Upcoming Dates & Locations
Cybersecurity Risks from an Audit Manager's Perspective - OAM302
New regulations, increasing IT security threats and staff shortages challenge audit management to address the organization’s IT risks. This course covers recent security breaches to put into perspective a strategy to help avoid devastating harm to the organization’s reputation from these headline-making security breaches. This course provides working knowledge of IT terms and concepts; updates on new and emerging technologies affecting your business, and ways to establish a strategic response.
Who Should Attend
Internal audit seniors, and managers involved with identifying, assessing and reporting on the technology-related risks for their internal audit projects or for the internal audit risk assessment.
- Fundamentals of Internal Auditing - OAG101
- Equivalent Experience
What You’ll Learn
You will learn about a wide range of technologies, the challenges posed by technological change, and ways to provide assurance that IT risks are being adequately addressed.
- update on recent security breaches
- data breach commonalities
- how hackers are hacking
- IT risk definitions
- information security objectives
- IT audit engagement strategies
- IT control categories
Basics of Information Technology - Battling the Buzzwords:
- why learn about technology?
- defining cyberspace & cybersecurity
- Operating Systems (OS)
- mainframe & client/server technology
- virtualization / virtual servers
- network environment
Logical Security Risks and Controls:
- social media and social engineering
- components of access control
- user identification and authentication
- authorization and user access controls
- log management
- patch management
- vulnerability assessments
- systems administrator / privileged access
Network Risks and Controls:
- what is a “network”?
- networking risks
- LANs & WANs
- network addressing
- Intrusion Detection Systems (IDS / IPS)
- Virtual Private Networks (VPNs)
- cloud computing
Database Risks and Controls:
- Database Management Systems (DBMS)
- database terminology
- database risks
- relational databases
- database audit procedures
IT General Controls:
- change management
- business continuity / disaster recovery
- physical security
- environmental exposures
Auditing System Development Projects:
- business risks
- getting involved … how, when, who?
- audit’s coverage
- auditing waterfall and RAD Projects
- communicating audit’s roles and results
- audit staffing
- audit resources
Assessing IT Governance:
- what is IT governance?
- IT governance risks
- determining the IT governance audit scope
- using COBIT® 2019 to assess IT governance
Audit and Control Frameworks and Standards:
- IIA - Global Technology Audit Guides
- ISO 27002 Security Standard
- NIST Cybersecurity Framework
- Center for Internet Security - 20 Critical Security Controls
- FISMA (NIST 800-53) - Federal Information Security Modernization Act
Why You Should Attend
You should attend because internal audit management must be aware of cybersecurity risks, their source, and mitigating techniques to effectively advise management and the board.
MIS Training Institute is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.nasbaregistry.org.