Ariana Levinson

The OSI model lays out and describes the characteristics of the communications functions that underlie any generic telecommunication or computing system.
(1) Physical – conveys the bit stream through the network at the mechanical and electrical level.
(2) Data Link – data packets are encoded and decoded into bits. It furnishes transmission p…[Read more]

In today’s world, with the traditional “work at the office” model of job productivity being shifted to a work at home model, having a VPN has become more important than ever. If you work remotely you must do so securely. A VPN enables secure, safe remote login to systems which in turn enables companies to offer flexible time to employees and expan…[Read more]

I’m sure cost is a factor. There are some very costly solutions that are available and I’m sure they work well, but why pay more than you need to if the end result is basically the same? Additionally Ian mentioned an app on the ipad. That requires a company to not only outfit their team with macs (very expensive), but it requires them to also…[Read more]

Absolutely, preventative controls similar to “parental controls” should be used to block websites that are not approved by the company. I also believe “getting caught” can be a strong deterrent for future misuse. There could be a type of alerting/logging system set up that monitored what sites a user visited. If a site they visited is on a list of…[Read more]

I agree, the security aspect of VPN is incredibly important. With more and more people working remotely, the risk of security breach increases. There are some people who, if their systems allow it, will do their work over a Starbucks connection, which of course is not secure at all and very, very risky so far as the risk of data loss goes. VPN…[Read more]

Oh absolutely. When it comes to outsourcing and compliance, things can get a bit murky. If we’re utilizing a SaaS solution and the vendor is managing the DB and OS layers, how do we audit that? We can’t just go into the vendor’s office and demand all of their records and evidence. My company examines the SOC reports (SSAE16s) put out by our…[Read more]

i agree that malicious employees can present a big problem in security, however sometimes the employee who does the most damage is the clueless employee. I know a friend’s business was almost shuttered because an employee clicked on a link in a spam email and it released ransomware on the network that captured all of their financial records. They…[Read more]

As a financial auditor (of sorts), it is crucial for auditors to be competent with technology as it is within technology that all of our modern day financial information resides. Businesses don’t keep their money in cash, they don’t keep their “books” and other finance related info on paper. Everything is in computers, and since that information…[Read more]

I agree that patches and updates are critical to keeping the OS layer in good shape. Patches are released for a reason – because someone found a bug and it needs to be fixed. If that bug is related to security, then by not patching you’re basically saying that you know your risk of exploitation is high and you know there’s a way to fix it, but you…[Read more]

Q: Why is so important to protect operating systems?

A: If you think of a computer system as a pyramid, the operating system is the base upon which everything else rests. It’s the foundation for everything to operate. It manages system memory, software, hardware, and important/sensitive information that is needed to keep everything running. T…[Read more]

At least towards the issue concerning hackers, there are all sorts of vulnerability management tools out there to help businesses control their risk and patch known vulnerabilities (Qualys, Nessus, Imperva, etc.) If I were to implement a vulnerability management program as a control to prevent hacking, it would involve continuous scanning,…[Read more]

Because these DBs are so complex and changes made can have far reaching impacts, it would be very important during an audit to take a close look at the change management policies and procedures to ensure they cover all aspects of the change control process, and to make sure that the changes being made do follow all parts of the documented process.…[Read more]

Oh absolutely I agree clients past and current should be interviewed. This process is one looonnnngg job interview for the vendor that would like the contracts and there should be a full list of references provided and a good number of them should be contacted to vet them and their experiences working with the vendor in question.

Q: Benefits and Risks of Outsourcing

A:
Benefits: Obviously one of the largest benefits of outsourcing IT services (and really any other kind of services) is the cost savings that can be gained. It is true that work can be done more cheaply elsewhere than in-house or even in-country. It is also saves time and resources (which again eventually…[Read more]

What are key characters of relational database management systems?

-Use tables to store information
-Data is represented in columns (fields) and rows (records)
-Primary and Foreign Keys; used for building relationships between tables
-Typically utilizes SQL for building, maintaining, and querying
-Must support at least one language

Key…[Read more]

Questions 1 and 2:. Explain the key IT audit phases and the key activities within each phase.

1. Planning
a. Scoping to determine what areas should be under audit and what the present risks are within the applicable areas.
b. Determine what, if any, internal controls already exist
c. Work with the customer to figure out when…[Read more]