Primary benefit of CSA Techniques

Control Self Assessment is predicated on the review of high-risk areas that either need immediate attention or a more thorough review at a later date.

Encapsulation

Encapsulation is a property of objects, which prevents accessing either properties or methods, that have not been previously defined as public. This means that any implementation of the behavior of an object is not accessible. An object defines a communication interface with the exterior and only whatever belongs to that interface can be accessed.

Which of the following is an object-oriented technology characteristic that permits an enhanced degree of security over data?
A. Inheritance
B. Dynamic warehousing
C. Encapsulation
D. Polymorphism

Risk

The risk that an error exists that could be material or significant when combined with other errors encountered during the audit, there being no related compensating controls, is the inherent risk. 

Control risk is the risk that a material error exists that will not be prevented or detected on a timely basis by the system of internal controls.   

Detection risk is the risk when an IS auditor uses an inadequate test procedure and concludes that material errors do not exist, when they do.   

Sampling risk is the risk that incorrect assumptions are made about the characteristics of a population from which a sample is taken.

Dead Man Doors

Only one can access at a time. Reduces risk of Piggy Backing. Unauthorized person follows authorized person into restricted area. It helps safe secure to confidential places. The security is comes under in Safety and Access Control Systems.

This Topic is regarding to Physical Access Control 

Physical Network Media

1)In any given situation, fiber-optic cables have proven to be more secure than the other media. They have very low transmission loss, not affected by EMI and preferred choice for high volumes and long distance calls.

2)When CISA question is about transmission error that can occur in wired as well as wireless communication, our answer should be attenuation.

3)It is essential to understand the difference between diverse routing and alternate routing. The method of routing traffic through split-cable facilities or duplicate-cable facilities is called diverse routing. Whereas the method of routing information via an alternative medium, such as copper cable or fiber optics is called alternate routing.

4)Also, CISA aspirant should be able to differentiate between last mile and long haul. Last mile provide redundancy for local loop whereas long haul provide redundancy for long distance availability.

Recovery Site

#In any given scenario, mirrored site is fastest mode of recovery and then hot site.

#In any given scenario, cold site is slowest mode of recovery.

#In any given scenario, for critical system, mirrored/hot sites are appropriate option.

#In any given scenario, for non-critical system, cold site is appropriate option.

#In any given scenario, reciprocal agreement will have lowest expenditure in terms of recovery arrangement.

Key Points of RTO & RPO

Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

1) RTO of 2 hours indicates that organization needs to ensure that their system downtime should not exceed 2 hours.

(2) RPO of 2 hours indicates that organization needs to ensure that their data loss should not exceed 2 hours of data captured.

(3)In any given scenario, for critical systems, RTO is zero or near zero. Similarly, for critical data, RPO is zero or near zero.

(4)In any given scenario, lower the RTO/RPO, higher the cost of maintenance of environment.

(5)In any given scenario, low RTO/RPO indicates that disaster tolerance is low. Other way round, if disaster tolerance is low, RTO/RPO should be low.

(6)In any given scenario, when RTO is low, mirrored site or hot site is recommended. 

(7)In any given scenario, when RPO is low, mirror imaging or real time replication for data back-up is recommended. 

(8)In any given scenario, where RPO is zero, synchronous data backup strategy to be used. 

(9)Both RTO & RPO are based on time parameters. The lower the time requirements, the higher the cost of recovery strategies.