General IT Controls -ITGC & GTAG

General IT Controls (GITC or ITGC)

Information Technology General Controls is a type of internal controls which is combined a set of policies that further ensure effective implementation of those controls in an organization. ITGC is also known as General Computer Controls (GCC).

Companies, auditors, business partners, and shareholders rely on ITGC’s as a key component of integrity over financial statements, business processes and information systems.

GITCs are a critical component of business operations and financial information controls. They provide the foundation for confidence on data, reports, automated controls, and other system functionality underlying business processes. The security, integrity, and reliability of financial information relies on proper access controls, physical facility, logical security, backup & recovery, computing infrastructure, change management, and operational controls.

The information within IT systems is critical for meeting many requirements in an organization such as,

• Financial information relied upon by decision makers that is maintained within the IT systems.
• Many user credential and data are stored in servers as well as in cloud infrastructure. 

In absence of ITGCs controls, employees can’t rely on the data and reports that IT systems provide us. 

When we talk about critical control areas of the above mentioned, let see a one of the control and detailed overview of it.

User Access Management 

User Access provisioning

Granting any new user access is the initial step for maintaining a controlled environment on the IT application. An inappropriate user access could result in posting of unauthorized financial transactions.

User Access De-provisioning

When employees are separated from the organization or leaves, their User credentials can be misused for processing of financial transactions or such operations. Such transactions would not only be unauthorized, but also lack accountability. Similarly, if an employee gets transferred to another division/ department and the old access provisioned to him doesn’t become obsolete, it leaves a chance to be used later.

Excessive access

Access to business application needs to be granted based on roles and responsibilities of users. Provision of access that is not in line with the user’s job responsibilities could lead to posting of unauthorized financials transactions.

Generic and Privilege access

Generic User IDs could lead to accountability issues for transactions processed using such IDs. Further, if privileged or administrative access is granted to Generic User IDs then such access can be misused for posting transactions that could have a pervasive impact on the financial statements.

User Access Review

While restructuring, user access provisioning is key to controlling the access management of an IT application; periodic user access review keeps the access aligned with respect to business requirements. In the absence of periodic user access review, excessive access may remain with the user or within the system. User access review also detects if there are any anomalies in access provisioned, de-provisioned or any other privilege/ excessive access.

Global Technology Audit Guide (GTAG)

The GTAG provides an overview of IT-related risks and controls for business executives, with which the audit activity will provide assurance about all important risks identified. It describes how to identify and assess the risks and standardized and system-specific controls relevant to business applications.

The GTAG controls released so far are as mentioned below

GTAG 1: Information Technology Controls

GTAG 2: Change and Patch Management Controls: Critical for Organizational Success

GTAG 3: Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment

GTAG 4: Management of IT Auditing

GTAG 5: Managing and Auditing Privacy Risks

GTAG 6: Managing and Auditing IT Vulnerabilities

GTAG 7: Information Technology Outsourcing

GTAG 8: Auditing Application Controls

GTAG 9: Identity and Access Management

GTAG 10: Business Continuity Management

GTAG 11: Developing the IT Audit Plan

GTAG 12: Auditing IT Projects

GTAG 13: Fraud Prevention and Detection in the Automated World

GTAG 14: Auditing User-developed Applications

GTAG 15: Formerly Information Security Governance--Removed and combined with GTAG 17

GTAG 16: Data Analysis Technologies

GTAG 17: Auditing IT Governance

While conducting ITGC audit, common questions should be asked and analyzed. 

For example

For Change Management, the questions can be asked such as:-

• How Change Management is planned?
• How Change plan is tested before the change?
• Are changes appropriately documented and approved by authorized personnel?
• Were necessary maintenance changes tested?
• Are appropriate segregation of duties in place for approving and making changes to the production environment?
• How are changes approved and tracked?
• What processes are in place to identify required control gates throughout the system development life cycle (e.g. peer review of code, software security scanning, third party approval).
• How you analyze impacts after a change occurred.

For further suggestions, please provide in the comment section.

-DR

Know about Cyber Squatting

Cyber Squatting

Cybersquatting is the practice of registering an Internet domain name that is likely to be wanted by another person, business, or organization in the hope that it can be sold to them for a profit. 

In Simple it is an unauthorized registration and use of Internet domain names that are identical or like trademarks, service marks, company names, or personal names. So, in the other word it is called domain squatting.

It involves the registration of trademarks and trade names as domain names by third parties, who do not possess rights in such names. Simply put, cyber squatters (or bad faith imitators) register trademarks, trade names, business names and so on, belonging to third parties with the common motive of trading on the reputation and goodwill of such third parties by either confusing customers or potential customers, and at times, to even sell the domain name to the rightful owner at a profit. As of study it was found that since 2012, nearly about 2,800 complaints have been filed involving domain name squatting.

That means You have spent many years and a lot of money building your business’s brand. But what you feel when someone could erase a lot of that customization by buying a low cost $10 domain that looks like yours?

There are several types of cybersquatting available such as;

• Typo squatting
• Celebrity Name
• TLDs Exploitation
• Misleading Subdomain
• Gripe Sites
• Look-Alike Domain
• Expiration Date Exploitation
• Homograph Attacks

To Prevent Cybersquatting, you need to check following techniques

• Consult your legal team and follow rules and procedures. There are acts documented such as Anti-Cybersquatting Consumer Protection Act (ACPA), World Intellectual property organization.
• Register Your organization or business quickly.
• Double-Check the Spelling of the Website to Avoid Typo squatting.
• Review your website in regular basis.
• Always check SSL/TLS certificate in the web application.

If you have further suggestions please comment below.

-DR

QR Code Security

Knowing QR Code Security

Have you scanned any QR code

Cybercriminals keep changing their phishing tactics as we become increasingly aware of their scams. The global cybersecurity team has identified QR code as a new email phishing tactic that you should be aware of. 

Quick-response codes (better known as QR codes) are two-dimensional barcodes used to enable users to access data or web-based resources (URLs). These codes are machine-readable codes that look like an array of black and white squares. These codes store website links or other information that can be read by the camera on your smartphone. You might have seen them recently at restaurants, small shops with digital menus or contactless payment have their QR code scan signage placed for payment. 

The actual QR Codes themselves are not designed to be hackable. This is because they are made using a square matrix with pixelated dots so these dots would have to be changed in order to be “hacked.”. The security issues arise from the information connected to the QR Code.

What is a QR-code phishing attempt?

Cybercriminals use QR codes within emails to encourage unsuspecting users to scan the codes, which then redirect them to malicious websites. Attackers can encode malicious links in the QR code that can lead e.g. to phishing sites. Sometimes attackers can embed malicious URLs containing custom malware into a QR code which could then exfiltrate data from a mobile device when scanned.

In many cases, QR-codes scams are designed to send you to what looks like an authentic login page and ultimately steal your login credentials.

How can you protect yourself?

Protecting against these malicious QR codes at all costs is very simple that,  never scan them.

• Particularly when scanning QR Codes from print materials in public places, there may be possible that the original QR Code has been replaced with a sticker of the dangerous one. Therefore, check twice that the QR Code is original.
• Do not scan a QR code you have received via email from an unknown or suspicious source. These codes are designed for physical signage, storefronts, flyers, and digital kiosks, not email.
• Only scan QR codes from trusted locations.

Stay Safe

-DR