Information Technology Operation Management (ITOM)

Information Technology Operations Management (ITOM) software is done on purpose to represent all the tools stand in need to manage the provisioning, performance, capacity and availability of the computing, networking and application environment.

IT Operations Management (ITOM) is the administrative part involving technology infrastructure components and the requirements of particular applications, storage, services, connectivity and networking elements in an organization. ITOM is all about infrastructure:

• Servers
• Applications
• Storage
• Virtualization
• Cloud
• Network

ITOM Methodology

Information Technology Operations control the way an organization manages software and hardware and involves other IT support, such as network administration, device management and help desks of all categories. IT Operations Management (ITOM) and IT Operations Analytics (ITOA) assist an organization rectify the way that IT make a start on services, deployment and support and help to safeguard consistency, reliability and quality of service.

Components of IT operations are chosen to provide effective services at the required quality and cost. IT operations are generally considered to be separate from IT applications. In a software development firm, for example, IT Operations incorporates all IT functions other than software development and management.

Different organizations describe IT operations in various method; the term is also used to describe the department that controls, IT operations as well as the collection of services and processes and how the department works as a standardized procedure. ServiceNow ITOM technologies are handed down to support ServiceNow's cloud infrastructure and operations.

Figure 1: Information Technology Operation Management

When ITOM is integrated along with ITSM, processes like Incident, Problem, and Change Management become more systematic and IT all together becomes far more effective. IT Services and Operations Management Strategy brings together and automates outcomes from all areas of the business by holding a single platform across the organization to increase the pace of service delivery.

Integrating IT Operations management and Service management enables to view and run these entities as one, aligning company and their operations with client’s needs.

Conclusion:

Information Technology Operation Management software and IT Service Management collaboratively monitors and controls the way an IT organization manages and handles software, hardware service as well as other IT support.

About Author:

Vinita Vaishnav  is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: vinita.vaishnav@spluspl.com

How to become PCI DSS compliant

In this blog we are going to talk about what is PCI DSS, to whom do these standards apply and how can one become PCI DSS compliant.

Let’s see what we understand by PCI DSS.

PCI DSS: Payment Card Industry Data Security Standard (PCI DSS) is managed by Payment Card Industry Security Standards Council (PCI SSC). PCI SSC was launched on 7th September 2006 to improve the security of the payment account throughout transactional processes. PCI DSS helps in building and maintaining a secure environment for all companies that accept, process, store or transmit credit or debit card information.

PCI DSS applies to any organization that accepts, processes, stores or transmits cardholder data (CHD). It does not depend on the number of people working in an organization. Even if there is a single transaction which involves transmitting CHD, the organization has to be PCI DSS compliant.

PCI DSS compliance: Merchants are categorized into 4 different levels of compliance as defined by Visa. Categorizing the merchants into different levels is a tough task and can raise many questions. To avoid this, Visa recommends the merchants to contact their acquiring banks and with the help of the bank merchants can complete the following steps:

• Determine the Merchant Level based on the most recent annual Visa transaction
• Understand the requirements which are necessary for PCI compliance
• If needed, hire an Approved Scanning Vendor (ASV), who will guide the merchants to adhere to the validation requirements of PCI DSS

PCI compliance levels and requirements: There are 4 different levels of PCI compliance defined by Visa. All merchants fall under one of the four Merchant Levels based on the volume of their annual financial transactions. The following table gives a brief description of each Merchant Level:

    *Note: Compliance validation requirements are set by the acquirer.

Understanding the requirements validation:

• On-site or Self-Assessment: On-site or Self-Assessment is also known as Report on Compliance (ROC). This assessment is usually performed by a PCI SSC certified Quality Security Assessor (QSA) or by a certified Internal Security Assessor (ISA). The acquiring bank can treat this assessment as a validation, that the organization / merchant is handling the card data as per the PCI DSS. This is applicable to Level 1 and 2 merchants.
• Self-Assessment Questionnaire (SAQ): This self-evaluation tool is used by merchants and service providers to understand their compliance with the PCI DSS. This is applicable to Level 2, 3, and 4 merchants. The following chart helps the organization / merchant to understand their compliance with the PCI DSS.

    (Note: The above chart is available @pcicomplianceguide.org)

• External Vulnerability Scan: A PCI SSC Approved Scanning Vendor (ASV) performs vulnerability scanning of all the systems components which interact with the system and are a part of or provide the path to Cardholder Data Environment. This applies to all merchants.

The merchant must submit the validations requirement to its acquiring bank once they have been verified as compliant. The acquiring bank then submits the compliance status of the Merchant to Visa.

Conclusion: 

This blog helps us in understanding different requirements for a merchant to be PCI DSS compliant. Once a merchant follows all the requirements and the details are submitted to Visa by the acquiring bank, they can be termed as PCI DSS compliant.

About Author:

Akash Poojary is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, he actively contributes to the areas of Technology and Information Security. He can be contacted at:    akash.poojary@spluspl.com

Overview on ServiceNow Tool

ServiceNow is the Enterprise IT cloud company that provides Software as a Service (SaaS). It is specialized in Information Technology Service Management (ITSM), Information Technology Operation Management (ITOM), and Information Technology Business Management (ITBM).

ServiceNow may also be looked on as Service desk platform that is based on Model-View-Control (MVC) concept. When starting with a ServiceNow application, first think of the data structure, where information needs to be stored and all get linked together to create tables and fields. This is a model facet. A simple view on this data is created automatically, with form and lists showing information about data. This data can be configured automatically or by manual updates. This is a control aspect.

ServiceNow provides the following management configuration:

1. IT Service Management

2. IT Operations Management

3. Business Management

IT Service Management (ITSM)

IT Service Management describes a planned way for managing, designing, delivering and improving the way information technology (IT) is used.

IT Operations Management

IT Operation Management is a process to manage day-to-day IT Infrastructure and also, manages performance and availability of the application environment.

IT Business Management

IT Business Management combines financial management, application management and project management in a single cloud platform to optimize resources to manage the business.

Purpose:

ServiceNow is a web-based tool for employees from different departments, where they can log service requests and various incidents. The primary purpose of ServiceNow web-based tool is to provide ease of access to users to request and receive timely help and in accurate manner. 

Different types of Users in ServiceNow:
ITIL users - able to work on Incidents/Tasks.
ESS users – ServiceNow End user.
Specialized Administrator - One with Admin rights for a certain module.
System Administrator - One with Complete admin rights over the system.

Key Features of ServiceNow:

Conclusion:

ServiceNow provides a structured process that delivers everything-as-a-service and also provide ease of access to users to request and receive timely help and in accurate manner.

About Author:

Vinita Vaishnav is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: vinita.vaishnav@spluspl.com

Information Technology Audits

An Information Technology Audit examines and evaluates the information system of an organization. Audits can be made to check whether various parameters, like any people, a company, a building, a system or a document that are been used by people is correct. With the help of evidences IT audit states whether the IT controls are safeguarding corporate virtue, ensuring data integrity, confidentiality and availability of data in an IT Infrastructure.

Information Technology Controls

Information Technology controls are used to meet the business goals and objectives. In Information Technology Audit IT controls objectives are almost similar to the availability, confidentiality, and integrity of data in the business enterprise. There are two types of IT controls as follows,

1. ITGC (Information technology general controls)

2. ITAC (Information technology application controls)

IT general controls are used to have control over the information technology environment, access to programs and data, changes in the program, computer operations performed, program change and program development. IT application controls are used to process transaction.

The COBIT Framework

Cobit stands for Control objectives for Information Technology. It is a framework made by International professional association ISACA (Information system audits and control associations) to govern and manage the Information technology. Cobit was promoted by the IT governance institute. 

Cobit was first released in 1996 as COBIT1, by ISACA as a set of control objectives for financial audit. ISACA then released COBIT2 in 1998, and expanded it further with management guidelines in 2000 as COBIT3. Later in 2005 and 2007, COBIT 4.0 and COBIT 4.1 were released respectively with IT governance controls. In 2012, COBIT 5 was released which included functionality of cobit 4.1, Val IT and Risk IT as one framework, which acts as associate framework for enterprise to operate along with other framework and standards.

Conclusion:

Basically, IT audit is evaluation and examination of IT Fundaments, operations and policies for an organisation. Information Technology audit look over whether IT controls safeguards corporate virtue, to ensure sincerity and achieve business goals. COBIT is a set of processes to manage Information Technology, and each processes include process input and output, process objectives and performance measures.

About Author:

Vinita Vaishnav is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: vinita.vaishnav@spluspl.com

Common Issues in Change Management

We have been hearing about Change management and the process to implement the same. But we all are aware, how challenges with change management were consistent across all of the enterprises irrespective of vertical focus and still persist to some extent. As observed, few very evident themes around these challenges were generally related to difficulty handling emergency changes to material systems, unauthorized changes, and problems dealing with security and unauthorized access. We also well aware know that auditors tend to focus on particular areas or known processes. Auditors are in a constant quest of trying to answer the questions such as; did the work get completed as planned; why was the approved request not completed; and why was there no request for a particular change? A tiny but very important key to meeting many of these challenges is to have tight control on the change management process. We cannot deny that there may be loopholes in approval procedures or in the change management guidelines. Also, reporting and tracking can be a limitation due to various reasons such as; insufficient automation in change management solutions and a lack of capabilities for tracking change history. 

Below listed are few of the areas that require more focus on managing change process: 

• Process Management 
• Approval Matrix 
• Security Measures 
• Unplanned emergency access/changes 

Refer below listed details on the areas of concern:

• Process Management:

A very important question to be answered is to determine a start point; who will initiate the change, how the workflow for the change will be managed? Help desk has been the primary requesting application used on a larger scale by organizations for initiating and tracking changes and this can work well. Organizations are traversing into the market with many other automated process oriented applications as means for tracing the change through its workflow steps.

• Approval Matrix:

One of the most difficult aspects of change management is the change approval matrix (Team Hierarchy). Taking necessary precautions in approving any change is the base of change management process that includes; involving the right people, and evaluating implications to the best of your ability. It is also important to focus on creating a simple to follow process, without too many gates, and not involving too many people so that it becomes inefficient and not leading the staff to look out for ways to avoid the change process itself. Many organizations have established a Change Advisory Board (CAB), which is a cross-section of individuals that meet on a periodic basis, usually weekly, to plan and approve changes that will be needed over the coming week. CAB establishment works well for important changes. A well arched process to set multiple gates for change approval. This would maintain different levels for different approval processes. This gives the organization the freedom to keep lower approval dependencies for smaller changes. The level of approval required depends upon the nature of the business. 

• Security Measures:

One of the crucial focus areas that needs to be focused and managed are the security measures. Unauthorized system access, data visibility and database access are few concerns that need to be governed. Also, maintaining the confidentiality of super-user credentials is highly required. During the Change implementation phase, employees and their respective roles change frequently, and controlling that appropriate access to all types of systems is a tedious task. However, in the given scenario these challenges are dealt as part of administration. Staff training and user guidelines are to be very well framed for meeting the security levels and controlling users from any breach of policies.

• Unplanned emergency access/changes:

Major tripping areas in a change management process is determining how to deal with unauthorized and unplanned emergency changes. The 2 major concerns in resolving this issue; difficulty in collating and documenting the change that has already taken place and resistant that the staff members portray to the change management process itself. 

Unplanned emergency cases will always be part of any organizational process that will also require staff to work outside of the formal process to address a problem situation. Similarly, a decent number of staff members will also take the decision that the change management process does not apply to them. Basic considerations are; how will one document this unplanned changes? How will one monitor the staff for failing to comply with the process? The much expected solution is a penalty for failing to operate according to the process that needs to be relatively severe. 

Regardless of the consequence, it is important for the change management process to have in place a continuous evaluation process for this unauthorized and unplanned changes to work towards identification and reduction of these changes. Few companies attempt to handle these changes just prior to an audit. In such cases, it is generally obvious to an auditor that these types of changes are not being managed. A new process of providing a post-change report, can be formally replaced for emergency changes.

Conclusion:

A change management process is the most tedious phase for a new implementation. This process needs well traced plans and motivated leaders to drive the teams towards achieving organizational goals. The major key factors that help in managing change management in an organization and needs to be well thought about are Process Management, Approval Matrix, Security Measures and Unplanned emergency access/changes.

About Author:

Mrudula Palyekar is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: mrudula.palyekar@spluspl.com

COBIT Indicators for Agile Software Development

In this blog, we are going to talk about the different COBIT controls which can be mapped to Agile software development process. After reading this we can determine if Scrum based software development process can be compliant with the auditing criteria as described in COBIT indicators.

First, let’s talk about how Agile came into existence and what is Agile.

Agile: Earlier the industry relied on Waterfall model of SDLC for software development but as time passed by, concerns were raised because the time gap between gathering requirements and delivering the final product was huge. By the time a working model was delivered the client would need more features or the software that was developed would need an upgrade. This led to cancellation of many projects based on the waterfall model. This growing frustration in the industry made a small group of people come together and come up with an alternative to the existing waterfall model. The outcome of this meeting was Agile Manifesto.

The agile manifesto has four foundation values and twelve supporting principles which can be used in any software development project using agile methodology. I will cover this in detail in the next blog.

Agile takes an iterative approach to deliver the software in increments rather than delivering the entire product in one go. It breaks down the projects into bits, prioritizes the bits with customer’s approval and then delivers a shippable product increment in one or two week’s cycle.

There are different methods of Agile software development but in this blog we will be focusing on Scrum Method.

Scrum: Scrum follows an incremental product development approach. It has a repeatable work cycle of around 3-4 weeks (depends on company’s process) to develop a shippable product increment. This work cycle is called as Sprint. Scrum has 3 roles Product Owner, Scrum Master and Scrum Team.

• Product Owner is responsible to explain and prioritize the requirement for each sprint
• Scrum Master’s job is to facilitate the daily scrum meeting and take care of any impediments 
• Scrum Team is the one who actually builds the potentially shippable product increment

Each Scrum usually has the following 5 processes:

1. Backlog Grooming: Product Owner gives an overview of all the user stories required for the developing the product. The stories captured in this meeting form the “Product Backlog”.
2. Sprint Planning: In Sprint Planning the product owner explains each story to the team. The team gives weightage to each story which is known as “Story Point Estimation”. Based on this the team will prepare the task estimates. Scrum Master then prepares the sprint backlog based on the team’s velocity.
3. Daily Scrum (Standup meeting): In this meeting only three things are discussed:
        3.1 What you did yesterday?
        3.2 What are you going to do today?
        3.3 What are the impediments you are facing?
4. Sprint Review: In this meeting the team reviews the completed work and the work which was not completed as per the plan. The team also gives a demo of completed work to the stakeholders, this process is also called as “show and tell”.
5. Sprint Retrospective: The team meets at the end of each sprint to discuss the pros and cons of the sprint and what should be changed to improve the efficiency of work.

Now let’s see what is COBIT and which different COBIT indicators will make Scrum Methodology of Agile Software development compliant with auditing criteria.

COBIT: Control Objectives for Information and Related Technologies (COBIT) is an IT governance framework created by the Information Systems Audit and Controls Association (ISACA). COBIT focuses on IT controls which is useful for IT Management, users and auditors. COBIT 4.1 has 34 high level process in 4 process domains with 210 control objectives. 

The 4 process domains are follows:

1. Plan and Organize
2. Acquire and Implement
3. Deliver and Support
4. Monitor and Evaluate

In this blog I am going to list down the indicators of COBIT process which will help us in assessing the software development process using Scrum methodology. The selection of process and its indicators are based on the auditing guidelines for SDLC. The below table has the list of COBIT process and indicators.

COBIT Process	COBIT Indicators
PO7 Manage IT Human Resources	PO7.2 Personnel Competencies
	PO7.3 Staffing of Roles
PO8 Manage Quality	PO8.2 IT Standards and Quality Practices
	PO8.3 Development and Acquisition Standards
PO10 Manage Projects	PO10.1 Program Management Framework
	PO10.9 Project Risk Management
	PO10.10 Project Quality Plan
	PO10.11 Project Change Control
	PO10.13 Project Performance Measurement, Reporting and Monitoring
	PO10.14 Project Closure
AI1 Identify Automated Solutions	AI1.1 Define and Maintain Business Functional and Technical Requirements
	AI1.3 Feasibility and Alternate Course of Action
AI6 Manage Changes	AI6.1 Change Standards and Procedures
AI7 Install and Accredit Solutions and Changes	AI7.1 Training
	AI7.2 Test Plan
	AI7.5 System and Data Conversion
	AI7.8 Promotion to Production
DS5 Ensure Systems Security	DS5.2 IT Security Plan
	DS5.3 Identity Management

Conclusion: This blog helps us in identifying different indicators of COBIT process which can be mapped to software development process using Scrum methodology. Thus, with the help of these COBIT indicators we can measure the performance of our process and also understand if our process is compliant with the information systems auditing criteria.

About Author:

Akash Poojary is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, he actively contributes to the areas of Technology and Information Security. He can be contacted at: akash.poojary@spluspl.com

An Introduction to PCI DSS for Beginners

PCI DSS stands for Payment Card Industry Data Security Standard. PCI DSS is a set of industry standard mandatory requirements, which are used to evaluate the security levels of businesses that accept, process, store, and transmit cardholder data or sensitive authentication data pertaining to credit cards. PCI DSS aids merchants, service providers and financial institutions to understand and implement standards for ongoing technology and processes that protect the payment system from security breach and theft of cardholder data and different security policies. PCI DSS standards are mandatory for entities that accept credit cards (known as a merchant) or entities that are directly involved in processing, storing or transmitting of cardholder data to ensure that the cardholder data is protected, on behalf of businesses (known as service providers). PCI DSS is structured in a way to protect sensitive cardholder data by ensuring that the information that is accessed has sufficient controls and protection around its usage.

This article deals with introducing readers to the world of PCI DSS from information perspective. Described below are some of the important terminologies necessary to be aware of; in order to understand the 12 requirements of PCI DSS and shall be useful in understanding the details of these requirements in the upcoming blogs.

Terminologies Involved in PCI DSS:

• Cardholder – A cardholder is any customer who is authorized to use a payment card. 
• Cardholder Data – Cardholder data also denoted as CHD or CD refers to the data contained on a consumer’s payment. It is inclusive of two elements viz. Cardholder data element and Sensitive Authentication Data (SAD).
• Cardholder data elements include Primary Account Number (PAN), cardholder name and expiration date
• Sensitive Authentication Data (SAD) includes data on Magnetic Stripe, Personal Identification Number (PIN) and Card Validation Code (CVC)
• Card Verification Code – Card Validation Code (CVC) also referred to as Card Verification Value is a SAD element that uses secure cryptography to protect the integrity of data stored on the magnetic stripe and reveals forgery.
• Cardholder Data Environment – Cardholder Data Environment (CDE) refers to any person, technology or process that stores, processes and transmits cardholder data or sensitive authentication data.
• Cross - Site Request Forgery – Cross - Site Request Forgery (CSRF) is a vulnerability that is created because of coding techniques which are insecure, that allow for the execution of unwanted actions through an authenticated session.
• Cryptography – Cryptography is a method of encrypting or storing data in a manner, such that only those who are intended to decrypt the same can read it and process it.
• Cryptographic Keys – Cryptographic keys are plain texts transformed into ciphertexts by using a cryptographic algorithm. It ensures the security of the message encrypted in the key created. It allows secure communication and maintains the confidentiality of the data.

PCI DSS Requirements:

The twelve requirements of PCI DSS are categorized into six main sections as below:

• Building and maintain a secure network systems
• Install and maintain a firewall configuration to protect cardholder data
• Do not use vendor-supplied defaults for system passwords and other security parameters
• Protecting cardholder data
• Protect stored cardholder data
• Encrypt transmission of cardholder data across open, public networks
• Maintaining a programme to manage and address vulnerabilities
• Use and regularly update anti-virus software or programs
• Develop and maintain secure systems and applications
• Implementing strong access control measures to restrict access to cardholder data
• Restrict access to cardholder data by business need to know
• Assign a unique ID to each person with computer access
• Restrict physical access to cardholder data
• Maintaining audit logs, monitoring and testing security of network and system components
• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes
• Developing and maintaining information security policies
• Maintain a policy that addresses information security for all personnel

Conclusion:

The implementation and compliance of PCI DSS is vital for entities dealing with financial transactions and security of such e - commerce payments. Implementing the PCI DSS is not only a mandate for such organisations but also helps in ensuring that the inflow and outflow of CHD and SAD remains protected and confidential.

About Author:

Devika Vaghela is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: devika.vaghela@spluspl.com

Successful Management of a Project

A Project is basically achieving planned objectives. To achieve it within a defined timeframe and budget, proper planning, execution and closure is required.

In order to manage a project efficiently, various factors are to be considered. Some of them are as follows:

Project Visibility: 

There should be a clear picture of project goals, timeframe, resources required etc. It is important to know what has to be achieved, in order to achieve it successfully. Without having a clear picture, it is not wise to jump to next step i.e. how to achieve it. Business cases prepared properly helps to understand the requirements of the customers.

Involvement of Management:

Top Management should help to provide the required resources, authority, and any kind of assistance wherever required. 

Project Schedule:

In a project, number of people work who perform various activities. So, action plan focusing on ideas and steps to be taken to achieve the objectives should be discussed and documented. It is important to figure out tasks to be carried out, time required to complete each task and resources to be allocated for the tasks. Project Manager has to make plan to recruit, select and train the required skilled personnel.

Communication: As many people are involved in a project, a network is required so that people can interact with each other. Team is aligned on activities taking place, roles and responsibilities and assistance required. The proper flow of communication reduces the ambiguity and helps to achieve the goals in an efficient and effective way. Communication is the backbone of a business, organization and system.

Monitoring, Feedback and Control:

All the activities should be monitored and accordingly decisions should be taken as and when required. Depending upon the feedback, improvements should be made. It is very important to compare the expected performance and actual performance. Control is required to reduce this gap between expected and actual results. The types of controls used in project management are cybernetic, go/no-go, and post-performance. Cybernetic control focusses on the outputs. Whereas, go/no-go control ensures that before undertaking a task the prerequisites are satisfied. After the completion of a project, post-performance controls are applied. This control is about the learning

Customer Focus and Acceptance: 

Amid all the activities, it is important that the customer’s interest shouldn’t be neglected. Along with the project manager, customer should also be benefited by the process efficiency. Ultimately we expect the product to be accepted by the customer.

If the customer focus is shifted, all the efforts may go futile. So while working on other aspects of project management, it is highly recommended to keep the requirements of the customer in mind. As we know that the customer is the king!

Motivation:

There are various activities involved in a project. To ensure the efficient working of the team and successful achievement of the objectives, Project Manager should motivate the teammates. Sometimes things may not work as expected but it is required that team is motivated to work together to achieve it.

Project Manager should talk, understand and try to find the solutions for the issues faced by the team.

It is the job of the Project Manager and management to help the team with timely solutions. It is the collective job of the management, Project Management and team to achieve the target of customer acceptance and satisfaction.

Having mentioned few factors, while working on projects, one may come up with various other aspects to increase the efficiency of the Project Management. 

Conclusion:

As efforts, money and time are involved in a project, it becomes a necessity to manage the project in a proper manner with an aim to make it a success. Project Manager manages the project skillfully with proper visibility, scheduling, motivation, and monitoring & control taking help from top management and successfully achieves the project objectives.

About Author:

Madhumita Mishra is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: madhumita.mishra@spluspl.com

Management’s Role in Audit Assessment

An internal audit assessment typically has 3 phases: Planning, Testing and Reporting. Management has an important role to play in each of the above phase of the assessment

Planning

During planning, the auditors prepare the audit plan that outlines the guidelines to be followed during assessment. It also covers the risks / impacts and the planned responses for the same. It is then the responsibility of the management to guarantee that the plan is understood by the senior officials. Management should make sure that senior officials agree with the audit purpose and approach. An open end discussion with the audit team on the approach on how to go about the whole process of audit is important. This helps the management and the audit team to align on the prospects in advance. Management talks about the assessment criteria that the auditors will use in testing the controls with the employees in the company, helping them understand on what needs to be done for the successful accomplishment of the audit.

Testing

During testing, the Management allows the auditors to investigate the company’s critical systems and frameworks. Management agrees with the audit results by checking the procedures and information so as to gain trust in the audit findings. The audit group and senior officials of different departments that were audited meet frequently throughout the audit procedure – generally weekly or monthly – to talk about audit progress, identified issues, and potential activities.

Such open, straightforward meetings between senior officials from both Management and the audit groups help avoid misunderstandings before the audit group issues its draft report. The auditors should convey all crucial findings to management at the earliest, even before the planned meetings. These findings are investigated during regular meetings, however proactive notification is essential.

Reporting

Once the auditors complete the assessment, they prepare the final audit report which outlines the gaps in the processes and corrective actions that need to be taken by the management. This will help in making the processes more effective and efficient. The management checks the findings, analyzes the gaps in the processes and thereby implements the corrective actions as suggested by auditors.

Audit Communication flow

• During planning, the audit team prepares and communicates the audit plan to the management. The meeting is then conducted between the management and auditors to discuss the audit goals and scope of the assessment
• Once the audit plan is finalized, auditors then test the controls by checking the evidences submitted by the management. Management also validates testing processes and meets frequently with the audit teams to discuss audit progress and issues
• Post assessment, audit team issues draft report and conducts meeting with management. After all the discussions, the audit team issues the final report, which is then reviewed and agreed upon by the management
• The management then starts to work on the gaps found in the processes by implementing the remediation as suggested by the auditors
• The auditors then follow up to check how well the Management has implemented the corrective actions suggested in the report

Conclusion:

The point of all this is: Audit team and Management should work in a joint effort throughout the audit assessment to guarantee that auditors meet objectives and have legitimate knowledge of IT and business forms. Great correspondence throughout the audit process guarantees that audit findings are applicable and can be utilized for the progress of the company.

About Author:

Nisha Bhatt is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: nisha.bhatt@spluspl.com

Data Loss Prevention

Have you ever imagined, your confidential data being possessed by someone you don’t even know and its consequences. Gosh!

This can be a reality!

Nowadays data is more transferrable and accessible than ever before, giving rise to the fear of loss and misuse of the data. Leakage of data could cause embarrassment, financial loss etc. depending upon the criticality of the data. Data Loss Prevention (DLP) detects and prevents the unauthorized transfer or access of the confidential data.

DLP is the identification and monitoring of the sensitive data to ensure that it is only accessed by authorized users and that there are safeguards against data leaks.

What types of data are to be protected?

In order to protect and prevent data loss, it is important to understand what types of data are at stake.

• Data in motion: It should be confirmed that the data moving over the network is going to the authorized user. The data in motion can leak through HTTP, FTP, SMTP, and P2P etc.
• Data in use: The data residing on end user workstations, laptops are data in use. The data in use can be leaked using USB, Emails, Web mails, HTTP/HTTPS etc.
• Data at rest: Any type of repositories that holds the data like databases are data at rest. There could be data leakage due to unauthorized access, data theft etc.DLP products are designed to detect sensitive data.

It is important to identify the sensitive data and ensure that there is structured use of the sensitive data. The data should reside at right place, accessed and owned by right people.

Data Loss Prevention Approach

To implement data loss prevention, following activities should be considered:

• Data Classification: Most of the organizations are not aware of the types of information and their locations. The first task is to identify the sensitive data and their flows. It is very important to understand the data life cycle.
• Establish high level policies and processes: After classifying the information, policies should be created or modified to define the classifications and ensure proper handling.
• Implementation: DLP Implementation should first be in monitoring mode, so that its impact to the business processes could be predicted. DLP is implemented by preparation of the process to be used, deployment plan, setting deployment policies and ultimately managing the overall process.
• Remediation of Violations: DLP solutions provide the information about the sensitive data and its transmission. So the organization can address the issues. They should be prepared to address and prioritize the issues in best possible manner. The analysis and decisions should be documented for audit purpose.
• Ongoing DLP program: The DLP solutions should be monitored. The rules should be reviewed and optimized periodically. The impact of the patches and upgrades of the DLP solutions should be tested. Awareness should be spread about the DLP solution through various programs and training.

Benefits of DLP solution

• Some of the benefits of the DLP solutions implementation are the following:
•  Protection of critical data
• Enhancing the business processes as per the requirements.
• Managing and optimising the storage space like file server and network bandwidth.
• Reducing the damage caused by malicious software by alerting or blocking the data streams.

Conclusion: Data Loss Prevention is the strategy of identifying and protecting the unauthorised transmission and access of the sensitive information.

About Author:

Madhumita Mishra is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: madhumita.mishra@spluspl.com

A Successful Audit:It is now for real!

Introduction

Information technology audit is the systematic evaluation of management controls in an Information Technology framework.

The objective of the audit is to prepare a report of truth and fairness of the various statements as well as to detect and prevent frauds.It also aims to improve the efficiency of governance processes, risk management and controls.

In order to perform a successful audit, it is very important to understand the process of an audit.

Audit Process:Audit process consists of the following steps:

1. Notification: It starts with receiving notification from auditors regarding the audit schedule consisting of preliminary checklist and list of documents required to plan the audit.
2. Planning: Post review of the documents, auditors draft an audit plan and schedule the meeting.
3. Meeting: In the meeting the scope of the audit, timeframe of the audit etc. is discussed.
4. Fieldwork:After this, auditors finalize the plan and start meeting with staffs, reviewing the manuals regarding the business processes, testing for the compliance with the policies, laws and regulation, controls etc.
5. Communication:After this fieldwork, there is an opportunity to discuss the issues and its solutions with the auditors through meetings, emails, etc.
6. Reports: Report forms an important part of the audit. The report generally consists of several sections like an overview of the organization, the follow-up date, scope of the audit, any major audit concerns, the overall conclusion, and detailed description of the findings and proposed recommendations, distribution list mentioning the people to receive the report etc.
7. Response from Management: Once the report is finalized, next step is response from management consisting of: Acceptance/ refusal with the issues mentioned in report, action plan to correct the issues and the expected date for the completion.
8. Closing Meeting: A closing meeting is held to discuss the report and the responses providing an opportunity to discuss the audit and any issues related to it.
9. Distribution of list: The report is then distributed to the people listed in distribution list like managers, senior managers, internal auditors, externalauditors of the organization etc.
10. Follow-Up:Follow up is performed after expected completion date to ensure that the corrective actions are taken as per agreed terms. A communication is received from the auditors conveying whether the organization has satisfactorily rectified the issues or further actions are required.

To reduce the Gap between organization and Successful Audit:

As audit involves efforts and money, least we expect the failure. So, to achieve the success in the audit there are three keys:

• Preparation: It is the most important and longest phase for an audit.It involves various departments of the organization to work together. An audit committee along with Finance committee finalizes auditors, considering factors like budget, timing, industry knowledge, accessibility etc.Organization should follow appropriate processes to ensure the success of the audit. Proper documents required by auditors should be maintained.
• Communication: Communication needs to be maintained between various departments of an organization throughout the audit process. A convenient date could be established for post fieldwork update in order to discuss initial findings. Coordination between departments is required so as to provide timely evidences whenever asked to furnish by the auditors.
• Review: Management should review all the reports provided by the auditors for errors, typos, incorrect names of committee members, incorrect dates etc.

Conclusion: An Audit is challenging but a necessity for an organization. Successful Audit can be achieved with right preparation, communication and review.

About Author:

 Madhumita Mishra is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, she actively contributes to the areas of Technology and Information Security. She can be contacted at: 

madhumita.mishra@spluspl.com

Project Management Framework

Project management framework is established for correct prioritization and co-ordination of all projects. This framework helps in defining the scope and boundaries of projects. It also helps in defining project methodology to be implemented and applied to each project undertaken.

A standard project should follow the below phases to ensure successful implementation.

1.Feasibility & Analysis

In this phase, the business sponsors, the stakeholders and project manager must be able to answer these core questions

• Is the project really required?

• How feasible will it be to the business?

• What will be the high level budget for the project?

• How beneficial will it be to the business?

In order to find answers to these questions, the business case will be created i.e. project abstract which will help in understanding the reasoning behind the project undertaken and answering the above questions.

2.Scope and Planning

Planning is the most important phase in the project lifecycle. Here, the project plan, project team, scope of the project, constraints and dependencies, timelines and deliverables for the project will be decided and documented within the project charter and finalized by the business sponsors.

3.Requirement Analysis and Design

During this phase, high level design and detailed level design documents will be prepared based on the requirements captured. DLD includes scope of the project, review of user requirements, low level design of the module, technology to be used etc. Along with the designs, the test plans for unit and integration testing will also be prepared during this phase.

4.Development and Infrastructure

In this phase, the application will be built and code review will be conducted to ensure its alignment with the requirements. Unit and Integration testing will be undertaken in this phase and corresponding test reports will be provided for review. Test environment will be set up and testing teams will be identified for each testing type to continue work in the testing phase.

5.Testing

Each step of testing has a different purpose. Different phases of testing help us to assess various parts of the module, and work towards testing the entire system as a whole. Below are different/important phases of testing.

6.Training and Go-Live preparation

The objective of this phase is to complete the final preparation (including reviewing all the required plans and end user training) to finalize the willingness to go live. Here, training will be provided to the users (IT and Business) as well as to the support team and feedback will be obtained from them in the end of the session. Also, the technical infrastructure will be validated and critical open issues will be resolved during this phase. On obtaining the approvals from the concerned stakeholders and business sponsors, the system will be prepared to Go-Live.

7.Go Live

Success of Go-live depends upon the preparation done in the previous phase. Here, all the plans will be updated and the concerned resources will be made aware of their roles and responsibilities.  In addition to this, mitigation plan will also be prepared for the risks and impacts identified during this phase. Ensure that the concerned teams involved do not deviate from the plan in the last moment.

8.Project Closure

This is the last phase in the project life cycle. Here, the project team will formally close the project and submit the final post implementation review to the business sponsors. It involves handing over the final deliverables to the business, submitting the final documentation to the customer, releasing resources and informing stakeholders of the closure of the project. It also involves documenting the lessons learnt and user feedbacks.

The point of all this is: how you begin and end your project will often determine the success or failure of your project and project management framework is more than just another way of doing business i.e. a particular roadway that is already documented.

Nisha Bhatt is a consultant in Systems Plus Pvt. Ltd. Within Systems Plus, She actively contributes to the areas of Technology and Information Security. She can be contacted at:nisha.bhatt@spluspl.com