ACCT 432 Week 2 Group Discussion Board Forum 2 Example

Group Discussion Board Forum 2: Security of Operating Systems, Networks and Databases

ACCT 432 IT Audit, Group Discussion Board Forum 2

Thread by [Student Name]

The clinic group and the classmates are composites; the textbook and the scholarly research cited are real.

The problem I selected asks how an auditor should evaluate operating system, network and database security at a small organization. Brightwater Therapy, a composite group of five physical therapy clinics, keeps its patient billing database on a server in its main office. All six office staff log in to that server with the same administrator account, the guest Wi-Fi for patients runs on the same network segment as the server, and the database records no log of who queries or changes billing records.

Hall (2016) describes access controls that assign each user a unique identity and only the privileges the job requires. The shared administrator account defeats both: anyone can change any billing record, and no change can be traced to a person. The control is individual accounts with role-based permissions, and the audit test is to compare the user list with current staff and their duties. The flat network means a patient on the guest Wi-Fi is one step from the billing server; segmentation behind a firewall closes that path, and the auditor would review firewall rules and attempt a connection from the guest network. Without database logging, an altered record leaves no trail; enabling audit logs and reviewing them weekly creates one.

Brightwater cannot fix everything at once. Gordon and Loeb (2002) modeled security spending and showed that the best amount to invest never exceeds roughly 37% of a breach's expected loss, and that the most vulnerable data are not always the best place to spend. Kamiya et al. (2021) found that when a breach exposed customers' financial data, the drop in shareholder value went well beyond the incident's direct costs, pointing to damage to reputation. For a clinic, the billing database is the asset whose loss would cost the most and should be protected first. I would segment the network and issue individual accounts this month, and add logging next.

Reply to Olivia

Olivia, your thread called for a second authentication factor on every login to Brightwater's billing server, and few controls do more for so little cost. Hall (2016) explains that authentication controls verify that a user is who he or she claims to be, and that passwords alone are weak because they can be guessed, shared or stolen. A second factor, such as a code from a phone application, makes a stolen password useless by itself. For a clinic whose staff log in from front desks that patients can see, that protection is especially valuable, because passwords written on sticky notes are common in busy offices. I would add two points. Both concern the order in which controls should be added. First, multifactor authentication does not fix the shared account problem; if all six staff share one account and one phone, accountability is still lost, so individual accounts have to come first. Second, the clinic should apply multifactor authentication to remote access and email as well, since those are the entry points most attackers use before reaching a server. Gordon and Loeb (2002) argued that security spending should be directed where it reduces expected loss the most, and multifactor authentication is inexpensive relative to the loss it prevents. For the audit, the test would be to review the authentication settings for each system and attempt a login without the second factor, documenting that the attempt fails. Repeating the test after any system change confirms that the setting has not been turned off for convenience.

Reply to Daniel

Daniel, your thread argued that IT security has to be overseen at the top of an organization, and you cited the growing number of public companies with board-level technology committees. Higgs et al. (2016) proposed that such committees signal a firm's ability to detect and respond to security breaches, and their research reflects how seriously boards now take IT risk. A small organization like Brightwater does not have a board committee, but the principle still applies. Oversight simply has to take a smaller, more personal form. The owners could designate one partner to receive a quarterly security report from the IT contractor, covering open vulnerabilities, user access reviews, backup tests and any incidents, and to sign off on the next quarter's priorities. Hall (2016) explains that IT governance includes management's responsibility for the controls that protect information assets, which means security cannot be delegated entirely to the technician who installs the firewall. Assigning ownership also helps the external auditor, Even a small group can hold that partner accountable at its monthly meeting. who can test the quarterly reviews as evidence that management monitors IT controls. Kamiya et al. (2021) found that the costs of a breach fall largely on owners through lost value, so in a small firm the owners themselves have the strongest reason to take on that oversight role. A one-page report each quarter is a realistic start that a busy clinic owner can sustain. Over time, the report can grow into the documented risk assessment that larger organizations maintain.

References

Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438-457. https://doi.org/10.1145/581271.581274

Hall, J. A. (2016). Information technology auditing (4th ed.). Cengage Learning.

Higgs, J. L., Pinsker, R. E., Smith, T. J., & Young, G. R. (2016). The relationship between board-level technology committees and reported security breaches. Journal of Information Systems, 30(3), 79-98. https://doi.org/10.2308/isys-51402

Kamiya, S., Kang, J.-K., Kim, J., Milidonis, A., & Stulz, R. M. (2021). Risk management, firm reputation, and the impact of successful cyberattacks on target firms. Journal of Financial Economics, 139(3), 719-749. https://doi.org/10.1016/j.jfineco.2019.05.019