Development Editor: Kelly Talbot
Technical Editors: Brady Pamplin, Jason James
Production Editor: Rebecca Anderson
Copy Editor: Judy Flynn
Editorial Manager: Mary Beth Wakefield
Production Manager: Kathleen Wisor
Associate Publisher: Jim Minatel
Media Supervising Producer: Rich Graves
Book Designers: Judy Fung and Bill Gibson
Proofreader: Kim Wimpsett
Indexer: Jack Lewis
Project Coordinator, Cover: Brent Savage
Cover Designer: Wiley
Cover Image: ©Getty Images Inc./Jeremy Woodhouse

Published simultaneously in Canada

ISBN: 978-1-119-05624-9
ISBN: 978-1-119-05625-6 (ebk.)
ISBN: 978-1-119-05640-9 (ebk.)

Manufactured in the United States of America

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2015960605

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CISA is a registered trademark of Information Systems Audit and Control Association, Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

About the Contributors

Brian T. O'Hara, CISA, CISM, CRISC, CISSP, is the Information Security Officer (ISO) for Do it Best Corp. With over 20 years' experience providing security and audit services he has served as the information security officer for Fortune 500 companies and has worked in PCI, healthcare, manufacturing, and financial services providing audit and security advisory services. Prior to entering the field of IS audit, Mr. O'Hara served as program chair for information technology at the largest community college in the country where he helped develop the first NSA Two Year Center of Academic Excellence in Information Security. In addition to contributing to the CISA study guide, he also served as technical editor on the Wiley ISC CISSP and SSCP study guides. He currently serves as the president of the Indiana chapter of ISACA and the Indiana Members Alliance of Infragard, a public-private partnership with the FBI aimed at protecting the nation's critical infrastructures.

Allen Keele is a recognized subject matter expert, consultant, and business systems architect for enterprise risk management (ERM), information security management, governance/risk/compliance (GRC), business continuity management (BCM), fraud control, and purchasing & supply management. He is a 6-time published author, and has achieved over twenty-five professional accreditations including CISA, CISM, CISSP, ISO 31000 CICRA, ISO 27001 CICA, ISO 27001 Lead Auditor, ISO 22301 Certified Business Continuity Manager, and Certified Fraud Examiner. Allen is often featured as a speaker at conferences, expositions, and functions for professional organizations and associations such as the Information Systems Audit and Controls Association (ISACA), the Institute for Internal Auditors (IIA), Ernst & Young, and many others.

Since founding Certified Information Security (www.certifiedinfosec.com) in 1999, Allen has led CIS in providing valuable training and consulting services focusing on business strategy, policy, and system development, deployment, and auditing for enterprise risk management, business continuity management, information security management, fraud control management, and purchasing & supply chain management. His scope of practical expertise includes:

Leading client organizations' cross-functional committees to develop standards-conforming program architecture and strategy for ERM, GRC, BCM, information security, and fraud control to support organizational objectives, as well as to fulfil industry-specific compliance requirements;
Enabling clients to establish the necessary strategy, management leadership, policies, and protocols to support organizational certification for ISO 22301 BCM, ISO 27001 Information Security, ISO 9001:2015 Quality Management Systems, and ISO 14001:2015 Environmental Management Systems;
Delivering critical group executive development sessions to establish requisite specialized management competence throughout the enterprise;
Leading program project kick-off and deployment;
Assisting organizations in establishing defined risk context, criteria, and scoping necessary for operational risk assessments and business impact assessments;
Assisting organizations in developing a formal risk assessment and risk treatment methodology; and
Leading risk owners and auditors to perform operational risk assessments, information security assessments, fraud risk assessments, and business continuity planning assessments.

Allen Keele can be contacted at CIS headquarters at +1 (904) 406-4311, or at allenkeele@certifiedinfosec.com.

Contents

Introduction

Assessment Test
Answers to Assessment Test

Chapter 1 Secrets of a Successful Auditor

Understanding the Demand for IS Audits
Understanding Policies, Standards, Guidelines, and Procedures
Understanding Professional Ethics
Understanding the Purpose of an Audit
Differentiating between Auditor and Auditee Roles
Implementing Audit Standards
Auditor Is an Executive Position
Understanding the Corporate Organizational Structure
Summary
Exam Essentials
Review Questions

Chapter 2 Governance

Strategy Planning for Organizational Control
Overview of Tactical Management
Planning and Performance
Overview of Business Process Reengineering
Operations Management
Summary
Exam Essentials
Review Questions

Chapter 3 Audit Process

Understanding the Audit Program
Establishing and Approving an Audit Charter
Preplanning Specific Audits
Performing an Audit Risk Assessment
Determining Whether an Audit Is Possible
Performing the Audit
Gathering Audit Evidence
Conducting Audit Evidence Testing
Generating Audit Findings
Report Findings
Conducting Follow-up (Closing Meeting)
Summary
Exam Essentials
Review Questions

Chapter 4 Networking Technology Basics

Understanding the Differences in Computer Architecture
Selecting the Best System
Introducing the Open Systems Interconnection Model
Understanding Physical Network Design
Understanding Network Cable Topologies
Differentiating Network Cable Types
Connecting Network Devices
Using Network Services
Expanding the Network
Using Software as a Service (SaaS)
The Basics of Managing the Network
Summary
Exam Essentials
Review Questions

Chapter 5 Information Systems Life Cycle

Governance in Software Development
Management of Software Quality
Overview of the Executive Steering Committee
Change Management
Management of the Software Project
Overview of the System Development Life Cycle
Overview of Data Architecture
Decision Support Systems
Program Architecture
Centralization vs. Decentralization
Electronic Commerce
Summary
Exam Essentials
Review Questions

Chapter 6 System Implementation and Operations

Understanding the Nature of IT Services
Performing IT Operations Management
Performing Capacity Management
Using Administrative Protection
Performing Problem Management
Monitoring the Status of Controls
Implementing Physical Protection
Summary
Exam Essentials
Review Questions

Chapter 7 Protecting Information Assets

Understanding the Threat
Using Technical Protection
Summary
Exam Essentials
Review Questions

Chapter 8 Business Continuity and Disaster Recovery

Debunking the Myths
Understanding the Five Conflicting Disciplines Called Business Continuity
Defining Disaster Recovery
Defining the Purpose of Business Continuity
Uniting Other Plans with Business Continuity
Understanding the Five Phases of a Business Continuity Program
Understanding the Auditor Interests in BC/DR Plans
Summary
Exam Essentials
Review Questions

Appendix Answers to Review Questions

Chapter 1: Secrets of a Successful Auditor
Chapter 2: Governance
Chapter 3: Audit Process
Chapter 4: Networking Technology Basics
Chapter 5: Information Systems Life Cycle
Chapter 6: System Implementation and Operations
Chapter 7: Protecting Information Assets
Chapter 8: Business Continuity and Disaster Recovery

Advert

EULA

List of Illustrations

Chapter 1

Figure 1.1 The relationship between policies, standards, guidelines, and procedures
Figure 1.2 World Trade Organization creates parent class controls.
Figure 1.3 Where IT control standards originate
Figure 1.4 Sample of Regulations and Standards
Figure 1.5 A typical business organizational chart
Figure 1.6 A typical auditing firm organizational chart

Chapter 2

Figure 2.1 IT alignment with organizational objectives
Figure 2.2 Reporting structure demonstrates IT’s purpose.
Figure 2.3 Organizational structure of a steering committee
Figure 2.4 The IT steering committee process
Figure 2.5 Balanced scorecard with four perspectives
Figure 2.6 Executives involved at the IT strategy level
Figure 2.7 Overlapping project process groups
Figure 2.8 Typical IT organizational structure
Figure 2.9 Tactical level in the organization
Figure 2.10 Capability Maturity Model
Figure 2.11 Excerpt of CMM to report metrics
Figure 2.12 Benchmarking process

Chapter 3

Figure 3.1 Overview of the audit process
Figure 3.2 Understanding the business requirements
Figure 3.3 Risk analysis process flowchart
Figure 3.4 Audit samples
Figure 3.5 The evidence life cycle

Chapter 4

Figure 4.1 Computer hardware architecture
Figure 4.2 Single-CPU system with multiple users (time-sharing)
Figure 4.3 Multiple-processor architecture
Figure 4.4 Multitasking systems (single-processor and multiprocessor workload)
Figure 4.5 Computer operating system
Figure 4.6 Comparing mainframes, minicomputers, and microcomputers
Figure 4.7 Computer processing market share
Figure 4.8 Graphical diagram of RAID disk systems
Figure 4.9 Hardware input and output ports
Figure 4.10 Mnemonic for seven layers of the OSI model
Figure 4.11 Mnemonic for TCP/IP layers
Figure 4.12 OSI processing of headers and data
Figure 4.13 OSI Physical layer
Figure 4.14 OSI Data-Link layer
Figure 4.15 Viewing your MAC address
Figure 4.16 Layer 2 communicates by MAC address.
Figure 4.17 OSI Networking layer
Figure 4.18 Dividing IP addresses into subnets
Figure 4.19 Using IP address resolution to find a MAC address (ARP)
Figure 4.20 Using the Reverse Address Resolution Protocol (RARP) to find the IP address
Figure 4.21 Static routing is analogous to using highway signs.
Figure 4.22 False network route via user PC
Figure 4.23 OSI Transport layer
Figure 4.24 OSI Session layer
Figure 4.25 OSI Presentation layer
Figure 4.26 OSI Application layer
Figure 4.27 OSI communication between systems
Figure 4.28 First computer networks
Figure 4.29 Bus topology
Figure 4.30 Star topology
Figure 4.31 Practical application of the star topology
Figure 4.32 Ring topology
Figure 4.33 Full mesh network (N -1 design)
Figure 4.34 Partial mesh network
Figure 4.35 Coaxial cable
Figure 4.36 Twisted-pair wiring
Figure 4.37 Fiber-optic cable
Figure 4.38 DNS address lookup
Figure 4.39 How DHCP works
Figure 4.40 DHCP and the router issue
Figure 4.41 Router with DHCP helper address
Figure 4.42 Expanding the network
Figure 4.43 Comparison of some of the different telephone circuits
Figure 4.44 First-generation filter
Figure 4.45 Application proxy with filter
Figure 4.46 ACL in a fifth-generation firewall in an OS kernel
Figure 4.47 Firewall generations compared to the OSI model
Figure 4.48 Firewall-screened host
Figure 4.49 Dual-homed host
Figure 4.50 Screened subnet, also known as DMZ subnet
Figure 4.51 Separation of duties with firewalls
Figure 4.52 Three common types of VPNs
Figure 4.53 IPsec VPN is designed to protect traffic crossing the Internet.
Figure 4.54 VPN using IPsec transport versus tunnel mode
Figure 4.55 VPN with separation of duties
Figure 4.56 Basic wireless network
Figure 4.57 Firewall protecting against wireless access points
Figure 4.58 Remote access server (RAS)
Figure 4.59 Difference between WEP and 802.1x
Figure 4.60 Intrusion detection and prevention system
Figure 4.61 How Syslog works
Figure 4.62 How RMON2 works

Chapter 5

Figure 5.1 Simplified waterfall model (W. W. Royce)
Figure 5.2 Boehm’s modified waterfall model
Figure 5.3 Spiral model for software life cycle
Figure 5.4 Seven phases of the SDLC
Figure 5.5 Calculating function points
Figure 5.6 Entity-relationship diagram
Figure 5.7 Program flowchart
Figure 5.8 1-10-100 rule of quality
Figure 5.9 Planning for quality during design (Plan-Do-Check-Act)
Figure 5.10 Pseudocoding inside a 4GL development tool
Figure 5.11 Generation levels of programming languages
Figure 5.12 Compiled programs versus scripts
Figure 5.13 Example of client entertainment database
Figure 5.14 Example database showing data relationships
Figure 5.15 Database rows, also known as tuples
Figure 5.16 Database columns, also known as attributes
Figure 5.17 Concept overview of program objects
Figure 5.18 Example of object classes
Figure 5.19 Overview of data warehouse and data mart in a DSS
Figure 5.20 E-commerce programs

Chapter 6

Figure 6.1 Overview of ITIL’s purpose
Figure 6.2 Separation of duties
Figure 6.3 Basic types of measurement metrics
Figure 6.4 Change management process
Figure 6.5 Tumbler lock
Figure 6.6 Electrical power conditions
Figure 6.7 Power system overview
Figure 6.8 Wet pipe system
Figure 6.9 Dry pipe system
Figure 6.10 Gas chemical system
Figure 6.11 Typical computer room

Chapter 7

Figure 7.1 Medieval defensive design
Figure 7.2 Bot-net concept of remote-control attacks
Figure 7.3 Using reCAPTCHA for input validation to reduce automated submission
Figure 7.4 Typical implementation of middleware in computer programming
Figure 7.5 Cross-network connectivity
Figure 7.6 Records management classification process
Figure 7.7 Database views for security
Figure 7.8 Smart card with embedded microchip
Figure 7.9 Hard authentication token
Figure 7.10 Using fingerprint data (minutiae)
Figure 7.11 Using palm print data
Figure 7.12 Retina scanning
Figure 7.13 Iris scanning
Figure 7.14 Face recognition
Figure 7.15 Voice pattern recognition analysis in biometrics
Figure 7.16 Template generator creates biometric data
Figure 7.17 Equal error rate versus crossover
Figure 7.18 Kerberos single sign-on
Figure 7.19 Symmetric-key cryptography
Figure 7.20 Getting a PKI digital certificate
Figure 7.21 Using a PKI certificate
Figure 7.22 Generating a digital signature
Figure 7.23 Verifying a digital signature
Figure 7.24 Using a digital envelope
Figure 7.25 DRM uses public-key encryption to enforce digital rights.
Figure 7.26 Email security issues
Figure 7.27 Security protocols and where they fall within the OSI model
Figure 7.28 Using digital certificates to authenticate computers
Figure 7.29 Types of e-commerce
Figure 7.30 Voice over IP network

Chapter 8

Figure 8.1 Business continuity integrates smaller departmental plans.
Figure 8.2 The best practices in business continuity planning according to FEMA
Figure 8.3 Selecting each business process to protect in separate activities
Figure 8.4 Relationships among business processes
Figure 8.5 Risk assessment worksheets for summary and detail
Figure 8.6 Geographic threat map for Texas
Figure 8.7 Recovery options compared to time
Figure 8.8 Roles in the Incident Command System
Figure 8.9 Creating the plan structure and content
Figure 8.10 The life cycle of testing and exercising the plan

CISA^®: Certified Information Systems Auditor

`Study Guide`

Fourth Edition

About the Author

About the Contributors

About the Technical Editor

Study Guide Fourth Edition

`Study Guide`

Fourth Edition