An Overview of IT Risk and Control

An Overview of IT Risk & Control
Presented at the HH Internal Auditor’sCOP.
By
Ismail Oduoye CISA,CISSP
December, 2019

Outlines
01
02
03
Introduction
Definition of IT Risk
Objective
What is IT Risk and Control
IT Risk and Control
An overview of IT Risk and
Control/IT Risk Management
04
05
06
Risk Response plan
Discussion of various risk
management approach.
IT Risk Identification
Activities involved in the
detection of risk in the
enterprise IT asset.
Questions
Rubbing mind session

Objectives
An overview of the IT Risk & Control and discussion of various
activities involved in the identification of risk in an enterprise IT
asset.

Introduction
What is Risk?
 Risk can be view as a challenge or obstacle to
achieving set objectives.
 ISO called risk “the effect of uncertainty on
objectives”
 IT Risk is view as a negative event.
 IT Risk is the potential that a given threat will
exploit vulnerabilities of an asset or group of
assets and thereby cause harm to organization.

IT Risk and Control/Management
IT Risk and Control/IT Risk management
is defined as the coordinated activities to
direct and control an enterprise with
regards to risk.
It is a set of activities undertaken to
predict challenges and lower the chance
of risk occurrence or its impact.
IT Risk management is a cyclical process.

Risk Response
Negative risk or threat
 Negative risk or threat
 Avoid
 Transfer
 Mitigate
 Accept
Positive risk or opportunity
 Exploit
 Share
 Enhance

IT Risk Identification
1. IT ASSET INVENTORY AND
ENUMERATION
 IT Asset Review
 Method and technique of detecting active
devices on the network.
 Asset Classification based on criticality to
the enterprise business operation.
2. ENTERPRISE NETWORK SECURITY
 Enterprise network architecture review and
assessment.
 Firewall logs review and analysis.
 Firewall configuration review .
 How to use basic network scanners, NMAP,
Angry IP, etc.
 Improving network access security .
The following activities are involved in the risk identification stage of the IT
Risk Management cycle.

3. DATABASE REVIEWAND MONITORING
 Basic database monitoring tools.
 What to know while deploying DAM.
 What to look for while monitoring your
organization database.
 Database Vulnerability Test and Management.
4. MALWARE ACTIVITIES MONITORINGAND
REVIEW
 Need for an enterprise antivirus solution
equipped with endpoints protection.
 Antivirus logs review and analysis.
 Gaining insight into users ‘activities on the
Enterprise network.

5. VULNERABILITY MANAGEMENT
 Methods and Techniques of detecting
Vulnerabilities in the system
 Ports and services scanning
 Servers configuration review
 System patch review
 Automation of vulnerability Management with
tools such as Qualys Guard and Nessus.
 VAPT of web application using OWASP or free
available tools on the internet.

6. SIEM (SECURITY INFORMATION EVENT
MANAGEMENT)
 SIEM implementation and requirement gathering
 Automation of security tool’s log review and
analysis.
 Active directory activities monitoring.
 Office 365 activities monitoring.
 Incident detection and reporting.
7. APPLICATION REVIEW TECHNIQUIES
 Functional testing.
 Application architecture and positioning on the
enterprise network.
 Code documentation and review.
 VAPT using Burp suite or OWASP tools
 SSL Certificate vulnerability assessment
 Free online web application scanner

8. USER ACCESS REVIEW ON CORE BUSINESS
APPLICATION
 Separation of duty technique.
 Inventory of active and Inactive users
 Secure password requirement.
 User profiles modification review.
 Approval should be in place for each user created.
 Exited staff profile review across the various platforms.
 Implementation of 2fa.
9. Other activities expected of IT Security Professionals
 Crawl the internet for detection of clone websites.
 Daily search on social media platforms for detection
impersonated profiles/pages.
 Policies and other administrative framework review.

An Overview of IT Risk and Control

More Related Content

What's hot (20)

Similar to An Overview of IT Risk and Control (20)

Recently uploaded (20)

An Overview of IT Risk and Control

Editor's Notes