Intermediate IT Audit School

Seminar: ID# 1264186

Agenda

• IT Threats, Risks And Exposures
• Risk Definition
• IT Risk Assessment
• IT Infrastructure Risks
• Information Classification
• Building The IT Audit Universe
• Establishing Risk Criteria
• IT Risk Assessment Resources

• Regulatory Compliance Challenges
• Us And International Regulatory Laws And Standards
• Identifying And Leveraging IT, IT Audit And Security Frameworks
• Using COBIT®, ISO 27002, ITIL, GAO/FISMA, And Other Standards As A Foundation For Your IT Audit Framework
• Integrating Compliance Requirements Into The Audit Plan

• Defining IT Governance
• IT Governance Risks And Responsibilities
• IT Governance Components
• Information Security Governance
• Separation Of Duties
• Audit Procedures

• Common Access Control Issues
• Social Media And Social Engineering
• User Access Controls
• User Identification And Authentication
• Authorization
• Log Management
• Privileged Access Monitoring
• Distributed Web Applications
• Mobile Computing
• User Access Audit Procedures

• Encryption Concepts And Key Management
• Symmetric Key Encryption
• Asymmetric Key Encryption
• Digital Signatures
• Public Key Infrastructure (PKI)
• Certificate Authorities (CAS)
• Encryption Key Management Audit Steps

• Network Terminology And Risk Analysis
• OSI Network Protocol Model
• Threat And Vulnerability Management
• Firewalls
• Intrusion Detection Systems (IDS/IPS)
• Virtual Private Networks (VPNS)
• Wireless
• Cloud Computing
• Audit Procedures

• Types Of System Software Virtualization And Hypervisors
• Patch Management
• Privileged Administrative Access
• Vulnerability Assessments (Health Checks)
• Log Management
• Audit Procedures

• Database Management System Concepts
• Database Terminology
• Relational Databases
• Structured Query Language (SQL)
• DBMS Risks And Controls
• Audit Procedures

• System Development Business Risks
• Audit’s Primary Objectives On Systems Development Projects
• Systems Development Methodologies
• Assessing Project Management
• Audit As A Value Added Service
• Configuration And Change Management
• Web Application Development Risks And Controls
• End User Computing Risks And Controls
• Audit Procedures

• Disaster Recovery Planning (DRP)
• Business Continuity Planning (BCP)
• Business Impact Analysis (BIA)
• Recovery Point Objectives (RPO)
• Recovery Time Objectives (RTO)
• Application Recovery Priority
• Continuity Plans And Procedures
• Audit Procedures

• Outsourcing Risks
• Ensuring Strong Contractual Agreements
• Right To Audit
• SSAE-16, SOC1, SOC2, SOC3 Reports
• Relationship Monitoring
• Audit Focus Areas

• IT Audit Planning
• Testing IT Controls
• Integrated Auditing
• IT Audit Resources