CISA – Certified Information Systems Auditor Study Guide: Achieve CISA certification with practical examples and over 850 exam-oriented practice questions, 2nd Edition

Description

Master the practical aspects of information systems auditing to pass the CISA exam and accelerate your career. Purchase of the book unlocks access to web-based exam prep resources like practice questions, flashcards, and more. Purchase of the print or Kindle book includes a free eBook in PDF format. Key FeaturesEnhance your understanding of each topic by practicing a set of exam-oriented questionsRevise concepts easily focusing on key aspects from CISA exam perspective, highlighted in each chapterAccelerate your exam prep with additional study material including flashcards, mock exams, and exam tipsBook Description With the latest updates and revised study material, this second edition of the Certified Information Systems Auditor Study Guide provides an excellent starting point for your CISA certification preparation. The book strengthens your grip on the core concepts through a three-step approach. First, it presents the fundamentals with easy-to-understand theoretical explanations. Next, it provides a list of key aspects that are crucial from the CISA exam perspective, ensuring you focus on important pointers for the exam. Finally, the book makes you an expert in specific topics by engaging you with self-assessment questions designed to align with the exam format, challenging you to apply your knowledge and sharpen your understanding. Moreover, the book comes with lifetime access to supplementary resources on an online platform, including CISA flashcards, mock tests, additional practice questions, and valuable exam tips. With unlimited access to the website, you'll have the flexibility to practice as many times as you desire, maximizing your exam readiness. By the end of this book, you'll have developed the proficiency to successfully obtain the CISA certification and significantly upgrade your auditing career. What you will learnPerform an audit in accordance with globally accepted standards and frameworksRecognize and recommend opportunities for improvementUnderstand data analytics tools and processesComprehend the effectiveness of IT governanceEvaluate different type of frameworksManage audit reporting and communicationEvaluate evidence collection and forensics processesWho this book is for This CISA study guide is specifically tailored for anyone with a non-technical background who wants to achieve the CISA certification. It caters to those currently working in or looking to seek employment in IT audit and security management roles. Table of ContentsAudit PlanningAudit ExecutionIT GovernanceIT ManagementInformation Systems Acquisition and DevelopmentInformation Systems ImplementationInformation Systems OperationsBusiness ResilienceInformation Asset Security and ControlNetwork Security and ControlPublic Key Cryptography and Other Emerging TechnologiesSecurity Event Management Cover FM Copyright Contributors Table of Contents Preface Chapter 1: Audit Planning The Contents of an Audit Charter Key Aspects from the CISA Exam Perspective Audit Planning Benefits of Audit Planning Selection Criteria Reviewing Audit Planning Individual Audit Assignments Key Aspects from the CISA Exam Perspective Business Process Applications and Controls E-Commerce Electronic Data Interchange (EDI) Point of Sale (POS) Electronic Banking Electronic Funds Transfer (EFT) Image Processing Artificial Intelligence and Expert Systems Key Aspects from the CISA Exam Perspective Types of Controls Preventive Controls Detective Controls Corrective Controls Deterrent Controls The Difference between Preventive and Deterrent Controls Compensating Controls Control Objectives Control Measures Key Aspects from the CISA Exam Perspective Risk-Based Audit Planning What Is Risk? Understanding Vulnerability and Threats Understanding Inherent Risk and Residual Risk Advantages of Risk-Based Audit Planning Audit Risk Risk-Based Auditing Approach Risk Assessments Risk Response Methodology Top-Down and Bottom-Up Approaches to Policy Development Key Aspects from the CISA Exam Perspective Types of Audits and Assessments Summary Chapter Review Questions Chapter 2: Audit Execution Audit Project Management Audit Objectives Audit Phases Fraud, Irregularities, and Illegal Acts Key Aspects from the CISA Exam Perspective Sampling Methodology Sampling Types Sampling Risk Other Sampling Terms Compliance versus Substantive Testing Key Aspects from the CISA Exam Perspective Audit Evidence Collection Techniques Reliability of Evidence Evidence-Gathering Techniques Key Aspects from the CISA Exam Perspective Data Analytics Examples of the Effective Use of Data Analytics CAATs Examples of the Effective Use of CAAT Tools Precautions while Using CAAT Continuous Auditing and Monitoring Continuous Auditing Techniques Key Aspects from the CISA Exam Perspective Reporting and Communication Techniques Exit Interview Audit Reporting Audit Report Objectives Audit Report Structure Follow-Up Activities Key Aspects from the CISA Exam Perspective Control Self-Assessment Objectives of CSA Benefits of CSA Precautions while Implementing CSA An IS Auditor’s Role in CSA Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 3: IT Governance Enterprise Governance of IT (EGIT) EGIT Processes The Differences between Governance and Management EGIT Good Practices Effective Information Security Governance EGIT – Success Factors Key Aspects from the CISA Exam Perspective IT-Related Frameworks IT Standards, Policies, and Procedures Policies Standards Procedures Guidelines Information Security Policy Key Aspects from the CISA Exam Perspective Organizational Structure Relationship between the IT Strategy Committee and the IT Steering Committee Differences between the IT Strategy Committee and the IT Steering Committee Key Aspects from the CISA Exam Perspective Enterprise Architecture Enterprise Security Architecture Key Aspects from the CISA Exam Perspective Enterprise Risk Management Risk Management Process Steps Risk Analysis Methods Risk Treatment Key Aspects from the CISA Exam Perspective Maturity Model Laws, Regulations, and Industry Standards Affecting the Organization An IS Auditor’s Role in Determining Adherence to Laws and Regulations Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 4: IT Management IT Resource Management Human Resource Management IT Management Practices Financial Management Practices Key Aspects from the CISA Exam Perspective IT Service Provider Acquisition and Management Evaluation Criteria for Outsourcing Steps for Outsourcing Outsourcing – Risk Reduction Options Provisions for Outsourcing Contracts Role of IS Auditors in Monitoring Outsourced Activities Globalization of IT Functions Outsourcing and Third-Party Audit Reports Monitoring and Review of Third-Party Services Key Aspects from the CISA Exam Perspective IT Performance Monitoring and Reporting Development of Performance Metrics Effectiveness of Performance Metrics Tools and Techniques Key Aspects from the CISA Exam Perspective Quality Assurance and Quality Management in IT Quality Assurance Quality Management Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 5: Information Systems Acquisition and Development Project Management Structure Project Roles and Responsibilities Project Objectives, OBS, and WBS Key Aspects from the CISA Exam Perspective Business Case and Feasibility Analysis Business Cases Feasibility Analysis The IS Auditor’s Role in Business Case Development System Development Methodologies SDLC Models SDLC phases Software Development Methods Software Reengineering and Reverse Engineering Key Aspects from the CISA Exam Perspective Control Identification and Design Check Digits Parity Bits Checksums Forward Error Control Data Integrity Principles Decision Support Systems Decision Trees Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 6: Information Systems Implementation Testing Methodology Unit Testing Integration Testing System Testing Testing Approach Testing Phases Key Aspects from the CISA Exam Perspective System Migration Parallel Changeover Phased Changeover Abrupt Changeover Key Aspects from the CISA Exam Perspective Post-Implementation Review Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 7: Information Systems Operations Understanding Common Technology Components The Types of Servers Universal Serial Bus Radio Frequency Identification IT Asset Management Performance Reports Job Scheduling End User Computing System Performance Management Nucleus (Kernel) Functions Utility Programs Parameter Setting for the Operating System Registry Activity Logging Software Licensing Issues Source Code Management Capacity Management Key Aspects from a CISA Exam Perspective Problem and Incident Management Network Management Tools Key Aspects from a CISA Exam Perspective Change Management, Configuration Management, and Patch Management Change Management Process Patch Management Configuration Management Emergency Change Management Backout Process The Effectiveness of a Change Management Process Key Aspects from a CISA Exam Perspective IT Service-Level Management Evaluating the Database Management Process Advantages of Database Management Database Structures Key Aspects from a CISA Exam Perspective Summary Chapter Review Questions Chapter 8: Business Resilience Business Impact Analysis Key Aspects from the Perspective of the CISA Exam Data Backup and Restoration Types of Backup Strategy Storage Capacity for Each Backup Scheme Key Aspects from the Perspective of the CISA Exam System Resiliency Application Resiliency – Clustering Telecommunication Network Resiliency Business Continuity Plan Steps of the BCP Life Cycle Contents of the BCP Backup Procedure for Critical Operations The Involvement of Process Owners in the BCP BCP and Risk Assessments Testing the BCP Key Aspects from the Perspective of the CISA Exam Disaster Recovery Plan The BCP versus the DRP Key Aspects from the CISA Exam Perspective DRP – Test Methods Checklist Review Structured Walkthrough Tabletop Test Simulation Test Parallel Test Full Interruption Test Key Aspects from the CISA Exam Perspective Recovery Time Objective (RTO) and Recovery Point Objective (RPO) RPO RTO and RPO for Critical Systems RTO and RPO and Maintenance Costs RTO, RPO, and Disaster Tolerance Key Aspects from the CISA Exam Perspective Alternate Recovery Sites Mirrored Site Hot Site Warm Site Cold Site Mobile Site Reciprocal Agreement Summary Summary Chapter Review Questions Chapter 9: Information Asset Security and Control Information Asset Security Frameworks, Standards, and Guidelines Auditing the Information Security Management Framework Key Aspects from the CISA Exam Perspective Privacy Principles Physical Access and Environmental Controls Environmental Controls Alarm Controls Water and Smoke Detectors Fire Suppression Systems Physical Access Control Key Aspects from the CISA Exam Perspective Identity and Access Management Access Control Categories Default Deny Policy – Allow All Policy Degaussing (Demagnetizing) Naming Convention Single Sign-On Key Aspects from the CISA Exam Perspective Biometrics Biometrics Accuracy Measure Control over the Biometric Process Types of Biometric Attacks Summary Chapter Review Questions Chapter 10: Network Security and Control Network and Endpoint Devices Open System Interconnection (OSI) Layers Networking Devices Network Devices and the OSI Layer Network Physical Media Identifying the Risks of Physical Network Media Network Protocols Key Aspects from the CISA Exam Perspective Firewall Types and Implementation Types of Firewalls What is a Bastion Host? What is a Proxy? Types of Firewall Implementation The Firewall and the Corresponding OSI layer Key Aspects from the CISA Exam Perspective VPN Types of VPN VPNs – security risks VPNs – Technical Aspects Key Aspects from the Perspective of the CISA Exam Voice over Internet Protocol (VoIP) Key Aspects from the CISA Exam Perspective Wireless Networks Enabling MAC Filtering Enabling Encryption Disabling a Service Set Identifier (SSID) Disabling DHCP Common Attack Methods and Techniques for a Wireless Network Key Aspects from the CISA Exam Perspective Email Security Key Aspects from the CISA Exam Perspective Summary Chapter Review Questions Chapter 11: Public Key Cryptography and Other Emerging Technologies Public Key Cryptography Symmetric Encryption versus Asymmetric Encryption Encryption Keys The Hash of the Message Combining Symmetric and Asymmetric Methods Key Aspects from the CISA Exam Perspective Elements of PKI PKI Terminology Processes Involved in PKI Certifying Authority versus Registration Authority Key Aspects from the CISA Exam Perspective Cloud Computing Cloud Computing – Deployment Models Types of Cloud Services Cloud Computing – the IS Auditor’s Role Virtualization Mobile Computing Internet of Things (IoT) Summary Chapter Review Questions Chapter 12: Security Event Management Security Awareness Training and Programs Participants Security Awareness Methods Social Engineering Attacks Evaluating the Effectiveness of Security Programs Key Aspects from the CISA Exam Perspective Information System Attack Methods and Techniques Malicious Code Biometric Attacks Key Aspects from the CISA Exam Perspective Security Testing Tools and Techniques General Security Controls Network Penetration Tests Key Aspects from the CISA Exam Perspective Security Monitoring Tools and Techniques IDS IPS Honeypots and Honey Nets Key Aspects from the CISA Exam Perspective Incident Response Management Computer Security Incident Response Team Key Aspects from the CISA Exam Perspective Evidence Collection and Forensics Chain of Custody Key Elements of Computer Forensics Summary Chapter Review Questions Index Other Books You May Enjoy