IT AUDIT

• آشنایی با مفاهیم حسابرسی فناوری اطلاعات
• شناخت چارچوب های کلیدی برای حسابرسی فناوری اطلاعات
• آشنایی با ریسک ها و کنترل های فناوری اطلاعات
• توانایی طرح ریزی و اجرای حسابرسی فناوری اطلاعات

آشنایی اولیه با مفاهیم ممیزی مبتنی بر استاندارد ISO 19011 و همچنین حاکمیت شرکتی و فناوری اطلاعات مبتنی بر چارچوب های COBIT & COSO نیاز می باشد.

این دوره برای تمامی افراد ذیل جذاب می باشد. این افراد شامل موارد ذیل هستند:

• مدیران ارشد
• تحلیل گران
• مدیران فناوری اطلاعات
• مدیران طرح و برنامه
• مدیران حسابرسی داخلی

Introduction

• Trainers
• Purpose of this course and applicability
• Audience
• Internal Audit in the Organizational Structure
• Auditors’ Authorities
• A sample best practice:

Information Systems Governance

• Information Systems Governance Components

1. Information Systems Strategic Planning
2. Information Systems Governance Structures
3. Key Governance Roles and Responsibilities
4. Information Systems Committees
5. Information Systems Policy and Guidance
6. Documentation
7. Ongoing Monitoring

• Information Systems Governance Challenges and Keys to Success

Portfolios, Projects, and Operations

System Development Life Cycle

• Initiation Phase
• Development/Acquisition Phase
• Implementation Phase
• Operations/Maintenance Phase
• Disposal Phase
• Security Activities within the SDLC

Awareness and Training

• Awareness and Training Policy
• Components: Awareness, Training, Education, and Certification

1. Awareness
2. Training
3. Education
4. Certification

• Designing, Developing, and Implementing an Awareness and Training Program

1. Designing an Awareness and Training Program
2. Developing an Awareness and Training Program
3. Implementing an Awareness and Training Program

• Post-Implementation

1. Monitoring Compliance
2. Evaluation and Feedback

• Managing Change
• Program Success Indicators
• Incident Management

Performance Measures and SLA (internal / vendor)

• Metric Types
• Metrics Development and Implementation Approach
• Metrics Program Implementation

Information Technology Contingency Planning

• Step 1: Develop Contingency Planning Policy Statement
• Step 2: Conduct Business Impact Analysis
• Step 3: Identify Preventive Controls
• Step 4: Develop Recovery Strategies
• Step 5: Develop IT Contingency Plan
• Step 6: Plan Testing, Training, and Exercises
• Step 7: Plan Maintenance

Risk Management

• Risk Assessment

1. Step 1 – System Characterization
2. Step 2 – Threat Identification
3. Step 3 – Vulnerability Identification
4. Step 4 – Risk Analysis
5. Control Analysis
6. Likelihood Determination
7. Impact Analysis
8. Risk Determination
9. Step 5 – Control Recommendations
10. Step 6 – Results Documentation

• Risk Mitigation
• Evaluation and Assessment

Security Violations

Incident Response

• Preparation

1. Preparing for Incident Response
2. Preparing to Collect Incident Data
3. Preventing Incidents

• Detection and Analysis
• Containment, Eradication, and Recovery
• Post-Incident Activity
• Knowledge Management
• SLA and Monitoring

Change Management

• Change Initiation
• Change CAB approval
• Change Plan
• Change Impact Analysis
• Change Resources
• Change Role back Plan
• Emergency Change
• Change Finalization
• Retrospective Change

Configuration Management

• CMDB
• Baseline
• Configuration Changes
• Configuration Management Process

Procurement and Asset Management

Business Continuity Management

Network

• Design

1. Boundaries of the Organization Digital Structure
2. Physical Boundaries and Security
3. Firewall
4. IDS/ IPS

• IP Ranges
• Access
• Log / Audit Trail
• Settings
• Server Room
• Spare Management

Application

• Access Management

1. Responsibilities of Access Grantors
2. Credentials Propagation
3. Levels of Access
4. View of Pages
5. View/ Edit/ Delete of Categories
6. View/ Edit/ Delete of Sub-Categories
7. Requesting Access
8. Access Review
9. Access Revoke

• Code Hardening
• Maintenance

1. Versioning
2. Patch
3. User Friendly Design

Operating Systems controls

• Access Management

1. Responsibilities of Access Grantors
2. Credentials Propagation
3. Levels of Access
4. Level
5. Intranet
6. Domains
7. Work groups
8. Internet
9. USB/ CD
10. Outgoing Emails
11. High Level Access
12. Local Admin
13. Domain Admin/ Enterprise Admin
14. Privilege
15. Read
16. Edit/ Update
17. Delete
18. Password Policy
19. Remote Access
20. Requesting Access
21. Access Review
22. Access Revoke

• Antivirus

1. In house Systems
2. Temp Systems
3. Vendor Systems
4. gusts Systems

• Authorized Applications
• Patch Management
• Audit Trails

1. Generation
2. Access
3. Retention
4. Review

• Backup

1. Generation
2. Actual OS
3. Virtual OS
4. Test/ Restore
5. Access
6. Retention
7. Redundancy

• Services
• File Sharing

1. Folders
2. SharePoint

Database Controls

• Access Management

1. Responsibilities of Access Grantors
2. Credentials Propagation
3. Levels of Access
4. Login / Account/ Database
5. Privilege
6. Read
7. Edit/ Update
8. Delete
9. Password Policy
10. Requesting Access
11. Access Review
12. Access Revoke

• Database in the Domain
• Patch Management
• Audit Trails

1. Generation
2. Access
3. Retention
4. Review

• Backup

1. Generation
2. Actual OS
3. Virtual OS
4. Test/ Restore
5. Access
6. Retention
7. Redundancy

Sources of Data/ Raw Data

APM

• RACI
• Mandate
• Auditing Process Background
• Objectives
• Risks and Control Criteria
• Scope
• Scope Exceptions
• Review Approach
• Reporting
• Key Audit Team Contacts

Opening Meeting

• Scope
• Initial Documents
• Auditee Contact People

Audit Plan

• Risks
• Best Practices
• Actual Business Practices
• Adequacy Check
• Audit Test
• Test Result
• Residual Risk

Execution of testing

• Communication
• Info Request/ Gathering
• Evidences
• Analysis

1. Intervals of Information
2. Info generators vs Info users
3. Analysis Tools

• Involvement of Managers
• Test Result Documentation

1. Completeness and accuracy
2. Referencing and Evidence

Report

• Drafting
• Management Exit Meeting

1. Describing
2. Action Plan
3. Scheduling

• Higher Manager (CEO) Exit Meeting

1. Describing Major Items
2. Review and Confirmation of Action Plan
3. Review and Confirmation of Scheduling

• Report Finalization
• Reporting to Board of Directors

Follow Up

به شرکت کنندگان در این دوره ی آموزشی گواهی حضور از سوی شرکت IT HOUSE اعطا خواهد شد

تماس بگیرید

ندارد.