Worksheet: Information Technology Audit and Control

Week 5

Worksheet 3: Information Technology Audit and Control

Course Learning Outcome(s)

· Explain the use of standards and frameworks in a compliance audit of an IT infrastructure.

You have been hired as an auditor for a local university. The university is preparing to undergo an accreditation inspection to validate security controls are in place and adhered to and that data is protected from unauthorized access from both people internal and external to the organization.

As the auditor, you play a key role in ensuring regulations and compliances are met. As the organization prepares for its three-year accreditation, you are tasked with gathering the artifacts that will be used to build the accreditation package.

Your university has an IT staff consisting of the following personnel:

CIO – Overall in charge of network operations and cyber security.

Information Security Officer – Implements and manages cyber security policies.

System Analysts – Tasked with monitoring security features implemented on hosts (laptops, desktops) and server side security (NIPS, NIDS).

Auditors – Tasked with validating baseline compliance of systems in accordance with Security Technical Information Guide (STIG), NIST, and Federal, state and local policies, regulations and laws.

System Administrators – tasked with managing data and applications on servers.

Network Administrators – tasked with managing all switches, routers, firewalls, and sensors.

Desktop Administrators – Tasked with administering hardware and software to users and managing the day to day trouble calls for users.

Help Desk – Acts as the liaison between the customer and administrators through the use of a Ticket Management System (TMS).

To ensure separation of duties, all employees are designated in writing the roles and responsibilities for which they are responsible. Terminated employees are debriefed and physical and logical access controls are removed to prevent further access.

Users are defined as those individuals that don’t have any elevated privileges that can affect the configuration of a computer or networked device. All users, prior to gaining access to the network, must read and sign a user agreement outlining the rules and terms of use. These forms are reviewed annually by the ISO and stored digitally on the network for three years from the date of termination. The organization defines a time period for each type of account after which the information system terminates temporary and emergency accounts (14 days) and all inactive accounts (accounts that have not been accessed for 45 days) are suspended and after 90 days, removed from Active Directory.

Advanced users are those users who possess the rights and credentials to physically make a configuration change to a networked device or direct a configuration change through positional authority. All advanced users complete the same initial user agreement as standard users as well as a Non-Disclosure Agreement (NDA). There is no required training needed for standard and advanced users.

For automated account management, the university uses Active Directory (AD).

Onboarding new users and managing access follows this process:

1. When a user arrives, they visit the help desk in person and submit a request to have an account created.

2. All users must read and sign a user agreement outlining the rules and terms of use before they are given network access.

3. These forms are reviewed annually by the ISO and stored digitally on the network for three years from the date of termination. The organization defines a time period for each type of account after which the information system terminates temporary and emergency accounts (14 days); all accounts that have not been accessed for 45 days are suspended and, after 90 days, removed from Active Directory.

4. The help desk creates a ticket that includes the signed user agreement and assigns the ticket to the system administrators.

5. The system administrator (SA) creates the account and assigns the user access based on their role.

6. Users are assigned least privilege when an account is created.

7. Discretionary access control is created for university departments to allow internal users to share information among defined users. These processes aren’t audited and Active Directory has become a massive database containing accounts of users who are no longer employed by the organization as well as their files. No negative impact has been observed by this.

8. System admins track when users log in and log out so security and software patches can be pushed to the users' machines. This tracking mechanism also contributes to nonrepudiation in the event of a cybersecurity incident. Additionally, the machine is configured to log the user out if there is no activity on the user’s computer for two minutes.

9. After three failed login attempts, the account will be locked and will require the user to visit the help desk in person to validate their credentials and unlock the account.

As the organization prepares for its three-year accreditation, you are tasked with gathering the artifacts and complete an assessment which will be used to build the accreditation package. The accreditation package that will be submitted is will be under the Risk Management Framework (RMF) and will be utilizing the controls found in NIST Publications 800-53 and 800-53A. The controls that are to be audited have been provided to you. We will start with addressing the Access Control Policy and Procedure (AC-1).

For this assignment, complete the following tasks within this worksheet.

1. Refer to the scenario above and NIST 800-53 and 53A for reference when completing the spreadsheet contained in this worksheet. Ensure that you answer based on the information provided to you based on the Assessment Objective listed in the control and the data provided to you in the scenario.

1. For example;

Control	Assessment Objective	Examine	Test / Interview	Compliant / Non-Compliant
AC-1.1	The organization develops and formally documents access control policy; the organization access control policy addresses: purpose; scope; roles and responsibilities; management commitment; coordination among organizational entities; and compliance; the organization disseminates formal documented access control policy to elements within the organization having associated access control roles and responsibilities; the organization develops and formally documents access control procedures the organization access control procedures facilitate implementation of the access control policy and associated access controls; and the organization disseminates formal documented access control procedures to elements within the organization having associated access control roles and responsibilities.	Access control policy and procedures; other relevant documents or records.	Organizational personnel with access control responsibilities.	Compliant – organization documents access control policy and is implemented based on user role and organizational policies.

Information Technology Audit and Control Table to be completed:

Control	Assessment Objective	Examine	Test / Interview	Compliant / Non-Compliant
AC-1.2
AC-2.1
AC-2.(2).1
AC-2.(3).1
AC-2(5).1
AC-3.1
AC-3(2).1
AC-3(4).1
AC-5.1
AC-6.1
AC-7.1