Information Systems Operations

0:01In IT, there's lots of different types of technologies

0:03that we deal with on a daily basis.

0:06And some of these technologies actually introduce risk

0:09into our environment.

0:10So let's take a look at some of these technologies,

0:12and the risks they introduce, and what

0:14controls that we can put in place to protect us

0:17from those risks.

0:18Starting off, we're looking at some general architecture.

0:21We have first of, client server architecture,

0:25and that's where we have a client here,

0:26and a server over here, in the server houses,

0:28some kind of application or data,

0:30could be web or email or just files.

0:34And our clients over here, like our workstation,

0:37goes out to the server to access those applications,

0:40or that data.

0:41And this is a very common architecture

0:43within, pretty much, every business out there.

0:47Now, these most often run on a Windows or Linux

0:50operating system on our workstation,

0:53could be like a desktop, or it could be a laptop, as well,

0:56doesn't matter.

0:57Then, the other type of architecture we're

0:59going to discuss is mainframes.

1:01Now, these are used to house big data,

1:03they crunch a lot of data, they house a lot of data,

1:06and they have specialized operating system.

1:09And most of them are based off of Unix.

1:12So here's kind of a little image of a mainframe,

1:16they're generally pretty big, and there's

1:17lots of processing and compute within those mainframes.

1:23So they can handle all of that data,

1:25and provide us the information we need from it.

1:27So those are a couple of generalized types

1:29of architecture that we see in IT.

1:33Now, moving on USB devices.

1:35Now, there's USB keyboards, USB mice,

1:38USB everything under the sun, but what

1:40we're most concerned with are things like USB sticks.

1:44Where we plug them in to a computer,

1:46or it could be a USB drive, but either way, they house data,

1:51and they allow us to transfer data from one point to another.

1:55Now the problem with that is, there could be viruses on them,

1:58because if one has a virus, you might not know it.

2:01And as you go from computer to computer

2:03and plug it in to move data around.

2:06Well, guess what, you're infecting each of them,

2:09and that is definitely not a good thing.

2:12So that's something to keep in mind.

2:15What about data theft and data loss?

2:18Both of them dealing with, either theft

2:20of a device with data on it, or loss of a device or data on it.

2:24Well, that affects the confidentiality of that data,

2:28as well as the availability.

2:29So there's something that we need to keep in mind.

2:32The other thing is data corruption,

2:34It can happen as we move these USB sticks and drives

2:38from device to device, they can become corrupted, and then

2:41affect the availability of that data.

2:44Now what are some controls that we

2:46can put in place to help protect from some of those risks.

2:50Well, we could use encryption, because if we encrypt

2:53the data that's on this drive, and is lost or stolen, well,

2:57that data is not compromised.

3:01So that's a good thing, and that's what we want to achieve.

3:04Then, we have training, because we

3:06need to train people on how to use these properly,

3:08and what data they can store on them, because that

3:11goes straight to policy.

3:13What are our organizational policies about USB devices?

3:16Maybe, we can't use them at all, so there are no USB devices.

3:21Or if we do use them, then we can't

3:24store sensitive information on them,

3:26or they can't leave the organizational premises.

3:31And those are policies that we will put in place

3:33to help address those risks.

3:35And those policies need to be relayed to the end users

3:39through things like training.

3:41So you can see, training and policies, go hand in hand.

3:46And lastly, we're looking at hardware maintenance

3:49and hardware monitoring, because maintenance and monitoring also

3:52go hand in hand.

3:53So we have maintenance programs, and that's

3:56so that we can provide maintenance

3:58to our indoor workstations, and our network

4:01devices, and our servers, where the data is housed,

4:05so that they can live long, healthy lives,

4:08and they can be available for us.

4:10We talked about the CIA triad, that

4:13availability-- they can be available for us,

4:16by reducing the risk of downtime.

4:18So if you're an auditor at an organization,

4:21and you're looking at the maintenance program,

4:23well, first of all, you need to make sure

4:25that a formal maintenance plan exists, because without one,

4:28well, then, it's going to be hit and miss,

4:30and that's not a good thing.

4:31We also need to make sure that maintenance is logged,

4:34so it's documented, that it was completed.

4:36And we also need to look at maintenance budgets,

4:38because, if you see the budget out of control,

4:41well, that means that there's, probably, procedures

4:44not being followed.

4:45And that's because when a maintenance plan is created,

4:48a cost plan is created along with it.

4:51So we look at what maintenance will cost,

4:53and we make sure that maintenance cost doesn't

4:56exceed the amount of risk that we have, with a certain device.

4:59Because if I have a $500 switch in my environment,

5:03I'm not going to spend $5,000 a year on maintenance for it,

5:06when I can simply just get a second switch,

5:08and have it as a spare device.

5:11So cost overages can definitely indicate a lack of adherence

5:14to procedures.

5:16Then, we have hardware monitoring,

5:17because we need to monitor our hardware

5:19to make sure it's functioning properly,

5:21make sure it's available, make sure there's not errors in it.

5:24So we can do that with things like availability

5:26reports to make sure it's available,

5:27we can see it's uptime.

5:29We can identify hardware errors, and we can check out

5:32the asset management reports.

5:34You've got to have an asset management program in place,

5:37so that we know what devices are in our environment.

5:40So we can, number one, make sure they're available and being

5:43monitored, and make sure that maintenance

5:45is being performed on.

5:47And lastly utilization reports, we

5:49need to know the amount of resources being utilized

5:52in our environment, so that we can make sure

5:54that we have enough available to meet our business objectives.

5:58I hope that this has been informative for you,

5:59and I'd like to thank you for viewing.

0:01In IT environments, we work with lots of different assets.

0:04Such as servers, and network devices, and people.

0:08And a key role in IT, is to manage those assets to make

0:12sure that they last a long time and that we

0:14address any risk they introduce to the environment.

0:17But we can only do that if we know of all the assets

0:20that are there through some type of inventory.

0:23So let's take a look at asset management.

0:26So starting off, let's define what an asset is.

0:29So that's just something of value

0:31that's worth protecting, right?

0:33So that people, finances, because if we

0:36don't have finances we sure can't be in business.

0:38Our reputation, super important.

0:41Information like our data.

0:43And of course, architecture.

0:44We're talking about our workstations, and our servers,

0:48and all of our network devices, all of the infrastructure that

0:52makes up our architectures.

0:54And those are some of the assets we

0:55deal with on a day to day basis that will

0:58be part of IT Asset Management.

1:00So before we can actually protect any assets

1:04we have to identify them.

1:06We have to know what they are.

1:08So some of the things we would want to identify

1:10would be things like, who is the asset owner?

1:13How do we identify them?

1:15Is there an ID number or a serial number?

1:17What is their value to the organization?

1:20How much did we pay for it?

1:21What's it worth?

1:23And how about if we lost that device

1:26if it quit functioning what impact would

1:28that have to our organization?

1:29We need to know where it's located at?

1:31And then if there is a security classification identified

1:35with it, such as confidential or internal only

1:38then we need to know that as part of our asset inventory.

1:42Speaking of asset inventory we can either build that manually

1:46or we can use some tools.

1:48And I'd prefer to go the way of tools.

1:50So one of them that we can use is the Microsoft SCCM

1:54or you could also use something like Spiceworks,

1:58which is a free tool that you can use to manage your assets

2:02and identify what's out there in your environment.

2:04So again, you can use tools or it can be done manually,

2:07but either way it needs to be done.

2:09So as we create this asset inventory it's actually

2:13going to be the first step in lots of different processes,

2:16such as our software license management.

2:19Because we need an inventory of all the different software

2:22in our environment, so we can make sure

2:24that we have licenses for each of them.

2:27And data classification, again, we're

2:29looking to find out what is out there.

2:31So we can have an inventory of all the different types

2:34of assets, such as data and we can properly classify them.

2:39And then, of course, as I mentioned at the get go.

2:41We cannot protect an asset if we don't know it exists.

2:45So that's why IT Asset Management

2:47is such an important process in our organizations.

2:51I hope it has been informative for you

2:52and I'd like to thank you for viewing.

0:01Many years ago, I was introduced to scripting and poor Hellboy,

0:05that day a light went off of my head.

0:07And I thought I'd hit the jackpot.

0:09Because I could write scripts that

0:11could automate all the tasks that I had to do on a day

0:14to day basis that were so tedious.

0:17So let's take a look at job scripting, and automation,

0:22and what benefit it brings to us.

0:24So starting off, we're looking at jobs scheduling

0:27and that's simply scheduling some software

0:30to run scripts or batch files or batch

0:33jobs to accomplish some tasks in here's

0:36key an automated fashion.

0:39So this way, all those little tidious tasks

0:41that we have to do from day to day

0:43we can write a script that does those tasks

0:47and then we could schedule those tasks to run

0:50at periods throughout the day.

0:53Now a key to keep in mind when doing that is we

0:56need to ensure that resources are given

0:58to the higher priority jobs.

1:01And that way those that aren't so important

1:04can kind of happen after the super important tasks run.

1:08Then the other thing is that jobs

1:11need to be scheduled based on complexity and requirements,

1:15those two things.

1:16Complexity and requirements and let me explain why.

1:19The more complex jobs are most likely

1:23going to require more resources.

1:25So we see complexity canon maps over to resources.

1:29And that's why complexity is there.

1:31But what about requirements?

1:33Well, if I write a script, that say it goes out

1:36and it makes a list of all the directories on a volume.

1:39So I have all these different directories

1:42and then I have another job and it goes and it grabs this file

1:46and it goes through and run some tests

1:48for each of those directories in that file.

1:51Well, that's a requirement.

1:53I first have to have this file before the second job can

1:57run and do work against each directory listed in that file.

2:02So there some requirements or prerequisites

2:05that jobs will need to have.

2:08Now moving on, we look at job scheduling software

2:11because we can do all of this manually, but tell me tell you

2:15what, it's a pane to do it manually.

2:18Because once you really get into and you start thinking

2:21of all the things you can automate,

2:22then you're mainly going through and creating each these

2:25re-entering the same information over again,

2:27setting time, making sure things don't conflict.

2:30There's lots to take into account when

2:33you're doing the automation.

2:34So it's a great idea, not just a good idea.

2:37A Great idea to use some type of software.

2:41It provides us with many advantages,

2:42such as you only enter that data one time,

2:45then it's in the system and you can simply select it

2:48you'd want to retype it in.

2:50The other thing is intelligence within the jobs.

2:52Now we took the example over here

2:54where we created a file with one script that listed out all

2:59the directories on a volume.

3:00And then we had another job that did work on all of those listed

3:05directories.

3:06Well, if this job didn't happen, if something happen and this

3:11completely failed well, the secondary job down here,

3:14it can't run at all.

3:16And that intelligence can say hey,

3:18job 1 did not complete successfully.

3:21So therefore I'm not going to run any jobs that

3:23had job one as a prerequisite.

3:26So that's where the intelligence comes in handy.

3:29The other thing is human operators.

3:32We need to reduce our reliance on them if we can,

3:35because we are human, we make mistakes,

3:38and mistakes are not necessarily a good thing.

3:40But if we use a software program to do this forth,

3:43once we program it correctly one time

3:46it can rerun those same jobs without any errors.

3:50So we can reduce the number of errors in our activity.

3:54And lastly, these applications will create audit logs for-- so

3:59that we can look at all the activities

4:01that were performed by the system

4:03to make sure they happen correctly,

4:05we can have it create reports for us.

4:07And we can also oftentimes have it send us notifications

4:11if jobs failed.

4:13And that's why the job scheduling softwares are so

4:16done handy.

4:18I hope this has been informative for you.

4:19And I'd like to thank you for.

0:01When you were a kid you ever played the pass

0:03the message game.

0:04You know where you'd line up a bunch of people,

0:06the first person whispers a message

0:08into the second person's ear, and then

0:11that message is relayed down the line of people.

0:14Now we know that at the end that message

0:17is never the same message that we started with.

0:20Well systems pass information back and forth

0:23between each other through their system interfaces.

0:26Now let's take a look at how we can manage these system

0:28interfaces so that we can ensure the message we end up

0:32with is the same message we started with.

0:34So looking at system interfaces.

0:37This is where the data output and data input happens.

0:41So we have one system sending data to another system,

0:45and the key is we want to make sure

0:48that the data that was sent from system 1 over here as it sent

0:53is the same message received over its system 2

0:57because that way we trust the data we know

0:59it's accurate and complete.

1:01Well how can we do that?

1:03Well, we can use input controls.

1:05One type of input control is a checksum.

1:09Then a checksum is a value that represents

1:12the data that was transmitted or a message really.

1:15So if we have a message over here

1:17and it's full of information we can run that

1:20through a mathematical formula and output what's

1:25called a hash value also known as a checksum, which is just

1:30a value, it's a bunch of numbers or letters

1:35that represent that data.

1:37And that way when the second server receives

1:41that message they run this or read the message

1:44they received through that same mathematical formula

1:49and their hash or checksum should be the same.

1:53And if it is then we know our system too

1:56knows that data is the same message that was transmitted.

2:01And that is a type of input control known as a checksum.

2:05Now organizations need to have a process or a system in place

2:11to monitor all the transfers that's

2:13happening between these systems, and it's

2:16for a specific reason or actual several reasons.

2:20Number 1, so we can see all that data transfer activity

2:23while it's happening, and there's

2:25going to be a record of that activity.

2:27Such as this who sent it?

2:29And who received it?

2:31What time did it happen?

2:32What date?

2:33What kind of data was included in it?

2:35Was there a checksum, because there should be,

2:38And what was that checksum?

2:40So this gives us records that we can go back and look

2:43at if there is a problem because if there's

2:46not a along with what happened and there's a problem then

2:49it can be really hard to figure out

2:51what the root cause of that problem was and to fix it.

2:54And it also provides a way to audit the data transfer

2:58activities so that we can verify things are working properly.

3:03Speaking of audit well, what should auditors

3:05do when looking at these system interfaces and programs

3:08used to track these system messages or transmissions.

3:12Well, first of all, you need to make sure

3:13that there is a program because if there is not that's always

3:17step 1, make sure you've got a program in place

3:20is going to track those system messages or transmissions that

3:24happen.

3:25Then we need to make sure that when that data is transmitted

3:30from one system to another, if it's going through

3:34like an internet let's say, where

3:36it could be seen by other organizations

3:40that it is encrypted appropriately.

3:42So there should be some type of encryption process

3:46that's happening to make sure that data is secured and cannot

3:49be read by anyone who might have access to that data as it

3:54traverses the internet.

3:56Now, this might not always be required.

3:59But it's something to keep in mind when you're dealing

4:01with sensitive types of data.

4:03The other thing is we need to verify authentication

4:06is used when appropriate.

4:07What I mean by that is when this system is sending data

4:12across to this system over here, how does this system

4:15too over here know that system 1 is who it should

4:20receive the message from?

4:22Well, oftentimes there's some type of system identifier

4:27that is sent along in those message transmissions.

4:29So if we were to look at a message transmission

4:32it might have as part one like a system identifier in one

4:37area of the message and then it could have the destination

4:42server as another part so it knows

4:44that when this one receives the message over here,

4:48it looks at the SID, the system identifier of the sender,

4:52and it says oh, yes, I know this sender

4:54and I am supposed to receive messages from it.

4:57Then it might look at the destination

4:59the server identifier which would be of this server

5:02here that matches from here, and it says yes that is me

5:07so I'm going to accept that message

5:09and I will now process it.

5:11And that could be a type of authentication.

5:13So authentication is oftentimes used and we need to make sure

5:17when appropriate it is used as well as, of course encryption

5:21that we talked about. .

5:22And that we have a program into place

5:24to track all that communication between the systems

5:28I hope this has been informative for you.

5:30And I'd like to thank you.

0:01Have you ever had a great idea for a computer program.

0:04But you're not a developer, so you don't know how to code it

0:07and the idea just goes by the wayside.

0:10Well the good news there's a type of systems called end user

0:13computing and they allow non developers

0:15to create applications.

0:17Well, that is not necessarily a good thing

0:19because some of those applications

0:22fall outside of the management of IT and the support of IT,

0:26so that causes problems.

0:27So let's take a look at what we should consider when

0:31managing end user computing.

0:33So end user computing as I said allows for non developers

0:37to create their own application.

0:39So that's really cool and can be super handy,

0:42however, it does bring some additional risk with it.

0:46Because again some of these applications

0:49will fall outside of the support of IT meaning IT

0:53is not included in the daily support of these applications.

0:57And that means we end up with these applications that

1:00might not be secured properly.

1:02The data that they hold might not be backed up,

1:05and the people who do support them

1:08the user who created it might not practice change management,

1:12so that could cause a loss of availability

1:15of this application.

1:16And the coding itself could contain errors

1:19since it was developed by machine

1:22and there wasn't a lot of input from an actual coder.

1:25So they have goods and bads you know, pluses and minuses.

1:30And we need to understand that so when

1:32we have these systems in our environment

1:35that we can manage them appropriately and here's

1:38key manage that risk that they bring to the environment.

1:43So as it pertains to these end user computing systems

1:46management needs to be involved and they

1:49need to determine the criticality of the application.

1:53Because if that application really

1:56does provide some special source to the business

1:59or the organization, it needs to be supported

2:02it needs to be backed up.

2:03You know we need to make sure the data in it

2:05is classified properly, we need to make

2:07sure there's proper maintenance being done to it.

2:10There's lots of things in the more critical it is,

2:12the more we attention we need to pay to it

2:15and make sure that it's supported.

2:17They also need to make sure the application is

2:19subject to any data classification policies that

2:23are in place.

2:24Because if it does hold sensitive data,

2:26it needs to be managed appropriately

2:29and data classification comes into play.

2:32And of course when we're talking about security of applications

2:36we have controls and we need to make sure

2:39that these EUC end user computing applications have

2:43the same control lists for them.

2:46Like input controls, and output controls, and authentication

2:49controls you know we can go on and on,

2:51but they need to have the same controls as all the

2:54IT supported applications because they

2:56are important to the business and the business objectives.

3:00So as an auditor what should you be looking for?

3:03Well, as an auditor you should be

3:05looking to make sure that there are end user computing

3:08policies in place.

3:09They need to be specific policies

3:12around in user computing, what is

3:15acceptable use of these systems, and what kind of information

3:19needs to be recorded about them.

3:21Who needs to know about them.

3:23When you create a new EUC application

3:26do you need to let IT know so they can add it to the data

3:29backup jobs?

3:30It's things like that.

3:31We need to have policies and procedures in place

3:34around in user computing.

3:36And then, of course, we have to have an inventory of these EUC

3:41applications.

3:42Remember a couple of videos back,

3:44we talked about asset inventory, well.

3:46These EUCs are going to be assets

3:50and we need, to have them inventoried so

3:53that we can make sure they're accounted for

3:55and they're being supported properly.

3:57And that is end user computing.

3:59I hope those has been informative for you,

4:01and I'd like to thank you for viewing.

0:00Data is a key part of many businesses and users

0:04of that data need to have confidence in the fact

0:07that that data is accurate and complete.

0:10And the only way we can do that is through managing the data.

0:13And we do that via a process called data governance.

0:16So let's take a look at data governance and data lifecycle.

0:20Data governance, if we were to say what that is in a nutshell,

0:24it's the management of data so that the users who

0:28use that data can absolutely have confidence that it

0:31is accurate and complete.

0:34And that is a key point there, accurate and complete.

0:38So that's what data governance is.

0:40Now, what that does is provide us with some things.

0:44It allows us to see and understand

0:48that this information or data is being managed

0:51through decision making.

0:53That means that the data isn't left on its own

0:56to do whatever it does.

0:58It's that management is there, they're looking at data.

1:02They're making decisions based on that data

1:05and how it's reacting to the environment.

1:09Now other than that, data governance

1:11make sure that that data that you have

1:14is meeting stakeholders needs.

1:16That means that the business is going

1:18to be able to meet objectives and use that data effectively.

1:23And lastly that the data is monitored.

1:25And when we're monitoring data, we're

1:27looking for performance to make sure it's

1:29meeting performance needs.

1:30So it's not slow for users.

1:32It's not full of a bunch of errors.

1:34And we're also looking for compliance.

1:36Now that compliance could be for sensitive data,

1:39and we have to make sure we're meeting

1:41certain regulatory compliances for that data.

1:44Or it could be that we have internal requirements so

1:47that our data must be accessed within certain time frames,

1:52or it has to be very speedy in with response time.

1:57And we could be monitoring data for those types of compliances

2:02as well.

2:03Now as an auditor, you should be looking at data quality

2:07because we need to look at that quality.

2:12And what I mean by data quality is that the data

2:16doesn't have errors.

2:17It's complete and accurate in itself.

2:21And the reason we need that quality to be there

2:24is because if it's not, the organization

2:26isn't going to be able to meet its objectives.

2:29And we said this throughout the entire course,

2:32it's all about business objectives

2:34and making sure that every different piece

2:36of the organization helps or aids

2:39the business in meeting those objectives.

2:42So as an auditor, we need to be looking at data quality

2:45so that we can make sure it's up to par

2:48so that the organization can use that data

2:51to meet its objectives.

2:52I mentioned we're going to look at data life cycle,

2:55and that's what we're looking at here.

2:57Now it's actually a five step life cycle,

3:00and it starts with planning.

3:02So in planning, we need to understand how

3:04that data is going to be used.

3:06Are we going to classify it?

3:08And is there a value to that data, meaning

3:11is that maybe our secret recipe that has 18 herbs and spices.

3:16And that's what makes our business so successful,

3:19and that's what makes it special.

3:22That's our IP or Intellectual Property.

3:25So at that point, there is a value to it.

3:27It could be, not necessarily, it doesn't have to be a recipe.

3:30It could be a way that we create something.

3:34Other people create it, but we create it in such a way

3:36that it brings additional value to our customers.

3:39And that brings value to us and the products we provide.

3:43So that's planning.

3:44We have to figure out what kind of data do we want,

3:46and what kind of classification and value

3:49is it going to provide.

3:51Then we need to either create, meaning build,

3:54or acquire this data.

3:55So we're going to create it, or we're

3:57going to go out and purchase the data.

3:59So now that we've planned for the data,

4:01we know what we're looking for, we

4:03have to create it or go and get it, or acquire it.

4:06And once we do that, then we can start to use the data.

4:08We store it in our systems.

4:11We share it between users and maybe

4:12between business partners.

4:14And of course, we use that data to provide something, perform

4:18some functionality.

4:19And once we've done that, then we're

4:21looking at the monitoring part of the lifecycle.

4:24And we're making sure that that data

4:26continues to work properly.

4:28And we talked about this in the last slide, where we're

4:31looking at management and making decisions around the data

4:35so that we can make sure it is maintaining its accuracy

4:39and completeness.

4:40And so that's where the monitoring comes into play

4:43to make sure that we can monitor data

4:45so that we can tell if there's changes

4:48that might be harming the data.

4:49And we can address those to make sure that data

4:52stays pristine for us.

4:53And lastly once we're finished with the data,

4:56we can either retain it by putting it

4:58into some type of archive, or we destroy it

5:01because we no longer need it.

5:02And that is the data lifecycle.

5:05I hope this has been informative for you.

5:07And I'd like to thank you for viewing.

0:01Every time you log into a computer,

0:03you're interacting with the operating

0:05system, which is the base of the computer system.

0:08And I'm sure you've heard lots of different types of operating

0:11systems, like, Windows and Mac and Linux.

0:14And there's others as well.

0:16So let's jump in and take a look at some of these operating

0:18systems and the importance that logging plays in the management

0:23and security of these systems.

0:25So the operating system is basically

0:28the foundational layer of code that runs on computers.

0:32And it gives users access to applications, which is key.

0:36Now, some different operating systems are Windows, Macs,

0:40and there's Android, and there's Linux, which you

0:44see represented by the penguin.

0:46Now, earlier videos, we talked about the client server

0:49architecture where we had workstations

0:53that connected and communicated with servers that

0:56housed applications and data.

0:58And we said that the workstations generally

1:01run Windows or a Linux operating system.

1:06And then we also talked about mainframes,

1:09where they handled the big data and they

1:11did lots of processing analytics,

1:13and that those generally ran on Unix systems, Unix operating

1:19systems.

1:20Now, software controls in parameters

1:23come into play when we're interacting

1:25with these operating systems.

1:27For example, they enable features, like,

1:29activity logging that is so important.

1:32And they enable other features, too,

1:34like turning printers on or configuring them, setting

1:37a wallpaper for your desktop environment, and other things,

1:41like, setting network information, network addresses,

1:44and such.

1:44So you can do lots of features and parameters

1:48can be set within your operating systems

1:50to provide different services.

1:53Now, as I said, the activity logging is one of them.

1:56And that is very important to remember.

1:58Now, you can also modify resource management,

2:02such as the power settings, like, on your workstation.

2:05You might set the power settings so

2:07that when your computer is inactive for a certain amount

2:10of time, the hard drive doesn't turn off.

2:12So that's an example of some of the resource management options

2:16that you have within operating systems.

2:18Now, operating systems logging is super important,

2:22like I said.

2:23It helps us to identify errors and malicious activity.

2:28And some of that malicious activity

2:29could be things, like, what users access

2:32to what application or data.

2:34And it could be what remote devices

2:36has a computer talked to.

2:38And that's good to know because if a computer is infected

2:41with a virus or a worm and is communicating

2:45with other hosts on the network, well,

2:47we can use the logs to try to identify where on the network

2:52that those viruses or worms have replicated to.

2:56And it also allows us to look at applications

2:59and what resources those applications have accessed.

3:02And that's important because applications

3:05can be compromised.

3:08So if I have an application installed on my computer,

3:11well, that's a program running on there.

3:13And this program here could be infected by a bad guy.

3:18And if it does, then that bad guy

3:19can use that application to access things on that computer

3:23and on the network.

3:25And it's not like a user account is doing this.

3:29It is the application itself being used as a tool

3:33by the bad guy.

3:34So that's why it's important that we're

3:35able to look at application access

3:38to resources as well as user access to resources.

3:43Now, I'm not sure if you know this or not,

3:45but most systems, like, servers on a normal infrastructure--

3:50if you turn logging on, like, the security logging

3:53we talked about, they can easily log 10,000 events every day.

3:58And that is super easy.

3:59A lot of them will log more, like, 30,000 events per day.

4:04And that is too much for a single person

4:07to look through and identify some malicious activity

4:11or errors, right?

4:12That's just way too much.

4:13And that's just one server.

4:14Imagine if you had 100 servers.

4:16We're looking at millions of log entries every day.

4:19Well, there's a system called a SIEM.

4:22That's a security information and event management.

4:25And what that does, it's a system that you set up

4:28or you can have hosted or you could pay as a service.

4:33And what that does is all of your system logs,

4:36like, from your servers and your network devices and firewalls

4:39and such, get fed into the SIEM.

4:42And this SIEM is designed to ingest those logs

4:46and perform analysis on that data

4:50and look for malicious activities

4:52and suspicious activities and errors and alerts.

4:54And it can send notifications out a lot of times via email

4:59or through different types of communication programs

5:03to admins to let them know that something suspicious

5:07or an alarm or an alert has been identified

5:10so that we can act on it.

5:12And that system that does that is referred to as a SIEM.

5:17So the SIEM helps us to ingest and analyze

5:19all those hundreds of thousands or millions

5:22of entries of logs every day because we know

5:25we can't do that as a person.

5:27And those are some of the things we

5:29need to consider when looking at operating systems management.

5:32I hope this has been informative for you.

5:33And I'd like to thank you for viewing.

0:00Every time you install a software,

0:02there's an end-user license agreement or EULA to agree to.

0:07And the EULA is how software vendors legally

0:10protect their applications that they produce and distribute.

0:14So let's take a look at some different types

0:16of software licensing.

0:18With software licensing, well, that's

0:21how software vendors protect their products

0:25via copyright laws and such.

0:28And there's a couple of different types

0:29of licensing agreements.

0:31First of all, we have the free.

0:33Hey, hey, I love me some free software,

0:35as long as it's software, not full of viruses and such.

0:39And those types of software are known

0:42by a couple of different names.

0:44The first of which is open source.

0:46And I'm a huge proponent of open source software.

0:50There's lots of great products out there

0:52that are open source, which means they are free.

0:55And here's the other thing, not only are they free,

0:58but the source code is openly available.

1:02So you could get a copy of the original source code,

1:05and you can edit it and make changes to it, and look at it

1:09and make it your own.

1:10You can do something called forking.

1:12And when you fork, you take the original code in there,

1:16and you just kind of tweak a little bit of it.

1:19Let's say, this bit here, we're going to change it up

1:21to meet our needs.

1:22And what we end up with is a new product

1:26that has a lot of the old code in it but also our new code,

1:29and this is a new fork.

1:31But basically open source, it's really great stuff.

1:35And it's well supported by the community, the open source

1:38community.

1:39And a lot of times is more secure than a paid closed

1:43source application because so many people actually

1:46get to look at the source code and identify problems with it.

1:50Then there's also freeware, and that's basically just

1:53free applications.

1:55You don't necessarily get the source code with that.

1:59And then we have shareware, and those where applications

2:01are freely available and shared amongst users,

2:04and again source code may not be involved with that.

2:08Then we have the paid version of software.

2:12So oftentimes when you're getting

2:14a licenses for paid software, you

2:16have to decide on what type of license you want.

2:19For example per seat, where it could be actually per computer

2:23that's there.

2:24So you could have one computer, and you license it

2:27on that computer and 10 different people

2:29use it but only one at a time.

2:31And that's because it's one computer, and it's one license.

2:34You might have to license it per CPU.

2:37Like in the past, I know Microsoft SQL

2:40has been licensed per CPU.

2:42So for example, if you had a server with four CPUs in it,

2:46you have to buy four CPU licenses

2:49to run it on that server.

2:50Otherwise you wouldn't be able to take advantage of all four

2:53of those CPUs.

2:55And these licenses change all the time,

2:57so you have to check with the vendors

2:58to see what they're using it at that point in time of purchase.

3:02But there's also concurrent users,

3:04which is a number of active users at the same time.

3:07We run into this on terminal servers

3:09a lot of times, which is a server that people remote into.

3:13So you might have a bunch of people

3:15at workstations, especially if they're working from home,

3:17and there's a server in the cloud.

3:19And they use something like remote desktop protocol

3:22to connect to it.

3:23And they run a desktop in that environment up there.

3:27And there might be 30 people on that server.

3:30So there are 30 concurrent users that could use that software.

3:34So you have to understand that there are different types

3:38of paid licensing.

3:39There's also one called enterprise or site license.

3:42And that's just generally a flat fee, and it's as many users

3:46as you want to use it within your organization.

3:50So that's a couple different types of software

3:52and some more explanation about each, you got free and paid.

3:56Now as an auditor, thinking about as an auditor, when

4:00you're looking at an organization and you're

4:02auditing their licensing.

4:04What do we need to be looking for?

4:07Well that's a great question.

4:08Well first off, we need to get a list of the software

4:11that that organization has.

4:13Because if we don't have a list that's

4:15showing all the different software they have,

4:18then how do I know what software to look for

4:21and to check for licensing.

4:22Now once I have that list in like step one,

4:25I need to go through step two.

4:27And I need to go through and verify

4:30that there is a license agreement for each

4:33of those software.

4:34So it could be an open source agreement,

4:36or it could be a paid agreement.

4:37It could be per seat, concurrent users like we talked about,

4:41or an enterprise or site license.

4:43It could be any of those.

4:44But basically we need to go through and check those often,

4:47and make sure there is a license agreement for each

4:49of those softwares.

4:51Then what we can do is if we have time, we can go out

4:54and we can from our computer, we can

4:57scan the network looking for softwares that are

5:01out there in the environment.

5:03So we can kind of make our own list,

5:05and we can match it up with the list

5:07they provide to see if we can find something

5:09that's not on their list.

5:11And that's something that we might do

5:13is to go ahead and scan the network

5:16and look for other softwares.

5:18And of course lastly, we're going

5:20to note any discrepancies or violations that we find,

5:24and we're going to report them.

5:26So really, we're looking to make sure that the customers

5:29that we're auditing, they have a list of software and license

5:33agreements for each of them.

5:34I hope this has been informative for you,

5:36and I'd like to thank you for viewing.

0:00For organizations that write applications,

0:03it's very important to ensure that the code is

0:05properly managed.

0:06And one of the ways we can do this,

0:08is through the use of a version control system.

0:12Now, these version control systems

0:14help us manage the code, and reduce

0:16the risk that's associated with managing and writing of code.

0:20So let's take a look at these version control systems,

0:23and the advantages that they provide us with.

0:25Well first of, whenever we're dealing with source code,

0:29we may need to, from time to time, use a software escrow.

0:34And that is a third party, who will hold on

0:38to software's source code, as a trusted third party.

0:44Now, this is associated with basically,

0:48purchasing applications from third party vendors.

0:53And the whole idea of the software escrow

0:56is to address the risk of the vendor going out of business.

1:01Let's say, for example, we go and buy this new great software

1:05from vendor A. And vendor A, six months later

1:10goes out of business.

1:12Well, now what?

1:13We just spent all this money on this new software product,

1:16but now, we don't have access to the source code,

1:19so we can't continue to make changes or edit

1:23this application as we see fit, to meet our business need.

1:27And that is a big sad face.

1:30So how can we avoid the risk of that happening?

1:34Well, we use what's called a software escrow,

1:36I just mentioned.

1:37And again, it's a trusted third party,

1:40that the source code gets sent to and they hold onto it.

1:44And that third party will not release that code to us,

1:48unless certain events happen, such as a vendor going out

1:52of business.

1:53And that helps us to reduce the risk of purchasing

1:56closed source software, which is software that we don't

2:00have access to the source code.

2:02But in this case, if the vendor did go out of business,

2:05we would have access to it through that escrow.

2:09Now, if we're writing applications in-house,

2:12we should be using a version control system, also known

2:15as a code repository.

2:17And these are super important, because they

2:19help reduce the risk associated with managing code.

2:23They provide us with lots of benefits, such as, some

2:27of these advantages.

2:29Such as, tracking changes that have

2:31been made to code, because every time change is made,

2:34we need to track it, so we have different versions.

2:38It allows us to have multiple people working

2:41on the same area of code at the same time,

2:44so that's concurrent coding.

2:46It allows us to roll back and go back

2:48to different versions of code that we've created in the past.

2:53It also allows us to manage something called branching.

2:55And that's when we take a piece of code,

2:58and we change a little bit of it.

3:00And now, we end up with a new piece of code.

3:03So this could be branch A, and this is branch B,

3:06and now we have a new branch of code.

3:10And that's what branching is.

3:12So let's take a look, over here on the right here,

3:14we have an example of kind of a central version control

3:18system, that's our VCS here.

3:20And you'll see down here, we've got workstations,

3:23so we've get three different coders or developers,

3:26working on some code.

3:27And up here is our central repository.

3:30And the way this works, they can all be working on code,

3:32and as this says, this workstation A

3:35over here, will have A, B, and C. A,

3:38goes and makes a change in the code,

3:41and adds the letter X to it.

3:43Well, once they commit that, it goes to the repository,

3:46and the repository pushes that update down

3:50to the other workstations.

3:52So they can continuously get updates to the code

3:55that they're working with.

3:57In that way, they're able to see the changes as they happen.

4:00And this is very important, and super handy for managing code.

4:05Now, as an auditor, what should you

4:07be concerned with, and looking to evaluate

4:10with version control systems?

4:11Well, first of all, who, as in, what developers,

4:15and what managers has access to code?

4:18Because only those who need access, should have access.

4:21You don't want your entire organization

4:23to have access to this code, because that is not

4:26good security practices.

4:27Now, the other one is, who can commit code,

4:31which means put it into production.

4:33Only certain people should be able to put code

4:36into production.

4:37And that's, for an example, you don't want all developers to be

4:40able to put new code into production,

4:42because if they were untrustworthy,

4:44they could make changes and deploy them

4:46into production and cause harm.

4:48But we have processes to prevent that, right?

4:51So you might have a group of developers who have access

4:55to the code, but then only managers

4:59can actually deploy the code.

5:02So when a developer makes code, or creates new code,

5:05they send it to the managers, who run it through test

5:08to make sure it's OK.

5:10And once it's tested, it gets deployed.

5:12Or there could be a group of testers,

5:15who are kind of the middle person,

5:16developers send to the tester, tester sends it

5:18to management for the OK, and management deploys it.

5:22Either way you don't want the developers deploying

5:24it themselves, there should be a process in place to make sure

5:28that those applications are tested,

5:29before they're deployed.

5:31And that's what we're checking for as auditors.

5:33And then, of course, make sure that they're using

5:36change management procedures.

5:38And that goes back to making changes,

5:40if we're making changes, we need to make

5:42sure they're tested and verified,

5:44before they're pushed out.

5:45And then lastly, we want to make sure,

5:47that the code is being backed up,

5:49it's being sent off-site for off-site backups,

5:52or a copy is being put into escrow, maybe.

5:55It all depends on the situation, but we

5:57need to make sure backups is happening.

5:59Now, here's one key, I want you to understand for sure.

6:01As auditors, when we're auditing a VCS, we are not,

6:06and this is a very important, look down here at the bottom.

6:09We are not concerned with who made an error in the code,

6:15or who did a coding error.

6:16We are focused on process and use of the VCS itself.

6:22So if you were there auditing, and somebody says,

6:26hey, there's a problem with the code.

6:29Well, you're not concerned with who

6:31did that, who caused that error, and who,

6:33maybe, needs additional training in the coding and processes.

6:36You are concerned, as an auditor,

6:38with the process of using that VCS,

6:42making sure that it's being used properly.

6:44And that's your role, when it comes to auditing VCS.

6:48I hope this has been informative for you,

6:50and I'd like to thank you for viewing.

0:00When it comes to our vehicles, we all

0:02keep an eye on our fuel gauge, because it's

0:04the fuel that makes our cars run, whether it be

0:07petroleum base or electricity.

0:09So we practice capacity management

0:12by managing what's in our fuel tanks.

0:14And the same thing is true for IT.

0:17We must provide capacity management services

0:20to make sure that our resources are there,

0:23and we have enough to meet our business objectives.

0:26So let's take a look at capacity management.

0:30So what is capacity management?

0:33Well, it's pretty simple.

0:34It's basically, managing, monitoring

0:36and planning of our compute and network resources

0:41to make sure that we have enough of it.

0:43We need to make sure we have enough resources,

0:45so that we can meet our day to day needs,

0:48and we can look to the future needs,

0:50and see if we have enough for upcoming projects.

0:53So there's some benefits that we get from capacity management.

0:57The First of which is cost savings.

1:00And that cost savings is because we can make sure

1:03that we're only making necessary expansions or purchases

1:08to our infrastructure.

1:10If we're practicing capacity management,

1:12we know when we need more resources.

1:16So if we don't need it, then don't

1:18spend it, and save that money.

1:20And that's where cost savings comes into play.

1:22The second benefit is resource planning,

1:25looking to the future.

1:28If I can look and say that I'm at 50% utilization

1:32today of my resources, and I know that our projected

1:36growth is X. Then I can say, hey, looking forward,

1:41we won't need to upgrade our servers

1:44or network for a good 30 months, but once we hit 30 months,

1:49we're going to be at capacity, and we're

1:50going to need to upgrade.

1:52What does that allow us to do?

1:53Well, it allows us to budget and plan

1:56appropriately to help our business succeed.

2:00And that's where resource planning comes in.

2:02So the overall goal of capacity management

2:07is to make sure that IT has all the resources it needs, to meet

2:11our business objectives.

2:13And by doing this planning, we can

2:15ensure that that will happen.

2:16Now, what are some of the things we

2:18want to monitor when we're performing capacity management?

2:22Well, we want to look at resources,

2:23like our CPU, our memory, how much storage are we using?

2:28What kind of bandwidth are we using on our network

2:31and telecommunications?

2:32These are all things we need to be monitoring.

2:35We also need to look at number of users in our environment,

2:38because if I can say, for every one user in our environment,

2:42we increase 0.2% of our resource utilization, that will help

2:48me forecast for user growth.

2:51Or I could look at the number of applications that are in use,

2:54and I can do the same thing.

2:55Maybe for every application, we increase by 5% resources.

3:00So I can use that to help me forecast,

3:02and plan for the future as needed.

3:06Moving on.

3:07Some of the things that we can look at,

3:09when we're doing the capacity management,

3:10we talked about storage.

3:12Well, when we're looking at storage,

3:14there's a couple different types.

3:15We've got server storage, and that's

3:17where you have a physical server,

3:19and it has a set number of drive bays in it,

3:22it may have four disk bays.

3:24Well, if I've got four drives in there already,

3:27well, it doesn't give me room to add more drive.

3:29So it's not going to be quite as flexible as something

3:32like a Storage Area Network or a SAN.

3:35Now, a SAN, is generally a bay of disks,

3:39it may have 16 disks in it, or it may have 24,

3:44they have different sizes.

3:46And you can hook them together to expand your storage.

3:51So you might end up with four chassis, or eight chassis, just

3:55depending on however many you need.

3:57And your servers will access this storage area network

4:02via a couple of different ways.

4:05It could be over the network, via something called iSCSI,

4:08or it could be a direct connect, via Fiber Channel,

4:12to a Fiber Channel switch.

4:13But either way, your storage resides in this storage area

4:17network here, and your servers will connect to it,

4:20and use that storage.

4:22So you've got server storage, which is a little limited,

4:25and then, you have your SAN, or storage, or network,

4:28where you can easily expand to hold more drives and more data.

4:32Then we look at CPU and memory.

4:34Now, we're going back, and we're going to take a look first,

4:36at just a standalone server.

4:38Well, they come with a motherboard in them,

4:41it holds most of the components that make up the computer.

4:44So you would have sockets for your CPUs,

4:47and slots for your memory to be plugged into.

4:50Well, that is a finite set of resources.

4:54When you purchase a server, it has X number of CPUs sockets,

4:58and X number of memory slots, once they're full,

5:01you can't add more.

5:02Now, you may be able to increase to faster memory, and faster

5:06CPUs, but that's going to be a limitation of your motherboard,

5:10and what it can do.

5:11So what I'm saying is, when you're

5:13dealing with a standalone server,

5:15you are, somewhat, limited on your expansion capabilities.

5:18Just like you were with storage.

5:20However, you can use something called a blade server,

5:24and that's something like this over here.

5:26Where each one of these blocks here-- let

5:28me use a different color.

5:30Each one of these blocks that you see here,

5:32is actually a separate motherboard,

5:34with CPU and memory slots on it.

5:37So we can actually add more cards

5:40as we need more resources.

5:42Now, there, again, is a finite number of cards you can have,

5:45yes.

5:45But the idea is you could start out with two cards,

5:48and then you add them as you need more.

5:50So that's an option when you're looking

5:52to expand or grow your capacity for CPUs in memory.

5:57Then we move on to network.

6:00And over here, we have a couple of switches.

6:03We got one here, that's switch one,

6:05we've got switch two down here.

6:07Now, when we have a connection between them,

6:09it may be a 1 gigabit connection,

6:13and that 1 gigabit gives us a gigabit speed.

6:16Well, what about when we saturate that?

6:19We are using like 900 Meg on a normal basis.

6:24Well, guess what, that's almost a gig,

6:26and it's going to start to slow things down.

6:28So what can we do?

6:29Well, in most switches, you can actually

6:31run another connection, or up to like eight connections,

6:35and you can use the coding within the switch,

6:38to do what's called, bonding of those connections.

6:42So if you did two of them.

6:44Now you would have a 2 gigabit connection.

6:46And you'll see when I'm going here--

6:48what if we added four of them?

6:50Then you'd have a four year connection.

6:52So that you can increase the bandwidth

6:54available on the backbone of your environment.

6:57So that is something you can do in a network

7:00to help increase your available bandwidth without purchasing

7:04new equipment.

7:06Well, what about telecommunications,

7:08like our internet connections?

7:10Or we might have MPLS connections

7:13between sites or something.

7:15Well, at that point, we just need

7:16to purchase more bandwidth, because we

7:19don't manage our telecommunication providers

7:22environment.

7:23So we just have to go to them and look at what options

7:26they have.

7:27And it's probably just going to end up

7:29spending more money to get additional bandwidth.

7:32And that's how we can work with capacity management.

7:35I hope this has been informative for you,

7:36and I'd like to thank you for viewing.