IT component decomposition
IT component decomposition
Organizations can facilitate planning and efficient performance of IT audits by clearly identifying IT assets and technical controls to be addressed within each type of audit. Decomposing IT audit subject areas into individual technologies helps to more accurately determine the scope of each audit, the skill sets and competen- cies needed by the auditors, and the level of resources necessary to complete the audit process. IT audit plans reflect the type of audit and its intended purpose, the IT components it will examine, and the procedures, protocols, standards, or criteria auditors will use. Decomposing the IT assets and corresponding controls included in an audit is analogous to the business-centric process of clearly defining the organ- izational level (e.g., enterprise, business unit, operational function, and project) to which the audit applies. Many approaches to information technology decomposi- tion use architectural frameworks or reference models to categorize different tech- nologies and determine the appropriate audit procedures to use for each component under examination. Such frameworks typically distinguish among IT systems, the environments in which those systems operate, and models or views describing the details of underlying technology components and their interaction [10] .
There is no single standard or “best” method to evaluating systems or techni- cal environments. One approach involves decomposing a system into its constituent parts and auditing each component individually, applying similar audit protocols across all major elements but also using technology-specific procedures or check- lists where appropriate. Organizations may use their own system architecture stand- ards or models as a guide for decomposing their systems in a consistent manner or follow available external standards applicable to the types of systems they maintain. Commonly used models for system decomposition include the seven-layer Open Systems Interconnection model described in ISO/IEC 7498-1 [11] , the software architecture design specified in ISO/IEC 12207 [12] , or other systems and soft- ware architecture description languages conforming to ISO/IEC/IEEE 42010 [10] . To audit a typical n-tier architected system, for example, an auditor using such an approach might separately examine the web server, application server, database, middleware or other integration technology as well as the administrators, support personnel, and end users who access the system. An alternative approach to audit- ing systems at the individual component level considers all components, points of integration, and data flows together as the basis for an end-to-end examination, sometimes called path analysis (or critical path analysis, or transaction path analy- sis). As illustrated in Figure 6.3 , this approach—informed by methods used in var- ied contexts such as network traffic analysis and behavioral analytics—defines the system scope by tracing the flow of information from initiation by a user or other system through all points of interaction. Path analysis may offer a more appropriate audit approach for transactional systems or those supporting processes with clearly correlated inputs and outputs.
Common categories or IT components representing audit subject areas include the eight IT elements shown in the center of Figure 6.1 . Some special audit
Auditing Different IT Assets 115
Request
Response
User Internet Boundary Firewall Web Firewall Application Database router
One approach to auditing IT systems focuses on the end-to-end flow of information associated with a transaction or other type of user or system interaction.
considerations also apply in certain types of operating environments such as cloud computing or other uses of server virtualization technology, and system or applica- tion access using web browsers, mobile devices, or other types of client applica- tions and interfaces. The following sections briefly describe the context and audit considerations applicable to different IT components.