Binu Anna Eapen

I agree with you Yu Ming that no matter what security precautions are taken, employees impose threat to the system. Educating employees help in reducing the risk.

For example one table contains information of temple ID and name and the health insurance policy associated and another table has temple ID and the fees due information, RDBMS is able to find relation between the tables and associate the temple ID to both the health insurance policy and the fees dues.

In file system, if authorization levels had to be different, for example L1 user having access to read and L2 user having the access to write then 2 different files had to be present one with L1 level access and one with L2 level of access. But in RDBMS the access control which delegates different levels of access to the same data provides…[Read more]

2. What is an information risk profile? How is it used? Why is it critical to the success of an organization’s risk management strategies and activities?

The Business and Information Risk management security professionals disagree to the risk factors because the business believes in taking risk to achieve their business activity and the IRMS p…[Read more]

Yes totally, I agree with you that assertions are important to anyone who reviews and uses the company’s financial statements.

In the example mentioned if the company XYZ’s employee has a brother who can supply the raw materials that the company is looking for, is it wrong to give the contract to that brother? Is not the purpose of getting raw materials met? If there are benefits to the company as a whole in doing a business with this seller will this still be a risk?

Not only in paper work even in data entry also wrong information can be filed.

By human error it can also mean deleting an entry by mistake or falsely entering wrong information as well.

New regulation proposed by the Governor to protect New York State from Cyberattacks:

The regulation requires banks, insurance companies, and other financial services institutions regulated by the State Department of Financial Services to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and…[Read more]

List risks associated with database management systems (DBMS)
Ans: The common risks associated with DBMS are:
1. Excessive privileges: If a person is given more privileges than is required, he/she may misuse the access. Or failure to remove access for an employee who leaves the project or organization.
2. Legitimate privilege abuse: Users may…[Read more]

I also think that Assertions are important to investors, suppliers, bank, customers, oversight bodies, share holders and also to stock market. Because people buy shares or invest in the company based on the company’s financial position and performance.

Probably. I thought that if all the transactions are being recorded in time then some sort of accuracy would be maintained. Well, as you said it is not necessary because there could be human error or even misrepresentation of data.

Key benefits of relational databases vs traditional file system?
Benefits of relational databases:
1. Query ability: In file system, the information was stored in file and to retrieve it the entire file had to be scanned. For doing this query had to be written step by step in programming language. Whereas in database, the query ability helps in…[Read more]

What are key characters of relational database management systems?
1. Data Integrity: DBMS maintains consistency of data
2. Rollback: Revert the previously executed command
3. Security: No unauthorized user can access the data
4. Concurrency control: Multiple user access
5. Backup: Backup of the data can be stored for security
6. Data…[Read more]

2.In class we discussed several dimensions of Management Assertions. Which do you believe is the most important? Why?

Management Assertion are the statement or fact that the management claim. Management Assertion dimensions is a measure to check the validity.

Dimensions of Management Assertions:…[Read more]

Audit universe can be centralized and decentralized IT functions, Business Application or regulatory compliance. Learn from the IT manager how the responsibilities are divided and learn about the existing known issues. Check if there could be any inherent risk. Understand the benefits of doing an audit in that area and how it can benefit the organization.

I guess these framework provides a standard to start with. So an organization may choose to follow ITIL alone or COBIT alone or both or even modify to establish a better framework meeting the business requirement.. COBIT and ITIL are complementary and work hand in hand.

Yes. An auditor can suggest or recommend the action plan. But finally it should be the customer who takes the decision whether they want to accept it or not.