Page 13 - Internal Auditor Middle East - December 2017

TO COMMENT on the article,
EMAIL the author at ahmed.malaji@LTRC.GOV.JO IT Control

Management Reports:
Creating management reports that include
Key Performance Indicators in terms of
the business disruption due to security
incidents, the number of installed,
maintained and developed systems,
and the time required to respond to the
detected security incidents.
Information System Security Testing:
There are many techniques that can
be used to examine the system and
detect vulnerabilities and weaknesses,
where a person can try penetrating the
information system (authorized person or
security consulting company) to identify
and handle gaps and vulnerabilities.
Role of internal auditor in ensuring the
effectiveness of detective controls:
The role of the internal auditor in
several technologies used to protect to normal when needed. assessing the detective controls
data and systems from manipulation, The role of the internal auditor in include ensuring whether or not the
including routers, firewalls, and intrusion ensuring the effectiveness of preventive administrative reports are prepared and
prevention systems. the audit trail/log file is effective, where
controls: the internal auditor can request a specific
• Main Router: It is used to connect the The role of the internal auditor is to sample from the log file analysis and
information system to the Internet.
ensure that procedures and techniques ensure that all transactions/activities in
• Firewalls: It works in conjunction with are used effectively and efficiently, for the file were made by authorized users,
the main router to filter information example: and match the privileges granted to the
transmitted in or out of the information Request the IT Department to provide a users with the user access authorization
system. list of all the addresses and websites that matrix.
• TCP / IP Protocol: It is used to accessed the information systems through Third: Corrective Controls:
communicate data in the form of the main router, as well as the websites
streams of bytes over the Internet. and addresses that were prevented from They include ensuring that all identified
Through this protocol, a set of rules entering through intrusion detection vulnerabilities and weaknesses have been
called the Access Control List “ACL” is systems and firewalls. This will be useful, corrected. These controls include:
used to determine the accepted/ rejected particularly upon noticing the repetition Computer Emergency Response Team
data streams. The most effective of certain websites and addresses.
data filtering technique is Intrusion Second: Detective Controls: (CERT): It consists of technical and
Prevention Systems. operations management specialists to
There are no preventive systems capable handle major incidents and regularly:
• Internal Firewalls: They are used to to completely protect the information
divide departments and divisions within systems from cyber attacks due to the • Recognize the problem;
an organization so that a particular continuous evolution of attackers’ methods • Contain the problem;
department or division cannot access
to the information systems of the other and inherited vulnerabilities in any • Solve the problem; and
division. information system. Hence, there should
be controls that detect any attempt to • Follow-up.
• Put key computers such as e-mail attack the information systems. Through
computers in a separate network outside detective controls, the effectiveness of Chief Security Officer: A specific
the company’s internal network. individual responsible for the
preventive controls systems is determined. organization’s scope of security. Such a
• There shall be special procedures for person should report to the COO or CEO
wireless network security. Log Analysis: It is a file that records all and be independent of the information
user’s activities, e.g. deleting, modifying,
Encryption: Encryption is the ultimate and adding database records. system management functions.
block in the development of preventive
controls, through which data is converted Intrusion Detection Systems (IDS): It Ahmed Salameh Al-Malaji, Accounting
from clear readable text to cipher creates a log of addresses and websites that Information Systems - Internal Auditor at the
unreadable data, and data can be returned are allowed to pass to the firewall. Land Transport Regulatory Authority / Jordan

DECEMBER 2017 INTERNAL AUDITOR - MIDDLE EAST 11