Ch. 1

Characteristics of a useful system

Ch. 1

5 major business processes or transaction cycles

1. revenue 
2. expenditure 
3. production or conversion 
4. human resources/payroll 
5. financing

Ch. 1

6 components of AIS

1. people 
2. procedures and instructions 
3. data 
4. software 
5. information technology infrastructure 
6. internal controls and security measures

Ch. 1

3 business functions of AIS

1. collect and store data about org’s activities, resources, and personnel 
2. transform data into information so mgmt can plan, execute, control, and evaluate activities, resources, and personnel. 
3. provide adequate controls to safeguard the organization’s assets and data

Ch. 1

How AIS adds value to an organization

1. improving the quality and reducing the costs of products or services
2. improving efficiency
3. sharing knowledge
4. improving the efficiency and effectiveness of its supply chain
5. improving the internal control structure
6. improving decision making

Ch. 1

Value chain of 5 primary activities that directly provide value to customers

1. inbound logistics (receive, store, distribute materials)
2. operations (activities transforming inputs into final products or services)
3. outbound logistics (activities to distribute finished products or services to customers)
4. Marketing and sales (help customers buy the org’s products/services)
5. Service (provide post-sale support to customers)

Ch. 2

Data is collected about what three facets of each business activity?

1. each activity of interest
2. the resources affected by each activity
3. the people who participate in each activity

Ch.2

source documents

used to collect data about a business activity

Ch.2

turnaround document

company output sent to an external party, who often adds data to the document, and then are returned to the company as an input document. Help collect data and ensure it’s accurate and complete.

Ch.2

source data automation device

captures transaction data in machine-readable form at the time and place of their origin (ATMs, barcode scanners, etc). This is a way to collect data and ensure the data are accurate and complete.

Ch.2

sequence codes

Ch.2

block code

Ch.2

Group Codes

Ch.2

mnemonic codes

Ch.2

Chart of accounts

Ch.2

Entity

Ch.2

Field

Ch.2

database

Ch.2

4 types of data processing activities

CRUD

1. Creating - new data records
2. Reading - retrieving, or viewing existing data
3. Updating - previously stored data
4. Deleting

Ch.2

batch processing

Ch.2

online, real-time processing

Ch.2

Enterprise resource planning (ERP) systems

Ch.3

Data Flow Diagram

graphically describes the blow of data within an organization;

uses data sources/destinations; data flows; transformation processes (circle); data stores (double lines)

Ch.3

Data sources/destinations

Ch.3

Data Flows

Ch.3

Context diagram

Ch.3

document flowchart

Ch.3

internal control flowcharts

Ch.3

System flowchart

Ch.3

Program flowchart

Ch.4

Database management system (DBMS)

Ch.4

Database system

Ch.4

Database administrator (DBA)

responsible for the database

Ch.4

business intelligence

using a data warehouse for strategic decision making. (data warehouse=both detailed and summarized data for a number of years and is used for analysis rather than transaction processing; updated periodically.)

Ch.4

online analytical processing (OLAP)

using queries to guide the investigation of hypothesized relationships in data; “drilling down” to lower levels

Ch. 4

data mining

using sophisticated statistical analysis, including AI techniques such as neural networks, to “discover” unhypothesized relationships in the data.

Ch. 4

benefits of databases

• data integration
• data sharing
• minimal data redundancy and data inconsistencies
• data independence
• cross-functional analysis

Ch. 4

logical view of a database

how people conceptually organize and understand the data

Ch. 4

physical view of a database

how and where data are physically arranged and stored in the computer system

Ch. 4

schema

logical structure of a database

3 levels: conceptual, external, and internal

Ch. 4

Conceptual-level schema

organization wide view of the entire database, lists all data elements and the relationships among them

Ch. 4

external-level schema

individual user views of portions of the database, each of which is referred to as a subschema

Ch. 4

internal-level schema

low-level view of the database, describes how the data are stored and accessed, including record layouts, definitions, addresses, and indexes.

Ch. 4

data dictionary

contains information about the structure of the database.

Ch. 4

Data definition language 

a DBMS language that builds the data dictionary, creates the database, describes logical views for each user, and specifies records or field security constraints.

Ch. 4

data manipulation language

changes database content, including data element updates, insertions, and deletions.

Ch. 4

data query language

contains powerful, easy-to-use commands that enable users to retrieve, sort, order, and display data.

Ch. 4

data model

abstract representation of database contents, upon which the DBMS is built.

Ch. 4

tuple

Ch. 4

primary key (for a database)

Ch. 4

foreign key

Ch. 5

Fraud

gaining an unfair advantage over another person. legally, for an act to be fraudulent there must be:

• a false statement, representation, or disclosure
• a material fact
• an intent to deceive
• a justifiable reliance (person relies on misrepresentation to take an action
• an injury or loss suffered by the victim

Ch. 5

4 actions from the Treadway Commission to reduce fraudulent financial reporting

1. establish an org environment that contributes to the integrity of the financial reporting process
2. identify and understand the factors that lead to fraudulent financial reporting
3. assess the risk of fraudulent financial reporting within the company
4. design and implement internal controls to provide reasonable assurance of preventing fraudulent financial reporting

Ch. 5

Fraud Triangle

1. pressure=person’s incentive/motivation for committing fraud; three types are financial, lifestyle, and emotional
2. opportunity=condition or situation that allows a person or organization to do three things: commit the fraud, conceal the fraud, and convert the theft to personal gain
3. rationalization=allows people to justify their behavior

Ch. 5

types of computer fraud

1. input
2. processor=unauthorized system use
3. computer instructions=tampering with company software, copying software illegally, using it in an unauthorized manner, and developing software to carry out an unauthorized activity.
4. data=illegally using, copying, browsing, searching, or harming company data.
5. output

Ch. 5

ways to prevent, detect, reduce

pg 134-5

Ch. 6

Hacking

the unauthorized access, modification, or use of an electronic device or some elements of a computer system

Ch. 6

botnet

robot network, a network of powerful and dangerous hijacked computers

Ch. 6

Hijacking

gaining control of a computer to carry out illicit activities without the user’s knowledge

Ch. 6

bot herders

install software that responds to the hacker’s electronic instructions onto unwitting PCs

Ch. 6

denial-of-service attack

botnets are used for this; designed to make a resource unavailable to its users

Ch. 6

dictionary attacks

(direct harvesting attacks); staged by spammers; use special software to guess addresses at a company and send blank e-mail messages; those not returned are probably real, so they’re added to a spam list

Ch. 6

spoofing

making an electronic communication look as if someone else sent it to gain the trust of the recipient

Ch. 6

E-mail spoofing

making an email appear as though it originated from a different source

Ch. 6

caller ID spoofing

displaying an incorrect number on a caller ID display to hide the caller’s identity

Ch. 6

IP address spoofing

creating IP packets with forged source IP addresses to conceal the identity of the sender or to impersonate another computer system (used for DoS attacks)

Ch. 6

address resolution protocol (ARP) spoofing

sending fake ARP messages to an Ethernet LAN.

Ch. 6

SMS spoofing

using the short message service SMS to change the name or number a text message appears to come from

Ch. 6

web-page spoofing

aka phishing

Ch. 6

DNS spoofing

sniffing the ID of a domain name system request and replying before the real DNS server can.

Ch. 6

Zero-day attack

an attack between the time a new software vulnerability is discovered and the time a software developer releases a patch that fixes problem

Ch. 6

Cross-site scripting (XSS)

a vulnerability in dynamic web pages that allows an attacker to bypass a browser’s security mechanisms and instruct the victim’s browser to execute code thinking it came from the desired web site.

Ch. 6

buffer overflow attack

happens when the amount of data entered into a program is greater than the amount of memory set aside to receive it.

Ch. 6

SQL injection attack

malicious code in the form of an SQL query that is inserted into input so it can be passed to and executed by an application program.

Ch. 6

Man-in-the-middle attack

places a hacker between a client and a host and intercepts network traffic between them. Session hijacking attack; used to attack public-key encryption systems where sensitive and valuable info is passed back and forth.

Ch. 6

Masquerading/impersonation

Ch. 6

Piggybacking

1. clandestine use of a neighbor’s wi-fi network 
2. tapping into a telecommunications line and electronically latching onto a legitimate user before the user enters a secure system an unauthorized person following 
3. an authorized person through a secure door, bypassing physical security controls such as keypads, ID cards etc.

Ch. 6

password cracking

Ch. 6

war dialing

Ch. 6

war rocketing

Ch. 6

data diddling

Ch. 6

data leakage

Ch. 6

podslurping

Ch. 6

salami technique

Ch. 6

round-down fraud

Ch. 6

economic espionage

Ch. 6

cyber-extortion

Ch. 6

sexting

Ch. 6

internet terrorism

Ch. 6

internet misinformation

Ch. 6

internet pump-and-dump

Ch. 6

click fraud

Ch. 6

web cramming

Ch. 6

software piracy

Ch. 6

social engineering

Ch. 6

pretexting

Ch. 6

posing

Ch. 6

phishing

Ch. 6

vishing

Ch. 6

carding

Ch. 6

pharming

Ch. 6

evil twin

Ch. 6

URL hijacking

Ch. 6

tabnapping

Ch. 6

scavenging/dumpster diving

Ch. 6

shoulder surfing

Ch. 6

Lebanese looping

Ch. 6

skimming

Ch. 6

chipping

Ch. 6

malware

Ch. 6

spyware

Ch. 6

adware

Ch. 6

torpedo software

Ch. 6

scareware

Ch. 6

ransomware

Ch. 6

key logging software

Ch. 6

trojan horse

Ch. 6

time bomb/logic bomb

Ch. 6

trap door/back door

Ch. 6

trap door/back door

Ch. 6

steganography programs

Ch. 6

rootkit

Ch. 6

superzapping

Ch. 6

virus

Ch. 6

worm

Ch. 6

bluesnarfing

Ch. 6

bluebugging

Ch. 7

Internal control

Ch. 7

Three functions of internal controls

1. preventive controls
2. detective controls
3. corrective controls

Ch. 7

preventive controls

deter problems before they arise (hire qualified personnel, segregate duties, control physical assets/info)

Ch. 7

detective controls

discover problems that aren’t prevented (duplicate checking of calculations)

Ch. 7

corrective controls

identify and correct problems as well as correct and recover from the resulting errors (maintain backups, correct data entry errors)

Ch. 7

Two categories of internal controls

1. General Controls (make sure an org’s control environment is stable and well maintained)
2. Application Controls (make sure transactions are processed correctly; concerned with accuracy, completeness, validity, and authorization of the data captured, entered, processed, stored, transmitted to other systems, and reported.)

Ch. 7

foreign corrupt practices act

passed to prevent companies from bribing foreign officials to obtain business.

Ch. 7

COBIT framework addresses control from 4 vantage points

1. Business objectives (info must conform to seven categories of criteria that map into the objectives established by COSO)
2. IT resources=people, application systems, tech, facilities, and data
3. IT processes=four domains: planning/organization, acquisition/implementation, delivery/support, monitoring/evaluation

Ch. 7

COSO

consists of the AAA, AICPA, IIA, IMA, and FEI.

Ch. 7

Internal Control-Integrated Framework

issued by COSO; widely accepted as the authority on internal controls.

Ch. 7

5 components of COSO’s IC framework

1. control environment
2. control activities
3. risk assessment
4. info and communication
5. monitoring

Ch. 7

Enterprise Risk Management-Integrated Framework

developed by COSO as a second control framework; ERM is the process the BoD and mgmt use to set strategy, identify events that may affect the entity, assess and manage risk, and provide reasonable assurance that the company achieves its objectives and goals.

Ch. 7

ERM model components

1. internal environments
2. objectives setting
3. event identification
4. risk assessment
5. risk response
6. control activities
7. info & communication
8. monitoring

Ch. 7

what does and internal environment consist of?

1. mgmts’s philosophy, operating style, and risk appetite
2. the board of directors (audit committee)
3. commitment to integrity, ethical values, and competence
4. organizational structure
5. methods of assigning authority and responsibility
6. human resource standards (hiring, compensating/evaluating/promoting, training, managing disgruntled employees, discharging, vacations/rotations, confidentiality agreements, prosecute/incarcerate perps)
7. external influences (FASB, PCAOB, SEC etc)

Ch. 7

ERM objective types

1. strategic
2. operations
3. reporting
4. compliance

Ch. 7

inherent risk

exists before mgmt takes any steps to control the likelihood or impact of an event

Ch. 7

residual risk

what remains after mgmt implements internal controls or some other response risk

Ch. 7

4 Risk responses

1. reduce (by implementing an effective system of internal controls)
2. accept (the likelihood and impact of the risk
3. share (or transfer it to someone else by buying insurance, outsourcing, or hedging)
4. avoid (don’t engage in the activity that produces the risk)

Ch. 7

expected loss

used to estimate the value of internal controls; Expected Loss=Impact x likelihood

Ch. 7

7 Control procedure categories

1. proper authorization of transactions and activities
2. segregation of duties
3. project development and acquisition controls
4. change mgmt controls
5. design and use of documents and records
6. safeguarding assets, records, and data
7. independent checks on performance

Ch. 7

specific authorization

certain activities/transactions that are of such consequence that mgmt has to authorize them

Ch. 7

general authorization

authorizes employees to handle routine transactions without special approval 

Ch. 7

segregation of accounting duties

• authorization
• recording
• custody

Ch. 7

segregation of system duties

1. system admin
2. network mgmt
3. security mgmt
4. change mgmt
5. users
6. systems analysis
7. programming
8. computer operations
9. info system library
10. data control

Ch. 7

systems integrator

manages a systems development effort involving its own personnel, its client, and other vendors.

Ch. 7

Computer security officer

in charge of system security, independent of the into system function

Ch. 8

7 IT controls criteria in the COBIT framework

1. effectiveness (relevant, timely info)
2. efficiency (info must be produced in a cost-effective manner)
3. confidentiality (sensitive information must be protected)
4. integrity (info must be accurate, complete, and valid)
5. availability (info must be available whenever needed)
6. compliance (ensure compliance with internal and external policies/requirements)
7. reliability (mgmt must have access to appropriate info needed to conduct daily activities etc.)

Ch. 8

4 Management domains (basic mgmt activities for COBIT)

1. Plan and Organize (define IT plan, determine tech direction, manage IT investment, communicate mgmt aims/direction etc.)
2. Acquire and Implement (acquire and maintain application software/tech infrastructure, procure it resources, manage changes, etc.)
3. Deliver and Support (define/manage service levels, ensure system security, manage problems/data/physical environment/operations etc.
4. Monitor and Evaluate (IT performance & internal control, ensure compliance with external requirements, provide IT governance)

Ch. 8

2 fundamental info security concepts

1. security is a management issue, not a technology issue
2. defense-in-depth and time-based model of info security

Ch. 8

defense-in-depth

use multiple layers of controls; involve preventive, detective, and corrective controls

Ch. 8

time-based model of security

P=time it takes an attack to break through preventive controls

D=time it takes to detect an attack is in progress

C=time it takes to respond to the attack

if P>D+C then security procedures are effective.

Ch. 8

Preventive controls

1. training
2. user access controls
3. physical access controls
4. network access controls
5. device/software hardening controls

Ch. 8

user access controls 

authentication (something they know, something they have, some physical characteristic), authorization (for access to certain portions of a system)

Ch. 8

access control matrix

Ch. 8

network access controls

Ch. 8

border router

Ch. 8

firewall

Ch. 8

demilitarized zone

Ch. 8

Transmission Control Protocol

Ch. 8

Internet Protocol

Ch. 8

routers

Ch. 8

access control list

Ch. 8

static packet filtering

Ch. 8

stateful packet filtering

Ch. 8

deep packet inspection

Ch. 8

intrusion prevention systems

Ch. 8

RADIUS

Ch. 8

war dialing

Ch. 8

hardening

Ch. 8

Detective controls

• log analysis 
• intrusion detection systems 
• managerial reports 
• security testing

Ch. 8

intrusion detection system

Ch. 8

penetration testing

Ch. 8

Corrective Controls

• computer incident response team 
• chief info security officer 
• patch management

Ch. 8

Computer incident response team

responsible for dealing with major incidents should go through 4 steps:

1. recognition 
2. containment 
3. recovery 
4. follow-up

Ch. 8

patch management (fine!)

Ch. 8

virtualization

Ch. 9

Ways to preserve confidentiality

1. identification and classification of the info to be protected 
2. encryption of sensitive information 
3. controlling access to sensitive info 
4. training

Ch. 9

Information rights management

Ch. 9

data loss prevention software

Ch. 9

digital watermark

Ch. 9

Privacy

Ch. 9

GAPP’s 10 internationally recognized best practices for protecting customer info privacy

1. management
2. notice
3. choice/consent
4. collection (cookies)
5. use/retention (only as long as it’s needed for a legit business purpose)
6. access
7. disclosure to third parties
8. security
9. quality
10. monitoring/enforcement

Ch. 9

Encryption

Ch. 9

factors that influence encryption strength

Ch. 9

Types of encryption systems

Ch. 9

hashing

Ch. 9

digital signatures

Ch. 9

digital signature 

Ch. 9

digital certificate

Ch. 9

certificate authority

Ch. 9

public key infrastructure (PKI)

Ch. 9

Virtual Private Networks (VPNs)

Ch. 10

Input Controls

1. forms design (pre-numbered, turnaround docs) 
2. cancellation and storage of source documents 
3. data entry controls 
4. additional batch processing data entry controls 
5. additional online data entry controls

Ch. 10

validity check

Ch. 10

reasonableness test

Ch. 10

check digit

Ch. 10

three types of batch totals

1. financial
2. hash
3. record count

Ch. 10

online data entry controls

1. prompting
2. closed-loop verification (displays related info about you input)
3. transaction log

Ch. 10

Processing Controls

• data matching
• file labels (header/trailer records
• recalculation of batch totals
• cross-footing and zero-balance tests
• write-protection mechanisms
• concurrent update controls

Ch. 10

Output Controls

• user review output
• reconciliation procedures
• external data reconciliation
• data transmission controls (checksums & parity bits)

Ch. 10

batch processing integrity controls

1. prepare batch totals
2. deliver the transactions to the computer operations department for processing
3. enter the transaction data into the system
4. sort and edit the transaction file
5. update the master files
6. prepare and distribute output
7. user review

Ch. 10

ways to minimize risk of system downtime

• preventive maintenance
• fault tolerance
• data center location and design
• training
• patch management and antivirus software

Ch. 10

ways to have quick and complete recovery and resumption of normal operations

• backup procedures 
• disaster recover plan 
• business continuity plan

Ch. 10

fault tolerance

Ch. 10

redundant arrays of independent drives (RAID)

Ch. 10

uninterruptible power supply

Ch. 10

recovery point objective

Ch. 10

Recovery time objective

Ch. 10

incremental backup

Ch. 10

differential backup

Ch. 10

archive

Ch. 10

Disaster recovery plan

Ch. 10

hot site

Ch. 10

business continuity plan

Ch. 10

change control

• all change requests should be standard and documented
• all changes should be approved by appropriate levels of mgmt
• changes should be thoroughly tested prior to implementation
• all documentation should be updated to reflect authorized changes
• emergency changes must be documented and subjected to a formal review/approval
• backout plans need to be developed for reverting to previous config in case approved changes need to be interrupted or abandoned
• user rights and privileges must be carefully monitored during the change process to ensure that proper segregation of duties is maintained.