Information Systems Security, Audit and Controls
Core concepts
Security rests on the CIA triad: confidentiality, integrity and availability, supported by authentication, authorisation, non-repudiation and accountability. Threats include viruses, worms, Trojans, ransomware, spyware, rootkits, logic bombs, phishing, social engineering, denial of service, man-in-the-middle attacks and SQL injection, plus physical and human threats. Controls are preventive, detective or corrective, and administrative, technical or physical.
Cryptography and access
Symmetric encryption uses one shared key and is fast (AES, DES); asymmetric encryption uses a public/private pair (RSA). Hashing is one-way and produces a fixed-length digest (SHA family) for integrity checking. A digital signature is a hash encrypted with the sender's private key. Authentication factors are something you know, have or are. Defence tools include firewalls, IDS (detects and alerts), IPS (blocks), VPNs, antivirus, access control lists, least privilege, segregation of duties, backups and audit trails.
Auditing
Audit types include internal, external, operational, compliance and IS audit. Auditors gather evidence, adopt a risk-based approach and use computer-assisted audit techniques. Controls include input controls (validation, batch and hash totals, check digits), processing controls and output controls.
Trap: hashing is not encryption and cannot be reversed. Signing uses the sender's private key and verification uses the sender's public key, the reverse of the keys used for confidential encryption.
Worked example: to sign and then conceal a message, the sender hashes it, encrypts the hash with their own private key, then encrypts the whole package with the receiver's public key. Rule of thumb: my private key is for signing, their public key is for sending confidentially.