BullsEye Selected as a Master Contractor for Maryland Montgomery College’s Multi-Year IT Contract

Posted on July 13, 2018 by Doguhan Avsar

Fulton, Maryland – July 11, 2018 – BullsEye Computing Solutions was selected by Montgomery College of Maryland as a Master Contractor for a five-year IT contract.

Under this IDIQ contract, BullsEye and its subcontractors will provide IT staffing and project-based services to the college and its affiliates in six (6) functional areas:

IT Management
IT System Management
Information System Security
Web & Internet Systems
Application Support & Software Engineering
Data Analytics & Reporting

BullsEye specializes in empowering technology and human resources to help customers achieve process efficiency and deliver high-profile, mission critical projects. The firm has 20 years of experience fulfilling business and IT needs of commercial and public organizations throughout the world. For more information, contact Elizabeth Hess at (410) 480-9443.

BullsEye plans to leverage Global Shield IS as a partner firm to bring unique Information Security and Compliance experience to enhance expertise in their respective focus areas.

Global Shield Information Services (GSIS) specializes in IT auditing for highly regulated government and commercial organizations. It supports public accounting firms with IT Risk Management Capabilities and performs IT financial and security audits and information assurance. For more information, contact Doguhan Avsar at (202) 656-4099, or visit https://globalshieldis.com/.

An Introductory Guide to Audit Readiness – Part 3

Posted on October 15, 2016 by Doguhan Avsar

Continuing from Part Two where we covered three of the four competencies within an organization and their procedures for audit readiness – Information Technology (IT) can turn out to be the most complex.

IT audit readiness may include, but is not limited to the following:

Resource planning for the organization and readiness procedures
IT General Controls
IT Systems and application controls

IT resource planning for audit readiness

As discussed in part two of the audit readiness guide, one of the roles in the planning process is to help identify experienced team members who can contribute towards the IT department’s audit readiness, as they are the ones who have most likely undergone at least one or more IT audits. These individuals would be most familiar with the processes involved and would understand what the auditors would be requesting, the types of audits they would run, and the systems and applications involved.

Identifying IT internal systems and applications for audit readiness

Audit readiness activities for the IT environment require the identification and evaluation of in-scope systems within the organization. The organization should be tracking, recording and reporting on any activities taking place that involve the selected systems and/or applications involved in the audit readiness plan and within any department reliant on these the IT systems.

Activities may include:

Documented system certification and accreditation packages
Plans regarding system or application security controls
Project plans and/or agreements on any application interfaces
IT compliance procedures

Once the appropriate systems and applications have been identified, the audit process should move onto assessing the following two groups of controls:

IT general controls
IT application controls

IT general controls and IT applications controls

The objective or intent of IT General Controls (ITGC) is to apply assurance over the system environment(s) of in-scope systems and/or applications. The ITGCs establish the integrity of:

Processes and computer operations
Data and data files
Components and programs

ITGCs most commonly known are:

Computer operations controls
Data recover and backup controls
Data center security controls
Program management and program change management controls
SDLC also known as system development lifecycle controls
Access controls for data, applications and infrastructure

Furthermore, the objective or intent for IT application controls is to apply control(s) over an individual application or system, intending to support business processes.

Consideration and preparation are key to any audit assessment. Ensuring the organization’s environments, systems and applications are identified and assessed will improve the overall efficiency during any audit or assessment related activity.

Global Shield IS specializes in IT audit readiness procedures. We are a global audit and advisory services company ready to help you become audit ready. Contact us today for advice.

Please note: These guidelines from Global Shield IS, are for an organization’s general information purposes only. It is not intended to advise or give any legal or business analysis. Global Shield IS, rather offers the services to any business who have further questions related to their uncommon or unique circumstances, to contact the office for further council. We will then assign the most appropriate adviser to address each question specifically.

An Introductory Guide to Audit Readiness – Part 2

Posted on August 29, 2016 by Doguhan Avsar

Continuing from Part One where we covered the key milestones in the readiness process for an audit, as well as the timelines to consider for assessments in Governance, Risk Management, Compliance, Information Technology and Financial Reporting, we can now take a look at the following competencies within departments and their procedures for audit readiness:

The required leadership to support assessments
IT Resources (IT)
The procedures of internal controls, and
Information Technology competencies – to be covered in Part 3

Required Support from Leadership

Support from leadership is defined by the organization’s culture to adopt audit readiness, as part of a necessary company process. If leadership supports audit readiness procedures, it will often create an environment that will achieve full cooperation from all levels of the organization and typically will yield better results than an organization without leadership support.

Full adoption and support from leaders across the organization would result in complete engagement planning standards, defining who should be involved in the audit procedure and what their role will be in the readiness process. These leaders should have an ongoing, active role throughout the entire readiness process.

Audit Readiness for IT

To understand the audit readiness procedure for IT, means to have the right employees with the right skills, aptitudes, experience and continuing education in place, who are able to identify any drawbacks or obstacles and correct them along the way. These skilled individuals will also have the capabilities to establish practical solutions to implement, and would have the ability to analyze and address any manual or automated requirements for internal controls. They would also have the ability to determine and/or train supporting staff required to assist in the readiness procedure.

Once IT leadership has successfully put the appropriate readiness resources in place, the resource level of the team, as well as their individual skill needs to be sustained and prepped for growth. Sustainability can be accomplished through continuous training and knowledge sharing within the department. Each resource should also receive challenging tasks or be assigned appropriate projects to challenge and grow the overall IT team skillset, further sustaining the readiness procedure.

Assurance with Internal Controls

Internal controls requires a designed set of policies and procedures which would need to be implemented and then maintained. Maintaining these policies and procedures provides assurance for the achievement of steady and functioning business operations; compliance for regulated and any legal procedures; and lastly for any reporting.

Once an organization has demonstrated an efficiency with their internal control procedures and has been able to prove that their organization is in good standing, it will prove to be a positive benchmark on the overall health of the organization, including its financial statements.

An Introductory Guide to Audit Readiness – Part 1

Posted on July 27, 2016 by Doguhan Avsar

Understanding the audit readiness of an organization, is to have the ability to identify the auditory requirements that need to be in place from an infrastructure or back-end perspective, to the preparation needed to take place from a financial reporting perspective.

Auditory requirements for an audit may include:

Governance
Risk management
Compliance
Information technology – environment
Financial reporting
The financial close process

Each of these areas may pose a significant risk to the successful execution of an audit, if not taken into consideration as an overall ‘audit requirements’ set. These particular elements for an audit are routinely overlooked or underestimated by executives and management, along with their various teams. Executives and management who need to lead these teams, rather focus on gaining the competitive edge in their industry, then at the most basic level, tend to lack the understanding and knowledge required to consult, and therefore, prepare and achieve the readiness required. Executives and management should rather turn to industry consultants for support and guidance while they focus on ‘business’ success. Turning to a professional consulting firm from the beginning, can lead to a successful audit along with reduced overhead costs while undergoing the audit itself.

The time required to prepare

In most cases, the effort and time required to readily prepare for an audit are frequently misconceived once timelines are set, or more often than not, underestimated. While each organization’s timelines may vary depending on the unique business requirements, it can typically take from 6 to 18 months to achieve readiness.

The key milestones in the readiness process should include:

An overall readiness assessment
A compliance assessment
A financial reporting assessment
IT infrastructure/systems and data assessment
Corporate governance assessment
Any other specific to-the-business requirements needing to be included in the assessments’

IT and data assessments – the most time consuming

Global Shield IS, considers all the key milestones to be relevant, and important to include in the timeline. Among these milestones, most notably, IT infrastructure, systems and data assessments usually require a considerable amount of time to execute. Furthermore, specific to timelines, audit related engagements from Global Shield IS are managed professionally and supervised to ensure quality and utilize industry specific audit processes.

The timelines and processes of preparing for the IT and data specific assessments should provide any organization with a clearer understanding of their business operations, on how to perform more efficiently and effectively going forward.

How PCI compliance is a major challenge for most businesses

Posted on June 17, 2016 by Doguhan Avsar

PCI compliance is considered to be a tough challenge in itself, however maintaining current compliance until the next PCI assessment takes place is much harder task.

Businesses who do manage to meet PCI compliance requirements at first, but fail at their next PCI compliance assessment, often remain unprotected and are at risk of a data breach, or may even receive various high impact security threats. This is due to the lack of management, or rather the continued management thereof, and the fact that it is treated as an annual event instead of a continuous effort throughout the year. We have seen many examples of the pitfalls of yearly exercises as opposed to continuous monitoring of the same controls within both the public and private sectors.

Standards or procedures created to increase control

Payment card/credit card processing organizations such as payment processors, financial institutions, merchants, and even service providers, have standards and procedures to abide by which help increase security and controls around the card owner’s data, leading to reduced credit card fraud. Companies such as Global Shield IS are able to understand an organization’s required standards and offer compliance assessment services, then create a Report on Compliance (ROC) to serve as a guide to uphold the set out standards for compliance going forward.

Too many businesses stop paying attention to ongoing PCI compliance activities. They often do not realize it should be seen as an ongoing effort. As an ongoing effort, businesses are able to continually mitigate various and arising risks.

We would say that if a business did meet the required PCI compliance standards, and failed, it is more likely they failed at the implementation of standards, or failed to continuously apply the defined standards.

Understanding the practice of continuous PCI compliance

Businesses can take control of their processes to unhold PCI compliance through practices such as:

Monitoring access which may include the use of Active Directory, Lightweight Directory Access Protocol, antivirus software, firewalls, (hardware and/or software) other access control mechanisms, Etc.
Ensuring security breaches or security control failures are detected and addressed in a timely manner
Assessing how newly introduced systems or new developments impacts PCI compliance, and updating accordingly
Assessing the impact on PCI compliance with acquisitions and mergers

Lack of resources to continue PCI compliance

Another challenge for businesses are the resources required to keep up with the demands of staying PCI compliant. Often resources are assigned to other duties or projects, allowing for compliance tasks to fall lower on the prioritization list. This more than likely happens after the initial, or annual PCI assessment/audits take place.

Businesses should conduct regular reviews with assigned resources, and strive to communicate the necessity of performing each task required to stay compliant. Regular reviews should cover tasks such as:

Reviewing the necessary configurations, and make sure they are applied
Reviewing any data centers and audit logs on a defined, periodic basis
Verify the PCI requirements that need to continually be in place
And so on…

The ongoing procedure to review and monitor processes that need to be in place for PCI compliance sets the necessary standard for performance. Achieving the necessary standard for security, should be considered as a business-as-usual act for any business large or small.

Three Steps to Improving Logical Access

Posted on March 29, 2015 by Doguhan Avsar

3-29-2015

One of the most important IT control areas to consider for any small, medium or large-scale organization is logical access to resources such as applications and databases. Logical access is the process by which a user or object is identified, authenticated and/or authorized to an application, system, database or another object[1]. Every organization must implement logical access in order to protect valuable data and resources, both internally and externally. Logical access to information prevents this data from being accessed by employees or external threats that might present a risk to the organization. This also ensures that the right resources are being accessed on a need-to-know basis, based on each individual’s role within the organization.

If an organization chooses to ignore implementing logical access controls, it runs the risk of losing proprietary data to the outside world, which could pose a threat to the organization. If you run a search on logical access breaches you will find thousands of recent examples of data that was extracted for malicious purposes by both employees of organizations and outside threats such as hacking groups. The following three steps will enable an organization to implement logical access and provide a basic framework to protecting its data.

Step 1: Identify gaps and risks regarding logical access

The first step must be to assess what types of controls are in place currently to protect organizational data, “what do we currently have”. From there, an evaluation must be directed to find out what types of controls are missing, “what do we need”. In regards to the missing controls, calculating the risk, impact and likelihood is a necessary part of this evaluation. Other criteria to consider are:

Documenting a system inventory of all applications, databases, interfaces and systems within your organization.
Excessive Privilege: What does each employee have access to? Are controls in place to ensure each employee has access to only what he or she needs to perform daily job duties? An example of excessive privilege would be if Sandra in Accounting had full access to the Human Resources system.
Are the Access Control policy and procedures built off of a framework? Examples of frameworks are COSO, COBIT and NIST.

Step 2: Develop access control policy and procedures

The second step must be to develop an access control policy and procedures that adhere to the new policy. The policy will dictate an organizational wide process to implementing the access controls. Although developing a new policy can be a daunting task, the NIST, COSO and COBIT frameworks offer a great deal of information including templates to developing your access control policy and procedures.

Once the policy and procedures are outlined and developed, they must be updated, revised and tested for any errors and omissions. All members of the organization must be involved in the development process to make sure that every department’s opinions and concerns are taken into consideration. For example, if you leave the development of the policy strictly to IT management, it might restrict too much access for anyone to conduct his or her daily duties. On the other hand, if HR develops the policy, it might be too lenient and not address any threats appropriately.

Step 3: Continuously monitor and update with any changes

As the world evolves, so will its existing threats, vulnerabilities and risks. Therefore, the last step of improving logical access consists of continually monitoring and updating the implemented policy and procedures as necessary. In addition, reviews of access controls should be conducted on a periodic basis as deemed necessary by the organizational, or as dictated by policy. This will ensure that all changes to the organization are considered and implemented into the access policy.

To close, access controls are necessary and an integral part of any organization, no matter what its size. Every organization must implement logical access in order to protect its data and resources from internal and external threats. The steps above are general and will help you get started. Each organization will have to tailor these steps as necessary. Each organization will also add or remove steps that do not present a risk at the time. In addition, implementing these steps will not guarantee that you will pass an IT audit. For assistance in understanding the requirements of an IT Audit or for help getting optimal results, please contact us. As always, if you or someone you know needs assistance in understanding or implementing a new access control policy, please do not hesitate to contact us at [email protected].

————————

[1] This is not to be confused with physical access, which can also accomplish the same means, however not through the use of software alone.

Configuration Management: Why You Should Care, No Matter Your Size

Posted on December 31, 2014 by Doguhan Avsar

12-30-2014

As technology advances and more companies turn to computer software to digitally process their data, a great deal of those companies overlook a very critical business process known as Configuration Management[1]. At a high level, Configuration Management (CM)[2] is the process of managing and tracking all changes within an entity, be it an individual server or an entire organization. It can quickly become a complex and labor intensive process, however implementing the basic fundamentals matter most. The official definition as stated by the National Institute of Standards and Technology (NIST)[3] is as follows:

Configuration Management (CM) comprises a collection of activities focused on establishing and maintaining the integrity of products and systems, through control of the processes for initializing, changing, and monitoring the configurations of those products and systems.

Over the course of the past ten years, we have observed companies, large and small overlook this process as a whole or mismanage the process by not segregating duties through several individuals, inherently introducing significant risk to the organization. As a result, lack of proper CM has resulted in non-functional software, data errors, systemÂ downtime, compromise of data and even financial fraud within an organization.

To minimizeÂ these costly risks it is important to incorporate a CM process to properly manage changes within your organization. Luckily, this process can be tailored to your organization depending on size and capabilities. NIST has a significantly detailed publication titled NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems which covers CM in large, complex environments along with the controls to periodically check that the process is working as it should in a separate publication titled NIST SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations[4]. In addition, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) offers a less detailed, financially focused framework[5] for managing a CM process.

However, if you do not have time to go through the processes mentioned above in great detail, or feel like your organization has not reached the level of where you would need to implement such a large effort to manage a small amount of changes to your IT environment, the following three steps could help start in developing your own CM process[6]:

Identify any risks and gaps in the current process for implementing and managing changes. Several factors to consider are as follows:
- Does your organization currently have a CM process?
- Understand the basics of the CM flow (documented in NIST 800-128 and COSO)
- Identify and accept or mitigate your risks before beginning to develop your new CM process. Such examples are as follows:
  - Does your organization currently have only one individual who is responsible for creating and implementing all changes within your IT environment? If so, this is a risk and will need to be mitigated. Examples we have seen in the past include separating duties and having a supervisor approve all changes before they are implemented into the production environment. In addition, changes included enforcement of separation, such as removing administrative access for programmers or implementers of changes.
  - Do you track all changes? If so, are they consolidated and reviewed on a periodic basis?
  - Do you keep backups of software or code before implementing new changes?
  - Do you have separate test and development environments for your software in order to test changes before implementing them into production?
  - Do you have a patch management process? Is your patch management process documented?

Develop your new process:
- Develop a tailored draft CM process from the fundamentals mentioned in in NIST 800-128 and COSO, the process should cover the CM controls in COSO and/or NIST 800-53, rev 4.
- Discuss your new draft CM process with all appropriate divisions, management and stakeholders involved in your business. Additional tailoring might be required based on managementâ€™s guidance and recommendations.
- Test the process from start to finish
- After successful testing, implement your newfound CM process and make the entire organization aware of the changes.
Continually monitor your process as you grow:
- Conduct patch management on your IT infrastructure.
- Conduct periodic vulnerability assessments on your IT infrastructure.
- Periodically review all changes for completeness and adherence to the CM process that you helped develop. This will help catch errors and also ensure that staff are following the new CM process.
- Revisit your CM process and periodically check for updated guidance from NIST or COSO. Make any changes or updates as necessary to improve the process.

The steps above are general and will help you get started. Each organization will have to tailor these steps based on internal policies and procedures. Each organization will also add or remove steps that do not present a risk at the time. In addition, implementing these steps will not guarantee that you will pass an IT audit. They only serve as guidance for starting the development of a CM process. For assistance in understanding the requirements of an IT Audit or for help getting optimal results, please contact us.

All organizations must implement some form of CM to manage changes to their systems and applications in order to reduce the risks mentioned above. Implementing an effective and efficient CM process will reduce[7] risks such as financial fraud, compromise of confidential data, non-functional software, data errors and costs associated with user downtime that come with implementing newer software and technology within your organization. As always, if you or someone you know needs assistance in understanding or implementing a new CM process, please do not hesitate to contact us at [email protected].

————————

[1] For the purposes of this article, we will use the term Configuration Management.

[2] We are referring to the IT Configuration Management process as opposed to the engineering Configuration or Change Management process.

[3] NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems, August 2011.

[4] NIST SP 800-53, rev.4, Security and Privacy Controls for Federal Information Systems and Organizations, April 2013.

[5] COSO, The 2013 COSO Framework & SOX Compliance, One Approach To An Effective Transition, June 2013.

[6] Before making any changes and/or implementing any processes into your organization, always consult with your IT Security and IT Audit departments.

[7] Although implementing a CM process will reduce certain risks, it does not eliminate them. Many other factors come into play when considering the threats of todayâ€™s world coupled with the vulnerabilities of todayâ€™s technology.