Where is the head and tail?

Hi Wali,



How should I start? Well, I can start to outline Change Management
procedures that would be followed. Segregation of duties between various
levels of developers, quality assurance, app admin etc. That's generic.

I suggest you should understand the basic working of the application.
Its not require to have a full understanding of the accounting or
finance.You should just have a fair knowledge of the flow of the
information.
Then you can start with the listing of the security procedures like

Change Management - How changes are made, who all are authorized to
make the changes, who reviews the changes, is there a fall back
procedure for the changes made, whether records are maintained for the
changes made and so on.
Backup Management - How regularly backup is taken , who is
responsible for backup, type of backup, where is backup is stored.
Privilege Management - What privilege levels are defined, are they
required for the daily operations, privilege access matrix.

Then what? I am a novice when it comes to accounting and finance. Should I
define workflows within dept. of accounting? Should I sit with accountants
and other users and get deep into various things they do and then look
deeply inside each module of this finance application in order to study
General Ledgers, Journal Vuchers, Accounts recievables/payables etc. That
would take months!!

Then you can start with the real application audit like checking in for:

Administrative privileges
Logging
Database vulnerabilities
A detailed understanding of the subject is not required, but should
have knowledge of the critical information and the threats to it. Then
you can design a checklist which will help you in auditing the
application.

I think this would help.......



Harshal Mehta

Information Security Analyst
ISO 27001 IA CEH cVa ITIL
NII Consulting
Mobile: +91 9819066601
Website: www.niiconsulting.com

---------------------------------------------------------------------------
This list is sponsored by: BigFix

If your IT fails, you're out of business - or worse. Arm your enterprise with BigFix, the single converged IT security and operations engine. BigFix enables continuous discovery, assessment, remediation, and enforcement for complex and distributed IT environments in real-time from a single console.
Think what's next. Think BigFix.

http://ad.doubleclick.net/clk;82309979;15562032;o?http://www.bigfix.com/ITNext/
---------------------------------------------------------------------------

Relevant Pages

  • Re: Where is the head and tail?
    ... Backup Management - How regularly backup is taken, ... I am a novice when it comes to accounting and finance. ... Information Security Analyst ... BigFix ...
    (Security-Basics)
  • Re: Ubuntu CD-Rs ?
    ... privilege is removed. ... CD/DVD does adopt the user who mounted it, to be the owner of the files on it. ... To avoid this (for your next backup) you should make a tarball of what ...
    (alt.linux)
  • HRESULT: 0x800736B1
    ... The DLL that I make requires that I ... Required to perform backup operations. ... This privilege is required by the RegSaveKey and RegSaveKeyExfunctions. ... HRESULT _stdcall ModifyPrivilege( ...
    (microsoft.public.dotnet.framework.interop)
  • Re: Willing to bet this is Windows at its best
    ... But doesn't the operator need write privilege if the backup has a /RECORD ... READALL Privilege (Objects) ... See the HP OpenVMS System Management Utilities Reference Manual ...
    (comp.os.vms)
  • Re: Thank Goodness for Backups
    ... Mostly its so I can access technical manuals from anywhere, but I also backup my accounting onto it. ... Actually I am sure its just a Windows error as I can boot with one of my special tools CDs and explore the file structure. ... Anyway, I grabbed a spare computer off the shelf, loaded my Quickbooks, and restored from my backup in less than 20 minutes. ... If you want a really stable server platform that will allow you to save documents and files from a Windows based network, you should consider configuring a Linux machine. ...
    (alt.security.alarms)