CISA made Easy - Easy CISA Preparation

Business Continuity Planning (BCP)– Essential Steps

2009-01-05T11:36:00.002+05:30

Disaster can happen anytime to any strong setup. The best way to provide stability is by establishing mechanisms to provide continuity to all critical Operations. This can be achieved by a proper...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Passing CISA is easy - final tips to pass CISA

2008-12-12T16:48:00.002+05:30

All your queries and hits has made me to devote more and more time for this blog and this blog has become a vital part of my life. Thanks for your support. Now examination is standing next to...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-1112

2008-12-11T17:49:00.000+05:30

1. Asymmetric key cryptography is known as Public key encryption and involves a private key and a public key. 2. A good Backup and recovery System should have following features: i. Backup...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-1012

2008-12-10T15:49:00.000+05:30

1. The purpose of setting, Disaster Recovery Site is to avoid Single Point of failure and maitain Business Continuity. 2. Logical Access & Physical Access Audit must include authorization as per...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-0912

2008-12-09T20:27:00.000+05:30

1. When data volume is more Symmetric cryptography is fast and suitable method to encrypt such data. 2.Access Control Lists(ACLs) are used in firewalls and in interfaces that connect two or more...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-0512

2008-12-08T21:43:00.000+05:30

1. Dry pipe sprinklers are i.very effective fire suppressor ii. environment friendly fire suppressor 2.Security administrator should not have full access/write access to security devices...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

IPsec & Encryption

2008-12-04T14:07:00.000+05:30

This post is in relation to a question asked by reader Question: Angus has left a new comment on your post "IP Security & Authentication Header (AH)": May I ask a question about IPsec? Which...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Audit Risk and Relationship

2008-12-02T20:48:00.001+05:30

This post is in relation to a question asked by a reader Question: Jez4christ has left a new comment on your post "Audit Risk Assessment – Risk Types & Relationships...": Hi, I am reading...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Volatile and Non-volatile memory

2008-12-01T20:53:00.001+05:30

This post is in relation to a question asked by a reader Question: Angus has left a new comment on your post "10 things you must remember about Antivirus": Sorry, I can't find a proper...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Type Question 08-2811 on Diverse routing an Alternative routing

2008-11-28T20:14:00.000+05:30

An IS Auditor while auditing a network finds a network routing scheme with following characteristics: 1. Routing involves two exchanges. 2. Routing involves split cables. This routing scheme is...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-2611

2008-11-26T17:46:00.000+05:30

1. programmer should not be allowed to alter or patch the Live environment. 2. Loss/Leakage of Confidential data may lead to Reputation Risk for the Organization. 3. Location of smoke detectors is...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-2511

2008-11-25T16:25:00.001+05:30

1. CPM or Critical Path Methodology helps in determining critical tasks and identifies the dependencies between/among those tasks. 2. Social engineering is the technique where attacker acquires ...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Two factor authentication using digital certificates

2008-11-24T06:39:00.000+05:30

This post is in relation to a question asked by the reader Question:Angus comment on post "Certificate Authority for CISA Exam - its all abou...": May I ask a question about how Digital...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-2111

2008-11-21T13:39:00.000+05:30

1. Data mining is the process of analyzing data from different sources and perspectives and summarizing it into helpful information by means of association, clustering, sequencing and...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-2011

2008-11-20T12:59:00.001+05:30

1. Maintaining Strong and tough password is an Preventive Control. 2. Stream cipher is a type of symmetric encryption which operates on continuous streams of plain text (1 & 0) Mostly used in...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

IP Security & Authentication Header (AH)

2008-11-19T15:32:00.001+05:30

IP Security (IPSec) is a super set of protocols which to large extent ensure security of Internet Protocol (IP). Beside Internet Key Exchange (IKE) two other important protocol supported by IPSec...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-1811

2008-11-18T11:57:00.000+05:30

1. Liquid fire should be ideally suppressed by agents like Dry powders and/or Carbon Dioxide. 2. Data Link(OSI Layer 2) handles bridging work. 3. Business Impact Analysis (BIA) phase of BCP must...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Quick Tips 08-1711

2008-11-17T17:36:00.001+05:30

1. Proper access control policy should be framed with regard to data file access and directory access while implementing Database Management system (DBMS). 2. Segregation of duties is a key area to...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

How to select a CAAT

2008-11-14T11:05:00.001+05:30

CAAT stands for Computer Assisted Audit Techniques This is a common thing of discussion among IS Auditors is "which one is best - CAATs or Manual method of IS Audit". Sometimes manual method is not...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Type Question 08-1111 on Audit Trail

2008-11-11T11:29:00.000+05:30

An IS Auditor while auditing a software Firewall will look which source for audit trails? 1. Firewall Log 2. Operating System Log 3. Both 1 & 2 4. None of the above. republished/modified...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Type Question 08-3110 on Audit Charter

2008-10-31T17:00:00.002+05:30

Which of the following is LEAST important characteristics of Audit Charter? 1. Audit Charter delegates authority from one person/organization to another person/organization 2. Audit Charter should...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Access Control in UNIX based operating systems

2008-10-27T21:27:00.006+05:30

A lot of UNIX based operating systems are available. Although basic architecture is same for all these Operating System but they varies in functionality. Following are some of the important UNIX...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

CISA Type Question 08-2210 on Audit Trails

2008-10-22T19:58:00.000+05:30

Which of the following an IS Auditor should FIRST see, before analyzing the Audit Trails of a Local Area Network (LAN) ? 1. Quantity of Audit Trails 2. Periodicity of audit trails 3. Synchronization...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Links for 2008-10-20 [del.icio.us]

2008-10-21T00:00:00-07:00

Audit Charter & Engagement Letter
Responsibility, Authority and accountability should be the part of

CISA type question 08-2010 on Audit Charter & Engagement Letter

2008-10-20T21:55:00.000+05:30

Responsibility, Authority and accountability should be the part of 1. Audit Charter 2. Engagement letter 3. Both 4. None Answer to CISA Type Question 08-1010 on Business Continuity & Disaster...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Links for 2008-10-14 [del.icio.us]

2008-10-15T00:00:00-07:00

Control Self-Assessment (CSA)- How,what & why ?
Control Self-Assessment (CSA) is a technique by which an organization accesses & assesses the effectiveness, reliability and adequacy of existing internal controls which may help the organization in strengthening existing controls further.

Control Self-Assessment (CSA)- How,what & why ?

2008-10-13T21:30:00.001+05:30

Control Self-Assessment (CSA) is a technique by which an organization accesses & assesses the effectiveness, reliability and adequacy of existing internal controls which may help the organization...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Links for 2008-10-10 [del.icio.us]

2008-10-11T00:00:00-07:00

CISA Type Question 08-1010 on Business Continuity & Disaster Recovery
n IS auditor while auditing of an Information System finds that system does not force for backup before and after major events/major updates in the system. Although backups are being taken without proper documentation.

Links for 2008-10-08 [del.icio.us]

2008-10-09T00:00:00-07:00

Auditing a Database Management System (DBMS)
An IS Auditor/ Database Auditor should broadly see following area while auditing a database ( mainly for Relational model): 1. Database consistency 2. Data Integrity 3. Data independence 4. Other ACID Properties

Links for 2008-10-06 [del.icio.us]

2008-10-07T00:00:00-07:00

CISA Type Question 08-0610 on Business Continuity Plan (BCP) Auditing
An IS Auditor is in the process of auditing Business Continuity Plan (BCP) for an organization.He comes across following : i. Incident Management Report ii.Previous reports & Followup audit report....

Links for 2008-10-03 [del.icio.us]

2008-10-04T00:00:00-07:00

How to secure your Network by Firewall implementation and auditing
Protection of information assets is the major aim of IT S policy. Firewall is one of the important tools for IT Security. Firewall protects networks from malicious intrusion from outside the network and many times from inside the network. Configuration and location of a firewall in a network is very important area for an Information Security Manager whereas an IS Auditor should see if firewall implementation helps in all the three basic requirement of a good Information System i.e. Confidentiality, Integrity & Availability of IS resources.

Links for 2008-09-30 [del.icio.us]

2008-10-01T00:00:00-07:00

CISA Type Question 08-3009 on advantages of kerberos
Impact of Single point of failure like sharing/stealing of session key