Intermediate IT Auditing

Who will benefit from this course?

This course is intended to enhance your understanding of cybersecurity concepts- including common frameworks, standards and guidelines - to apply the audit process to emerging threats to associated with social media, mobile computing, cloud environments and more. 

This course is designed for internal auditors with a basic understanding of IT and cybersecurity concepts or who have been involved in integrated audits. This course will also benefit those internal auditors who have been involved in internal audit activities that require an understanding of how to manage the impact of cybersecurity events on organizational risks.

Course Objectives

• Define cybersecurity from an internal audit perspective. 
• Explore the business process – cybersecurity connection and the importance of classifying and assessing controls. 
• Explain cyber liability insurance and its impact on cybersecurity. 
• Describe cyber standards, state notification laws, and how they affect an organization.
• Express how to assess an organization’s cyber capabilities from an attacker perspective, using threat modeling.
• Evaluate applicable controls and considerations associated with mobile computing and connected devices.
• Analyze applicable controls and considerations associated with social media and digital presence.
• Explain how to assess a cloud environment taking into consideration the organization’s liabilities when utilizing cloud solutions.
• Examine how to audit the automation CoE and assurance within established organizational risk appetite.
• Understand the risks and controls associated with identity access management, zero trust, and micro-segmentation.
• Examine the common practices for providing comprehensive assurance over operational and technological resilience programs.

Course Topics

Unit 1: Network and Cybersecurity Overview

• Exploring Connections between Network and Cybersecurity, including:
  • Cybersecurity connection to network security. 
  • Cybersecurity triad.
  • Connection to the OSI Model.
  • Defense in depth and layered security. 
  • Boundary controls.
• Understanding the Breach, including:
  • Assessing a breach.
    • Attack view.
    • Detective view.
    • Corrective view.

Unit 2: Applying Risk Management Techniques to Assess Technology

• Applying risk management techniques including:
  • Considerations for mitigating breach-related costs and risks.
• Mitigation through insurance.
  • Common characteristics of cyber liability insurance and why it is important.
• Cybersecurity and breach notification laws. 
  • Impact of federal notification regulations (SEC Cybersecurity Law).
  • Current U.S. and international notification laws affecting security incident management.

Unit 3: Insider Threats

• Recognize the characteristics and warning signs related to insider threats.
• Describe common risks related to insider threats. 
• Describe common controls to protect against insider threats.
• Articulate the necessary components of an insider threat program.
• Identify the key activities to include an insider threat audit.
• Identify how to provide assurance of an insider threat program to the board of directors. 

Unit 4: Auditing Operational Resiliency in Technology

• Operational Resiliency Overview, including: 
  • Prioritizing critical technologies and operations impacting customers, markets, and other stakeholders if disrupted.
  • Identifying measures needed to ensure the business remains operational.
  • Operational resiliency essential terminology.
• Governance & Ownership, including:
  • Establishing internal control networks.
  • Ownership, roles, responsibilities, and reporting lines.
  • Third party considerations.
  • Other risk and control groups.
• Operational and Technological Resiliency Controls for Business Services, including:
  • Establishing lines of defense.
  • Scheduling regular audits, testing, and continuous improvement.
  • Designing processes to ensure incremental change in response to disruption.
  • Understanding and mapping business services inventory to technology assets, processes, and owners. 
  • Identifying impact and risk tolerances.

Unit 5: Vulnerability and Patch Management

• Auditing the Vulnerability Management Program, including: 
  • Vulnerability management program overview. 
  • Understand common vulnerability management maturity models used to assess organizational cybersecurity vulnerabilities. 
  • Review key metrics for auditing the vulnerability program. 
  • How to implement appropriate actions when auditing vulnerabilities.
• Patch Management, including: 
  • Key concepts of patch management. 
  • Patch management program. 
  • Patch management metrics. 
  • Patch management controls. 
  • Patch management and MSP risks. 
  • How the patch management program reduces cybersecurity risk and organizational vulnerabilities. 
  • How the patch management program reduces data breach risk and loss. 
  • Auditing the patch management program. 

Unit 6: Incident Management

• Incident Management, including: 
  • Incident and incident management overview.
  • Common incident management activities.
  • Incident preparation plans and playbooks. 
  • Incident response.
  • Post incident.
• Red Team, Blue Team, Purple Team Testing, including:
  • Introduction to Red, Blue, and Purple Teams. 
  • Understanding the “cyber kill chain.”
  • Common cyberattack methods.
  • Vulnerabilities related to people, processes, and technologies. 
  • Improving incident response.
  • Red Team activities.
  • Auditing the exercise. 

Unit 7: Auditing Identity Access Management, Zero Trust, and Micro-Segmentation 

• Overview of Identity Access Management, Zero Trust, and Micro-Segmentation, including:
  • Identity access management components.
  • Zero trust and micro-segmentation components.
  • Protection, privacy, and resilience overview.
• Related Risk and Control Groups, including:
  • Risk management.
  • Event logging.
  • Log monitoring.
  • Other risk and control groups.
• Risk Assessment Concerns for Internal Audit, including:
  • Determining who has access to the organization’s most valuable information.
  • Understanding which systems would cause the most significant organizational disruption if compromised.
  • Analyzing which organizational data would cause financial or competitive loss, legal ramifications, or reputational damage to the organization if exposed.
  • Assessing if management is prepared to react timely in the event of a cybersecurity incident.
• Frameworks and Controls for Assurance, including:
  • Understand internal audit’s role related to identity access management and zero trust assurance, governance, risk, and cyber threats.
  • Identify assurance gaps, implementation frameworks, and controls.
  • Reporting responsibilities of the internal audit function.

Unit 8: Understanding the Cloud Environment

• Cloud Overview, including: 
  • The cloud, what it is, and how it works.
  • Common cloud standards and guidelines.
  • Cloud models and deployments.
  • Cloud provider selection criteria.
  • Connectivity between the cloud provider and the client site.  
• Examining Cloud-Based Risks and Controls, including:
  • Cloud governance and strategy.
  • Cloud-based asset and configuration management.
  • Risks related to cloud providers and conducting cloud-based risk assessments.
  • Cybersecurity threats associated with cloud utilization.
  • Key cloud contract considerations. 
  • Annual assessment/service organization control (SOC) reports.
• Assessing the Cloud Environment, including: 
  • Assessing cloud tools.
  • Assessing the cloud provider contract.
  • Assessing cloud controls at the cloud vendor and client sites.

Unit 9:  Auditing Mobile Computing and Connected Devices

• Mobile Computing and Connected Device Essentials, including: 
  • Mobile computing characteristics. 
    • Enterprise mobility management solutions.
    • Mobile apps. 
  • Connected device characteristics. 
    • Smart home/office.
    • E readers, tablets, phablets. 
    • Mobile phones, smart watches, and other wearables.
• Mobile Computing and Connected Device Risks and Controls, including:
  • Compliance risks.
  • Privacy risks.
  • Security risks.
  • Mobile computing and connected device controls (home office vs. organizational headquarters).
• Assessing Mobile Computing and Connected Device Related Controls, including: 
  • Connected device risk and control matrix.
  • Planning the internal audit.
  • Data collection and analytics opportunities.
  • Testing connected devices (home office vs. organizational headquarters).
  • Reporting on effectiveness of connected device security. 

Unit 10: Auditing Social Media and Digital Presence

• Social Media and Digital Presence Overview, including:
  • Social media strategies and objectives of the organization. 
  • Digital presence strategies and objectives to the organization.
  • Digital presence governance. 
• Social Media and Digital Presence Risks and Controls, including:  
  • Compliance risks.
  • Privacy risks.
  • Security risks.
  • Social Media site vulnerabilities (e.g., site security, impersonation, public posting, employee access).
  • Social media and digital presence controls. 
• Assessing Social Media and Digital Presence, including: 
  • Assessing digital presence controls.
  • Assessing social media controls.
  • Evaluation and interpretation of social media contracts. 

Unit 11: Automation Center of Excellence

• How to Audit the Automation Center of Excellence (CoE) and Cognitive Technologies, including:
  • Common terminology.
  • Automation risk frameworks and CoE mandates.
  • Governance and oversight.
  • Planning and alignment.
  • Return on automation CoE investment.
  • Policies and procedures.
  • Development standards.
  • Controls.
• Automated Auditing Processes and Benefits, including:
  • Business processes.
  • System access control testing.
  • Internal audit processes.
  • Sarbanes-Oxley (SOX) testing.
  • Database control testing.
  • Compliance testing.
• Automation CoE Risks, including:
  • Account management and separation of duties in the bot development lifecycle.
  • Operational risk stemming from confusion around ownership of automation.
  • Additional artificial intelligence (AI) risks.