Information Technology: Systems, Controls and Cyber Resilience
Concepts to understand
IT questions test your understanding of information systems, data integrity, security and control. Know the CIA triad: confidentiality, integrity and availability. Understand logical access controls, authentication and authorisation, segregation of duties, input and processing controls, audit trails, backup and restoration, disaster recovery and business continuity planning, encryption, firewalls, ERP systems, cloud computing, e-commerce risks and data protection principles.
Common traps
- Mixing confidentiality, integrity and availability. Encryption primarily protects confidentiality; an audit trail supports integrity and accountability; backups support availability.
- Confusing disaster recovery, which restores IT services, with business continuity, which keeps critical business functions running.
- Treating a backup as a recovery plan without testing restoration.
- Giving system administrators both the ability to change data and to delete audit logs, which destroys segregation of duties.
- Assuming cloud providers accept all responsibility. The organisation remains accountable for its data.
- Classifying a password policy as detective when it is preventive.
- Ignoring the difference between RTO, the maximum acceptable downtime, and RPO, the maximum acceptable data loss.
Worked example
A firm can tolerate four hours of system downtime and can afford to lose no more than 15 minutes of transactions. Its recovery time objective is four hours and its recovery point objective is 15 minutes. Backups must therefore be taken at intervals no longer than 15 minutes, and the recovery plan must restore service within four hours. A nightly backup alone would fail the RPO.
Rule of thumb
Use the 3-2-1 backup principle: at least three copies of data, on two different media, with one copy off-site. Test restoration, review access rights regularly, and log privileged activity.