Mainframe audit

From Wikipedia, the free encyclopedia

 This article or section needs copy editing for grammar, style, cohesion, tone or spelling.
You can assist by editing it now. A how-to guide is available. (January 2008)

A mainframe audit is a comprhensive inspection of computer processes , security , and procedures ,with recommendations for improvement.

Contents

[edit] Definition of mainframe

A mainframe computer is not easy to define. Most people associate a mainframe with a large computer; but mainframes are getting smaller all the time. The terms mainframe and enterprise server are converging. Supercomputers are generally used for their speed and complexity, while mainframes are used for storing large volumes of sensitive data.

[edit] External Factors

generally this includes but is not limited to an understanding of the following:

  • Nature of the organization.
  • Organization’s external factors such as regulatory requirements and the nature of its industry.
  • Organization’s management, governance,objectives and business processes.
  • Organization’s performance compared to the industry . (Messier, 2003).

This information can be obtained by conducting outside research, interviewing employees, touring the data center and observing activities, consultations with technical experts, and looking at company manuals and business plans.

[edit] Passwords:

  • Who has access to what, and are employees protecting their passwords properly?
  • Are there written policies and procedures in place stating how this is accomplished and are they enforced.
  • Are passwords timed out?
  • Evidence of implementation can be obtained by requesting employee manuals, evaluating the software and user histories, and by physical observation of the environment. (Gallegos, F., 2004).

[edit] Physical environment

  • Are cables adequately protected from damage and sniffing between the Network and the Data Center? This can be achieved by proper routing of the cables, encryption linkage, and a good network topology (Software Diversified Services). Physical observation of where the cables are routed and confirmation of the security procedures should be obtained. Tests of controls should be conducted to determine any additional weaknesses.
  • Does the mainframe have access to an Uninterrupted Power Supply? If so confirmation should be obtained that it exists, is available, and is adequate to meet the organizations needs.
  • Environmental controls: Are physical controls such as power badges for access, fire suppression devices, and locks in place to protect the data center (and the mainframe inside) from theft, manipulation or damage? A physical observation should be conducted and employee reference manuals should be examined to confirm this assurance.

[edit] The Operating System

  • What controls are in place to make sure the system is continually updated?
  • Is the software configured to do updates, or is it done by the system technicians?
  • Controls should be in place to deter unauthorized manipulation or theft of data,
  • Proper segregation of duties also needs to be verified. The company’s internal controls need to be tested to determine if they are effective.
  • Samples of entries into the system should be examined to verify that the controls are effective and unauthorized and/or suspicious voided transactions need to be investigated (Gallegos, 2004).
  • Are there any processes on the system that could needlessly compromise other components?
  • Procedures and measures need to be in place to minimize the risk of unauthorized access through Backdoors in the system, such as the Program Properties Table (PPT).
  • There should be an accurate audit trail that can be followed. endeavor (The Henderson Group, October, 2001).

[edit] Security server

  • Are proper segregation of duties implemented and enforced and is technology and procedures in place to make sure there is a continuous and accurate audit trail?
  • Controls need to be put in place to minimize the risk of unnecessary and unauthorized entry into the system, and the protection of passwords.
  • Computer assisted audit techniques should be used to explore the system, and on hand observations should be conducted to verify procedures, such as segregation of duties are being followed.
  • Security systems such as RACF, ACF2, and Top Secret need to be constantly evaluated to verify that they are providing the necessary security and if additional protection such as new firewalls is needed. . (The Henderson Group, August, 2002).

[edit] Application system

  • Is concerned with the performance and the controls of the system.
  • Is it able to limit unauthorized access and data manipulation?

[edit] Evaluate whether sufficient evidence was obtained

After performing the necessary tests and procedures determine whether the evidence obtained is sufficient to come to a conclusion and recommendation.

[edit] How is the security of the mainframe maintained?

Mainframes, despite their reliability possess so much data that precautions need to be taken to protect the information it holds and the integrity of the system.

  • Physical controls over the mainframe and its components.
  • Encryption techniques.
  • Putting procedures in place that prevent unnecessary and unauthorized entries into a system and that input, output, or processing is recorded and accessible to the auditor. This is particularly important for people with Elevated-Privilege.
  • Security Software such as RACF, ACF2, and Top Secret.
  • Constant testing of the security system to determine any potential weaknesses.
  • Properly protecting Backdoor accesses.
  • Continual examination of the techniques to determine effectiveness.

To gauge the effectiveness of these internal controls an auditor should do outside research, physically observe controls as needed, test the controls, perform substantive tests, and employ computer assisted audit techniques when prudent.

[edit] See also

[edit] References

  • Gallegos, F., Senft, S., Manson, D., Gonzales, C. (2004). Information Technology Control and Audit. (2nd ed.) Boca Raton, Florida: Auerbach Publications.
  • Messier jr., W., F. (2003) Auditing & Assurance Services: A Systematic Approach. (3rd ed.) New York: McGraw-Hill/Irwin.
  • Licker, M., D. (2003). Dictionary of Computing & Communications. New York: McGraw-Hill
  • Philip, G. (2000). The University of Chicago Press: Science and Technology Encyclopedia. Chicago, IL: The University of Chicago Press.
  • O’Brien, J., A., (2002). Management Information Systems: Managing Information Technology in the E-Business Enterprise. 5th ed. New York: McGraw-Hill/Irwin.

[edit] External links