Understanding the above information should enable the reviewer to make an assessment of the significant threats to the LAN, together with the potential impact and probability of occurrence of each threat. Having assessed the risks to the LAN, the reviewer should evaluate the controls used to minimise the risks. To test physical security, a reviewer should perform the following: Inspect the LAN wiring closet and transmission wiring and verify they are physically secured. Observe the LAN file server computer and verify it is secured in a manner to reduce the risk of removal of components and the computer itself. Obtain a copy of the key logs for the file server room and the wiring closet, match the key logs to actual keys that have been issued an determine that all keys held are assigned to the appropriate people, for example, the LAN Administrator and support staff. Select a sample of keys held by people without authorised access to the LAN file server facility and wiring closet and determine that these keys do not permit access to these facilities. Look for LAN operating manuals and documentation not properly secured. To test environmental controls, a reviewer should visit the LAN file server facility and verify: Temperature and humidity are adequate. Static electricity guards are in place. Electric surge protectors are in place. Fire extinguishers are nearby. Observe the LAN file server facility, looking for food and beverage containers and tobacco products in the area and in the garbage cans. Observe the storage methods and media for backup and verify they are protected from environmental damage. To test logical security, a reviewer should interview the person responsible for maintaining LAN security to ensure that person is: Aware of the risks associated with physical and logical access that must be minimised. Aware of the need to actively monitor logons and to account for employee changes. Knowledgeable in how to maintain and monitor access. REPORTING Evaluation by Auditor After completing the testing phase, the auditor summarizes the results of the audit, draws conclusions on the individual and aggregate effect of identified IS control weaknesses on audit risk and audit objectives and reports the results of the audit. The auditor evaluates the individual and aggregate effect of all identified IS control weaknesses on the auditor’s conclusions and the audit objectives. The auditor evaluates the effect of any weaknesses on the entity’s ability to achieve each of the critical elements and on the risk of unauthorized access to key systems or files. Also, the auditor evaluates potential control dependencies. Audit Findings
Understanding the above information should enable the reviewer to make an assessment of the significant threats to the LAN, together with the potential impact and probability of occurrence of each threat. Having assessed the risks to the LAN, the reviewer should evaluate the controls used to minimise the risks. To test physical security, a reviewer should perform the following: Inspect the LAN wiring closet and transmission wiring and verify they are physically secured. Observe the LAN file server computer and verify it is secured in a manner to reduce the risk of removal of components and the computer itself. Obtain a copy of the key logs for the file server room and the wiring closet, match the key logs to actual keys that have been issued an determine that all keys held are assigned to the appropriate people, for example, the LAN Administrator and support staff. Select a sample of keys held by people without authorised access to the LAN file server facility and wiring closet and determine that these keys do not permit access to these facilities. Look for LAN operating manuals and documentation not properly secured. To test environmental controls, a reviewer should visit the LAN file server facility and verify: Temperature and humidity are adequate. Static electricity guards are in place. Electric surge protectors are in place. Fire extinguishers are nearby. Observe the LAN file server facility, looking for food and beverage containers and tobacco products in the area and in the garbage cans. Observe the storage methods and media for backup and verify they are protected from environmental damage. To test logical security, a reviewer should interview the person responsible for maintaining LAN security to ensure that person is: Aware of the risks associated with physical and logical access that must be minimised. Aware of the need to actively monitor logons and to account for employee changes. Knowledgeable in how to maintain and monitor access. REPORTING Evaluation by Auditor After completing the testing phase, the auditor summarizes the results of the audit, draws conclusions on the individual and aggregate effect of identified IS control weaknesses on audit risk and audit objectives and reports the results of the audit. The auditor evaluates the individual and aggregate effect of all identified IS control weaknesses on the auditor’s conclusions and the audit objectives. The auditor evaluates the effect of any weaknesses on the entity’s ability to achieve each of the critical elements and on the risk of unauthorized access to key systems or files. Also, the auditor evaluates potential control dependencies. Audit Findings
1311494623ISCA%20Notes.docx