- Mainframe audit
Definition of mainframe
A mainframe computer is not easy to define. Most people associate a mainframe with a large computer, but mainframes are getting smaller all the time. The terms mainframe and enterprise server are converging. Supercomputers are generally used for their speed and complexity, while mainframes are used for storing large volumes of sensitive data.
Organizations in different areas can have different auditing and security requirements. Some factors affecting the organizations' requirements are: external factors such as regulatory requirements; management, objectives, and business practices; and the organizations' performance compared to the industry. This information can be obtained by conducting outside research, interviewing employees, touring the data center and observing activities, consultations with technical experts, and looking at company manuals and business plans.
Another consideration is the level of access employees have and the password policies in place at the company. Evidence of implementation can be obtained by requesting employee manuals, evaluating the software and user histories, and by physical observation of the environment. (Gallegos, 2004).
Physical access is also an area of interest. Are cables adequately protected from damage and sniffing between the Network and the Data Center? This can be achieved by proper routing of the cables, encryption, and a good network topology. Physical observation of where the cables are routed and confirmation of the security procedures should be obtained. Tests of controls should be conducted to determine any additional weaknesses.
Does the mainframe have access to an adequate uninterruptible power supply? Are physical controls such as power badges for access, fire suppression devices, and locks in place to protect the data center (and the mainframe inside) from theft, manipulation or damage? Physical observation is necessary to ensure these requirements.
The Operating System
- What controls are in place to make sure the system is continually updated?
- Is the software configured to do updates, or is it done by the system technicians?
- Controls should be in place to deter unauthorized manipulation or theft of data.
- Proper separation of duties also needs to be verified. The company’s internal controls need to be tested to determine if they are effective.
- Samples of entries into the system should be examined to verify that the controls are effective, while unauthorized and suspicious voided transactions need to be investigated. (Gallegos, 2004)
- Are there any processes on the system that could needlessly compromise other components?
- Procedures and measures need to be in place to minimize the risk of unauthorized access through Backdoors in the system, such as the Program Properties Table (PPT).
- There should be an accurate audit trail that can be followed. endeavor (The Henderson Group, October, 2001).
- Are proper separation of duties implemented and enforced, and are technology and procedures in place to make sure there is a continuous and accurate audit trail?
- Controls need to be put in place to minimize the risk of unnecessary and unauthorized entry into the system, and the protection of passwords.
- Computer assisted audit techniques should be used to explore the system, and on hand observations should be conducted to verify procedures, such as separation of duties are being followed.
- Security systems such as RACF, ACF2, and Top Secret need to be constantly evaluated to verify that they are providing the necessary security and if additional protection such as new firewalls is needed. (The Henderson Group, August, 2002).
- Is concerned with the performance and the controls of the system.
- Is it able to limit unauthorized access and data manipulation?
Evaluate whether sufficient evidence was obtained
After performing the necessary tests and procedures, determine whether the evidence obtained is sufficient to come to a conclusion and recommendation.
How is the security of the mainframe maintained?
Mainframes, despite their reliability, possess so much data that precautions need to be taken to protect the information they hold and the integrity of the system. Security is maintained with the following techniques:
- Physical controls over the mainframe and its components.
- Encryption techniques.
- Putting procedures in place that prevent unnecessary and unauthorized entries into a system and that input, output, or processing is recorded and accessible to the auditor. This is particularly important for people with elevated privilege.
- Security Software such as RACF, ACF2, and Top Secret.
- Constant testing of the security system to determine any potential weaknesses.
- Properly protecting backdoor accesses.
- Continual examination of the techniques to determine effectiveness.
To gauge the effectiveness of these internal controls an auditor should do outside research, physically observe controls as needed, test the controls, perform substantive tests, and employ computer assisted audit techniques when prudent.
- Gallegos, F., Senft, S., Manson, D., Gonzales, C. (2004). Information Technology Control and Audit. (2nd ed.) Boca Raton, Florida: Auerbach Publications.
- Messier jr., W., F. (2003) Auditing & Assurance Services: A Systematic Approach. (3rd ed.) New York: McGraw-Hill/Irwin.
- Licker, M., D. (2003). Dictionary of Computing & Communications. New York: McGraw-Hill
- Philip, G. (2000). The University of Chicago Press: Science and Technology Encyclopedia. Chicago, IL: The University of Chicago Press.
- O’Brien, J., A., (2002). Management Information Systems: Managing Information Technology in the E-Business Enterprise. 5th ed. New York: McGraw-Hill/Irwin.
Wikimedia Foundation. 2010.
Look at other dictionaries:
Systems Applications Products audit — is when a computer system from SAP undegoes an audit to check its security and data integrity. SAP is the acronym for Systems, Applications, Products. It is a system that provides users with a soft real time business application. It contains a… … Wikipedia
Information technology security audit — A computer security audit is a manual or systematic measurable technical assessment of a system or application. Manual assessments include interviewing staff, performing security vulnerability scans, reviewing application and operating system… … Wikipedia
Aldon Inc. — AldonInfobox Company company name = Aldon Inc. company type = Private company slogan = Process Driven Application Lifecycle Management for Every Environment foundation = 1979 location = Emeryville, CA, U.S. num employees = 100+ est. (2007)… … Wikipedia
IBM DB2 — Developer(s) IBM Initial release 1983 (1983) … Wikipedia
Cloud computing — logical diagram Cloud computing is the delivery of computing as a service rather than a product, whereby shared resources, software, and information are provided to computers and other devices as a utility (like the electricity grid) over a… … Wikipedia
History of operating systems — The history of computer operating systems recapitulates to a degree the recent history of computer hardware. Operating systems (OSes) provide a set of functions needed and used by most application programs on a computer, and the linkages needed… … Wikipedia
Job scheduler — This article is about a class of software. For the mathematical problem in Computer Science, see Job Shop Scheduling. For other uses, see Scheduling (disambiguation). A job scheduler is a software application that is in charge of unattended… … Wikipedia
History of information technology auditing — Information Technology Auditing (IT auditing) began as Electronic Data Process (EDP) Auditing and developed largely as a result of the rise in technology in accounting systems, the need for IT control, and the impact of computers on the ability… … Wikipedia
MUD — This article is about a type of online computer game. For other uses, see Mud (disambiguation) … Wikipedia
Data center — An operation engineer overseeing a Network Operations Control Room of a data center. A data center (or data centre or datacentre or datacenter) is a facility used to house computer systems and associated components, such as telecommunications and … Wikipedia