proposals for reducing risk 6. Respond to risk Risk-related incident response plans 27

28 IT risk management Risk scenario structure

29 IT risk management Risk factors Risk factors 1. Internal context 2. External context 29

30 IT risk management Risk factors Category 1. Internal context Risk factor 1. Enterprise goals and objectives 2. Strategic importance of IT for the business 3. Complexity of IT 4. Complexity of the entity 5. Degree of change 6. Change management capability 7. Operating model 8. Strategic priorities 9. Culture of the enterprise 10. Financial capacity 11. Risk management capability 12. IT-related capabilities 30

31 IT risk management Risk factors Category 1. External context Risk factor 1. Market and economic factors 2. Rate of change in the market/product life cycle 3. Industry and competition 4. Geopolitical situation 5. Regulatory environment 6. Technology status and evolution 31

32 IT risk management Risk scenario examples from COBIT Risk Category Risk scenario Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management 3. IT investment decision making 4. IT expertise and skills 5. Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) There is duplication between initiatives There is an IT project budget overrun The wrong software, in terms of cost, performance, features, compatibility, etc., is selected for implementation. There is a lack of or mismatched IT-related skills within IT, e.g., due to new technologies Hardware components were configured erroneously Portable media containing sensitive data (CD, USB drives, portable disks, etc.) is lost/disclosed. The enterprise architecture is complex and inflexible, obstructing further evolution and expansion leading to missed business opportunities. 8. Infrastructure The systems cannot handle transaction volumes when user volumes increase Software Intentional modification of software leading to wrong data or fraudulent actions

33 IT risk management Risk scenario examples from COBIT Risk Category Risk scenario Cobit Ref 10. Business ownership of IT 11. Supplier selection/performance, contractual compliance, termination of service and transfer 12. Regulatory compliance 13. Infrastructure theft or destruction Business does not assume accountability over those IT areas it should, e.g., functional requirements, development priorities, assessing opportunities through new technologies. Support and services delivered by vendors are inadequate and not in line with the SLA. There is non-compliance with regulations, e.g., privacy, accounting, manufacturing Destruction of the data centre (sabotage, etc.) occurs Malware Regularly, there is infection of laptops with malware Logical attacks There is a service interruption due to denial-of-service attack Industrial action Facilities and building are not accessible because of a labour union strike Acts of nature There is flooding

34 IT risk management Risk scenarios by category IT Programme and Project Delivery 15% IT Operations and Service Delivery IT Benefit / Value Enablement 36% RISK SCENARIOS 50% 13% Cybersecurity 87% Others 34

35 IT risk management Risk response examples from COBIT Risk Category Risk responses (Cobit Processes) Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management Prioritise resource allocation. Maintain a standard approach for programme and project management. APO06.02 BAI IT investment decision making Manage stakeholder engagement. BAI IT expertise and skills Plan and track the usage of IT and business human resources. APO Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) Manage contract staff. Ensure traceability of Information events and accountabilities. Define reference architecture. APO07.06 DSS06.05 APO Infrastructure Monitor and scan the technology environment. APO Software Evaluate, prioritise and authorise change requests. BAI

36 IT risk management Risk response examples from COBIT Risk Category Risk responses (Cobit Processes) Cobit Ref 10. Business ownership of IT Monitor and report service levels. APO Supplier selection/performance, contractual compliance, termination of service and transfer Monitor supplier performance and compliance. APO Regulatory compliance Identify external compliance requirements. MEA Infrastructure theft or destruction Manage physical access to IT assets. DSS Malware Monitor the infrastructure for security-related events. DSS Logical attacks Monitor IT infrastructure. DSS Industrial action Identify key IT personnel. APO Acts of nature Exercise, test and review the Business Continuity Plan. DSS

37 Section III IT AUDIT CASE STUDY 1. IT audit approach 2. Needs of the key players 3. Audit scope and planning 4. Risk assessment 5. Audit areas 6. Methods adopted 7. Audit report and improvement points 8. Key points 37

38 IT audit Case study IT audit approach 1. Overall analysis 2. Effective checks 3. Search of logic vulnerabilities 38

39 IT audit Case study Needs of the key players 1. Management 2. Audit and control functions 3. IT department 39

40 IT audit Case study Audit scope 1. Foreign branch of a leading company in the industrial sector 2. Internal control system against cybercrimes 3. Company has 20 foreign branches on several continents 40

41 IT audit Case study Information system audited Audited branch Applications: Tenders Design Production Support processes Headquarter 41

42 IT audit Case study Audit planning 1. Preliminary survey 2. Risk assessment 3. Audit plan Documentation analysis Interviews IT systems IT management processes Cybercrimes Audit areas Checks 42

43 IT audit Case study Risk assessment Cybercrimes (as of Italian Penal Code) Unauthorized access to an IT system art.615-ter c.p. (Cobit risk scenario 1601) Risk Scenarios 1. Competitors IT system violation in order to acquire, for industrial espionage purposes, documentation regarding products/projects 2. Unauthorized access to IT protected systems, by company internal users, to activate services that were not solicited by customers. 3. Unauthorized access to invoice systems in order to alter information and programs with the aim to achieve illicit profits. Risk Evaluation 43

44 IT audit Case study Audit areas Area Cobit Ref 1. System administrators DSS Management of users and authorisations DSS Software licensing management BAI Security of IT workstations DSS Electronic signature DSS

45 IT audit Case study Audit area 1 - System Administrators Audits Population / Sample 1 - Identification of administrators Contract documents 2 - Name-registered administrator accounts List of users in the administrators authentication group 3 - Rules of minimum complexity of passwords Settings for authentication of administrator accounts 45

46 IT audit Case study Audit area 2 - Management of User Accounts Audits 1 - Correspondence between user accounts and the employees 2 - Traceability of the requests relating to user accounts 3 - Minimum complexity of passwords 4 - Name-registered accounts Population / Sample List of user accounts and employees / collaborators of the branch-office Procedure adopted for the traceability of the subjectmatter requests Settings for the authentication of user in the centralized authentication system List of user accounts in the centralized authentication system 46

47 IT audit Case study Audit area 3 - Management of access authorizations 1 - Use of the folder Public Audits Population / Sample List of the folders and files contained in the shared folder Public 2 - Shared folders in the PCs Sample of PCs 3 - Adequacy of the authorizations List of the authorization and users for a selected sample of shared folders 47

48 IT audit Case study Audit area 4 - Software Licences Audits Population / Sample 1 - Inventory of software licences Archiving of software setup supports Software licences Sample of PCs and software licences 48

49 IT audit Case study Audit area 5 - Cybersecurity of PCs Audits Population / Sample 1 - Update of antivirus software 2 - Security updates Sample of PCs 3 Installing authorizations 49

50 IT audit Case study Audit area 6 - Electronic signature Audits Population / Sample 1 - Electronic signature devices Signature authorizations Revocation of the electronic certificate - 50

51 IT audit Case study Methods adopted 1. Analysis of company regulations 2. Surveying practices and IT systems 3. Process walk-throughs 4. Verifying IT system 51

52 IT audit Case study Audit report 1. Methods used to plan and carry out the activities 2. Improvement points 3. Suggestions for action 52

53 IT audit Case study Improvement points 1. Contractual definition of System Administrators 2. Use of shared folders 3. Inventory of software in use 4. Traceability of new user requests 53

54 IT audit Case study Critical factors 1. Co-existence of local and central IT systems 2. Outsourced IT administration 3. Temporary nature of the production sites 4. Specific needs of each production site 54

55 IT audit Case study Key points 1. Value of information / dimension of infrastructures 2. IT risk & control policy 55

56 Section IV NEW EU PRIVACY REGULATION RISK APPROACH 1. Brief introduction to regulation 2. Risk based approach adopted 3. Key concepts 4. COBIT Risk scenarios applicable 56

57 GDPR risk based approach The new european data protection regulation (GDPR) 1. Data protection legislation unchanged since 1995 (current Directive) 2. GDPR adopted on May GDPR directly applicable from May New concepts (e.g. profiling, right to be forgotten), obligations on businesses and rights for individuals 5. Fines are increased exponentially (to 20 M / 4% of turnover) 57

58 GDPR risk based approach GDPR and risk based approach implement protective measures corresponding to the level of risk of data processing activities 58

59 GDPR risk based approach GDPR risk based approach Key concept 1 - ACCOUNTABILITY Article Taking into account the [ ] risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing [of data] is performed in accordance with this Regulation. 59

60 GDPR risk based approach GDPR risk based approach Key concept 2 - DATA PROTECTION BY DESIGN Article 25 1.Taking into account [ ] the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures [ ] 60

61 GDPR risk based approach GDPR risk based approach Key concept 3 PERSONAL DATA SECURITY Article In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 61

62 GDPR risk based approach Example Data security risk categories from 1. IT investment decision making 2. IT expertise and skills 3. Staff operations (human error and malicious intent) 4. Information (data breach: damage, leakage and access) 5. Infrastructure 6. Software 7. Supplier selection, performance, contractual compliance, termination and transfer 8. Malware & Logical attacks 9. Acts of nature 62

63 DISCUSSION 63

64 Discussion Assessing the risk connected to personal data security see article 32 of GDPR below which are the risk scenarios to consider among the ones detailed in the following slide? Article In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 64

65 Discussion Risk Category Risk scenario Cobit Ref 1. Portfolio establishment and maintenance 2. Programme/projects life cycle management There is duplication between initiatives There is occasional late IT project delivery by an internal development department. 3. IT investment decision making Redundant software is purchased IT expertise and skills 5. Staff operations (error and malicious intent) 6. Information (data breach: damage, leakage and access) 7. Architecture (architectural vision and design) There is a lack of or mismatched IT-related skills within IT, e.g., due to new technologies Hardware components were configured erroneously Portable media containing sensitive data (CD, USB drives, portable disks, etc.) is lost/disclosed There is a failure to adopt and exploit new infrastructure in a timely manner Infrastructure The systems cannot handle transaction volumes when user volumes increase

66 Thank you! Alessandro Salibra Bove Partner 66