Blog

In the movie The Untouchables, a hit man pulls a knife to stab Sean Connery, then Connery pulls a shotgun on the hit man. The lesson from this scene is do not bring a knife to a gunfight.

A lot of corporate IT security staff must not have seen this movie. They are bringing knives to the data security fight while hackers bring guns, cannons, tanks and jet fighters.

With increasingly clever malware and phishing tactics, hackers are snagging users login credentials at a frightening pace and gaining access to networks. It can be as easy as exploiting a security hole in a web browser while the user is surfing the web to seize credentials and access privileged services.

While hackers poke, prod and probe networks every hour of the day looking for weaknesses, most corporate IT staff only review access privileges semiannually, quarterly or, if they are particularly diligent, monthly. The reviews are often perfunctory affairs that do not offer much in the way of detection or prevention.

That is not even bringing a knife to a gun fight; that is like remaining at the scene of the crime until the police arrive. Hackers have little fear of getting caught. The hacker who infiltrated Anthem’s customer database was not caught at all; Anthem did not detect the theft until 7 months later.

All of this responsibility does not necessarily have to fall to the corporate IT function. They are doing the best they can with what they have. If IT had to constantly examine and recertify user access with their current access management systems, they would not have time to do anything else. Their systems are typically a patchwork of manual or minimally automated security functions native to individual applications and databases. They do not exist in an integrated data security framework that enables IT to monitor usage of all key resources.

IT does not stand a chance of preventing more Anthem-level data losses until companies automate and analyze. Automating data extraction and cleansing provides a constant stream of user data. Analytical applications spot orphan accounts and irregular usage as they occur, not 7 or more months later. Arming IT with this kind of access management systems mean they are not going into the gunfight with a knife. It means they are ending the fight because the other side knows it cannot win.

Read Chris Sullivan’s recent ISACA Journal article:
“Accelerating Access Management to the Speed of Hacks,” ISACA Journal, volume 5, 2015.

[ISACA Journal Blog]

Angela Thomas, MS-MIS, MBA, audit coordinator for DFA Office of Internal Audit, recently passed the Certified Information Systems Auditor (CISA) exam. Here, she shares her story on how not giving up led her to success.

I took the CISA Exam for the first time in December 2014. My preparation for the December 2014 exam included reading and studying the following material:

• ISACA’s 2014 CISA Supplemental Manual containing 100 sample questions
• IT Auditing Using Controls to Protect Information Assets, 2^nd Edition, by Chris Davis
• CISA Certified Information Systems Auditor Study Guide, by David L. Cannon
• CISA Certified Information Systems Auditor All-in-One Exam Guide, 2^nd Edition, by Peter Gregory

I did not pass the December 2014 exam—I was disappointed about that, but I did not give up! I dusted off the above study materials, began studying again and registered for the June 2015 exam.  In addition to the above study materials, I purchased ISACA’s 2015 CISA Review Manual (CRM) that contains 1,100 sample questions, joined ISACA’s CISA Study Community Discussion and joined ISACA’s Official LinkedIn Group.

I obtained many online resources via the CISA Study Community that helped enhance my knowledge and understanding. I also gained some resources from the LinkedIn Group. I read the ISACA 2015 CISA Review Manual three times. The first time I read each question slowly and thoroughly and studied why each correct answer was the correct answer and why each incorrect answer was the incorrect answer. My second and third readings consisted of reading each question to try and select the correct answer based upon knowledge and understanding—not memory. Whenever I selected the wrong answer, I re-read and reviewed why the correct answer was correct and why the incorrect answer was incorrect.

The important thing to remember to be successful on the exam is to focus on the key words such as “best,” “most,” “first.” I knew this when I took the exam the first time, but although I felt like I was prepared, I was very nervous and anxious.  I think that negatively affected my performance. I felt completely different when I took the exam for the second time in June 2015. I was not as nervous and anxious. I felt that I was much better prepared, and my score demonstrated that—I scored in the top 20 percent during my second sitting! Now I am looking forward to applying for the CISA certification, as I continue my CISA studies, so I will be a successful Certified Information Systems Auditor.

[ISACA Blog]