Microsoft SQL Server Database Audit/Assurance Program

Transcription

1 Microsoft SQL Server Database Audit/Assurance Program

2 ISACA With 95,000 constituents in 160 countries, ISACA ( is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor (CISA ), Certified Information Security Manager (CISM ), Certified in the Governance of Enterprise IT (CGEIT ) and Certified in Risk and Information Systems Control (CRISC ) designations. ISACA continually updates COBIT, which helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business. Disclaimer ISACA has designed and created Microsoft SQL Server Database Audit/Assurance Program (the Work ) primarily as an informational resource for audit and assurance professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of all proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, audit and assurance professionals should apply their own professional judgment to the specific circumstances presented by the particular systems or IT environment. Reservation of Rights 2011 ISACA. All rights reserved. No part of this publication may be used, copied, reproduced, modified, distributed, displayed, stored in a retrieval system or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written authorization of ISACA. Reproduction and use of all or portions of this publication are permitted solely for academic, internal and noncommercial use and for consulting/advisory engagements, and must include full attribution of the material s source. No other right or permission is granted with respect to this work. ISACA 3701 Algonquin Road, Suite 1010 Rolling Meadows, IL USA Phone: Fax: [email protected] Web site: ISBN Microsoft SQL Server Database Audit/Assurance Program CRISC is a trademark/service mark of ISACA. The mark has been applied for or registered in countries throughout the world. Microsoft SQL Server Database Audit/Assurance Program is an independent publication and is not affiliated with, nor has it been authorized, sponsored or otherwise approved by, Microsoft Corp ISACA. All rights reserved. Page 2

3 ISACA wishes to recognize: Researchers Rene Aguero, CISSP, MCSE, Foothill FCU, USA Christopher Bolton, CISA, CISSP, GSEC, Newegg Inc., USA Dave Jones, CISA, CIA, Independent, USA Ray Parrish, InSight Consulting Partners, USA Tony Partida, GSG Associates Inc., USA Cheryl Santor, CISA, CISM, CGEIT, CISSP, Los Angeles Metropolitan Water District, USA Christina Tsang-Reveche, CISA, CISM, PMP, The Capital Group Companies, USA Mike Villegas, CISA, CISSP, GSEC, Newegg Inc., USA Expert Reviewers Anjay Agarwal, CISA, CGEIT, CRISC, AAA Technologies P. Ltd., India Shawna M. Bang, CGEIT, CRISC, Smart Business Information Technology, USA Madhav Chablani, CISA, CISM, TippingPoint Consulting, India Milthon J. Chavez, Ph.D., CISA, CISM, CGEIT, Integral Centre of Organizational Resilience, Venezuela Yves M. Dorleans, CISA, Charles River Laboratories, USA Luis Fuente, CGEIT, Junta de Castilla y Leon, Spain Gbadamosi Folakemi Toyin, CGEIT, APDM, CGRC-IT, CICA, CIPM, IT Governance Consult, Nigeria Curt Hartinger, CISA, CISM, CPA, GSNA, MSIA, Office of the State Treasurer, USA Abdus Sami Khan, Sami Associates, Pakistan Prashant A. Khopkar, CISA, CA, Grant Thornton, LLP, USA Stephen C. Lau, CISA, CISSP, PricewaterhouseCoopers, USA Lucio Molina Focazzio, CISA, CISM, ITIL, Colombia Philippe Rivest, CISA, CEH, CISSP, TransForce, Canada Megah Santio, CISA, Australia Vipin Sehgal, CISA, Sun Life Financial, Canada Vinoth Sivasubramanian, ABRCCI, CEH, ISO LA, ITIL V3, UAE Exchange Center LLC, UAE John G. Tannahill, CISM, CGEIT, CA, J. Tannahill & Associates, Canada ISACA Board of Directors Emil D Angelo, CISA, CISM, Bank of Tokyo-Mitsubishi UFJ Ltd., USA, International President Christos K. Dimitriadis, Ph.D., CISA, CISM, INTRALOT S.A., Greece, Vice President Ria Lucas, CISA, CGEIT, Telstra Corp. Ltd., Australia, Vice President Hitoshi Ota, CISA, CISM, CGEIT, CIA, Mizuho Corporate Bank Ltd., Japan, Vice President Jose Angel Pena Ibarra, CGEIT, Alintec S.A., Mexico, Vice President Robert E. Stroud, CGEIT, CA Technologies, USA, Vice President Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, Vice President Rolf M. von Roessing, CISA, CISM, CGEIT, Forfa AG, Germany, Vice President Lynn C. Lawton, CISA, FBCS CITP, FCA, FIIA, KPMG Ltd., Russian Federation, Past International President Everett C. Johnson Jr., CPA, Deloitte & Touche LLP (retired), USA, Past International President Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Director Tony Hayes, CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA, Queensland Government, Australia, Director Howard Nicholson, CISA, CGEIT, CRISC, City of Salisbury, Australia, Director Jeff Spivey, CRISC, CPP, PSP, Security Risk Management, USA, ITGI Trustee Knowledge Board Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Chair Michael Berardi Jr., CISA, CGEIT, Nestle USA, USA John Ho Chi, CISA, CISM, CBCP, CFE, Ernst & Young LLP, Singapore Jose Angel Pena Ibarra, CGEIT, Alintec S.A., Mexico Jo Stewart-Rattray, CISA, CISM, CGEIT, CSEPS, RSM Bird Cameron, Australia Jon Singleton, CISA, FCA, Auditor General of Manitoba (retired), Canada Patrick Stachtchenko, CISA, CGEIT, CA, Stachtchenko & Associates SAS, France Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA 2011 ISACA. All rights reserved. Page 3

4 Guidance and Practices Committee Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, Chair Kamal N. Dave, CISA, CISM, CGEIT, Hewlett-Packard, USA Urs Fischer, CISA, CRISC, CIA, CPA (Swiss), Switzerland Ramses Gallego, CISM, CGEIT, CISSP, Entel IT Consulting, Spain Phillip J. Lageschulte, CGEIT, CPA, KPMG LLP, USA Ravi Muthukrishnan, CISA, CISM, FCA, ISCA, Capco IT Service India Pvt. Ltd., India Anthony P. Noble, CISA, CCP, Viacom Inc., USA Salomon Rico, CISA, CISM, CGEIT, Deloitte, Mexico Frank Van Der Zwaag, CISA, Westpac New Zealand, New Zealand ISACA and IT Governance Institute (ITGI ) Affiliates and Sponsors American Institute of Certified Public Accountants ASIS International The Center for Internet Security Commonwealth Association for Corporate Governance Inc. FIDA Inform Information Security Forum Institute of Management Accountants Inc. ISACA chapters ITGI Japan Norwich University Solvay Brussels School of Economics and Management University of Antwerp Management School ASI System Integration Hewlett-Packard IBM SOAProjects Inc. Symantec Corp. TruArx Inc. The ISACA Los Angeles (CA, USA) Chapter for its support 2011 ISACA. All rights reserved. Page 4

5 Table of Contents Page I. Introduction 5 II. Using This Document 6 III. Controls Maturity Analysis 9 IV. Assurance and Control Framework 10 V. Executive Summary of Audit/Assurance Focus 12 VI. Audit/Assurance Program Planning and Scoping Preparatory Steps Access and Authorization Security Processes and Monitoring Backup and Recovery Encryption Trusted Relationships Network Security 26 VII. Maturity Assessment 28 VIII. Assessment Maturity vs. Target Maturity 32 IX. s and Resources 33 X. Technical Appendix 33 I. Introduction Overview ISACA has developed the IT Assurance Framework (ITAF ) as a comprehensive and good-practicesetting model. ITAF provides standards that are designed to be mandatory and that are the guiding principles under which the IT audit and assurance profession operates. The guidelines provide information and direction for the practice of IT audit and assurance. The tools and techniques provide methodologies, tools and templates to provide direction in the application of IT audit and assurance processes. Purpose The audit/assurance program is a tool and template to be used as a road map for the completion of a specific assurance process. ISACA has commissioned audit/assurance programs to be developed for use by IT audit and assurance practitioners. This audit/assurance program is intended to be utilized by IT audit and assurance professionals with the requisite knowledge of the subject matter under review, as described in ITAF section 2200 General Standards. The audit/assurance programs are part of ITAF section 4000 IT Assurance Tools and Techniques. Control Framework The audit/assurance programs have been developed in alignment with the ISACA COBIT framework specifically COBIT 4.1 using generally applicable and accepted good practices. They reflect ITAF sections 3400 IT Management Processes, 3600 IT Audit and Assurance Processes, and 3800 IT Audit and Assurance Management. Many organizations have embraced several frameworks at an enterprise level, including the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Framework. The importance of the control framework has been enhanced due to regulatory requirements by the US 2011 ISACA. All rights reserved. Page 5

6 Securities and Exchange Commission (SEC) as directed by the US Sarbanes-Oxley Act of 2002 and similar legislation in other countries. They seek to integrate control framework elements used by the general audit/assurance team into the IT audit and assurance framework. Since COSO is widely used, it has been selected for inclusion in this audit/assurance program. The reviewer may delete or rename these columns to align with the enterprise s control framework. Governance, Risk and Control of IT Governance, risk and control of IT are critical in the performance of any assurance management process. Governance of the process under review will be evaluated as part of the policies and management oversight controls. Risk plays an important role in evaluating what to audit and how management approaches and manages risk. Both issues will be evaluated as steps in the audit/assurance program. Controls are the primary evaluation point in the process. The audit/assurance program identifies the control objectives and the steps to determine control design and effectiveness. Responsibilities of IT Audit and Assurance Professionals IT audit and assurance professionals are expected to customize this document to the environment in which they are performing an assurance process. This document is to be used as a review tool and starting point. It may be modified by the IT audit and assurance professional; it is not intended to be a checklist or questionnaire. It is assumed that the IT audit and assurance has the necessary subject matter expertise required to conduct the work and is supervised by a professional with Certified Information Systems Auditor (CISA) designation and/or necessary subject matter expertise to adequately review the work performed. II. Using This Document This audit/assurance program was developed to assist the audit and assurance professional in designing and executing a review. Details regarding the format and use of the document follow. Work Program Steps The first column of the program describes the steps to be performed. The numbering scheme used provides built-in work paper numbering for ease of cross-reference to the specific work paper for that section. The physical document was designed in Microsoft Word. The IT audit and assurance professional is encouraged to modify this document to reflect the specific environment under review. Step 1 is part of the fact-gathering and pre-fieldwork preparation. Because the pre-fieldwork is essential to a successful and professional review, the steps, or audit procedures, have been itemized in this plan. The first level steps, e.g., 1.1, are in bold type and provide the reviewer with a scope or high-level explanation of the purpose for the substeps. In addition, some program steps require the performance of several audit procedures, identification of several specific points, issues, etc. (For an example, see step 3.9.) The document breaks down this kind of lengthy process into individual points to ease referencing the individual audit procedures or other work papers. The audit/assurance professional should treat the parent step, e.g., 3.9, as a roll up that includes the set of subordinate steps. Beginning in step 2, the steps associated with the work program are itemized. To clarify purpose, the audit/assurance program describes the audit/assurance objective the reason for performing the steps in the topic area; the specific audit steps then follow in substeps. Each review step is listed after the control. These steps may include assessing the control design by walking through a process, interviewing, observing or otherwise verifying the process and the controls that address that process. In many cases, once the control design has been verified, specific tests need to be performed to provide assurance that the process associated with the control is being followed ISACA. All rights reserved. Page 6

7 The maturity assessment, which is described in more detail later in this document, makes up the last section of the program. The audit/assurance program does not include typical audit wrap-up steps, including, but not necessarily limited to those processes associated with completing and reviewing work papers, preparing issues and recommendations, and writing and clearing reports. The Research Team presumes that each audit/assurance function will have identified and defined standards that address each of these processes in accordance with the needs and standards its individual enterprise. COBIT Cross reference The COBIT cross-reference provides the audit and assurance professional with the ability to refer to the specific COBIT control objective that the audit/assurance step addresses. The COBIT control objective should be identified for each audit/assurance step in the section. Multiple cross-references are not uncommon. Some subprocesses in the work program address the same COBIT standards identified in the parent rollup step; or the subprocesses are too granular to cross-reference to specific COBIT steps. The audit/assurance program is organized in a manner to facilitate an evaluation through a structure parallel to the development process. COBIT provides in-depth control objectives and suggested control practices at each level. As the professional reviews each control, he/she should refer to COBIT 4.1 or the IT Assurance Guide: Using COBIT for good-practice control guidance. COSO Components As noted in the introduction, COSO and similar frameworks have become increasingly popular among audit and assurance professionals. This ties the assurance work to the enterprise s control framework. While the IT audit/assurance function uses COBIT as a framework, operational audit and assurance professionals use the framework established by the enterprise. Since COSO is the most prevalent internal control framework, it has been included in this document and is a bridge to align IT audit/assurance with the rest of the audit/assurance function. Many audit/assurance organizations include the COSO control components within their reports, and summarize assurance activities to the audit committee of the board of directors. For each control, the audit and assurance professional should indicate the COSO component(s) addressed. It is possible, but generally not necessary, to extend this analysis to the specific audit step level. The original COSO internal control framework contained five components. In 2004, COSO was revised as Enterprise Risk Management Integrated Framework and extended to eight components. The primary difference between the two frameworks is the additional focus on ERM and integration into the business decision model. Large enterprises are in the process of adopting ERM. The two frameworks are compared in figure 1. Figure 1 Comparison of COSO Internal Control and ERM Integrated Frameworks Internal Control Framework ERM Integrated Framework Control Environment: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management s operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization. Internal Environment: The internal environment encompasses the tone of an organization and sets the basis for how risk is viewed and addressed by an enterprise s people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate. Objective Setting: Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the enterprise s mission and are consistent with its risk appetite ISACA. All rights reserved. Page 7

8 Figure 1 Comparison of COSO Internal Control and ERM Integrated Frameworks Internal Control Framework ERM Integrated Framework Event Identification: Internal and external events affecting achievement of an enterprise s objectives must be identified, distinguishing between risks and opportunities. Opportunities are channelled back to management s strategy or objective-setting processes. Risk Assessment: Risks are analyzed, considering the likelihood and impact, as a basis for determining how they could be managed. Risk areas are assessed on an inherent and residual basis. Risk Assessment: Every enterprise faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, and thus risk assessment is the identification and analysis of relevant risks to achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed. Control Activities: Control activities are the policies and procedures that help ensure that management directives are carried out and that necessary actions are taken to address risks to achievement of the enterprise's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorisations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. Information and Communication: Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information that make it possible to run and control the business. In a broader sense, effective communication must ensure that information flows down, across and up the organization. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders. Monitoring: Internal control systems need to be monitored a process that assesses the quality of the system s performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system. Information for figure 1 was obtained from the COSO web site Risk Response: Management selects risk responses avoiding, accepting, reducing, or sharing risk developing a set of actions to align risks with the enterprise s risk tolerances and risk appetite. Control Activities: Policies and procedures are established and implemented to help ensure that the risk responses are effectively carried out. Information and Communication: Relevant information is identified, captured, and communicated in a form and timeframe that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the enterprise. Monitoring: The entirety of enterprise risk management is monitored and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations, or both. The original COSO internal control framework addresses the needs of the IT audit and assurance professional: control environment, risk assessment, control activities, information and communication, and monitoring. As such, ISACA has elected to utilize the five-component model for its audit/assurance programs. As more enterprises implement the ERM model, the additional three columns can be added, if relevant. When completing the COSO component columns, consider the definitions of the components as described in figure 1. / Good practices require the audit and assurance professional to create a work paper that describes the work performed, issues identified and conclusions for each line item. The reference/hyperlink is to be used to cross-reference the audit/assurance step to the work paper that supports it. The numbering system of this document provides a ready numbering scheme for the work papers. If desired, a link to the work paper can be pasted into this column. Issue Cross reference This column can be used to flag a finding/issue that the IT audit and assurance professional wants to further investigate or establish as a potential finding. The potential findings should be documented in a work paper that indicates the disposition of the findings (formally reported, reported as a memo or verbal finding, or waived) ISACA. All rights reserved. Page 8

9 The comments column can be used to indicate the waiving of a step or other notations. It is not to be used in place of a work paper that describes the work performed. III. Controls Maturity Analysis One of the consistent requests of stakeholders who have undergone IT audit/assurance reviews is a desire to understand how their performance compares to good practices. Audit and assurance professionals must provide an objective basis for the review conclusions. Maturity modeling for management and control over IT processes is based on a method of evaluating the enterprise, so it can be rated from a maturity level of nonexistent (0) to optimized (5). This approach is derived from the maturity model that the Software Engineering Institute (SEI) of Carnegie Mellon University defined for the maturity of software development. IT Assurance Guide Using COBIT Appendix VII Maturity Model for Internal Control (figure 2) provides a generic maturity model that shows the status of the internal control environment and the establishment of internal controls in an enterprise. It shows how the management of internal control, and an awareness of the need to establish better internal controls, typically develops from an ad hoc to an optimized level. The model provides a high-level guide to help COBIT users appreciate what is required for effective internal controls in IT and to help position their enterprise on the maturity scale. Figure 2 Maturity Model for Internal Control Maturity Level Status of the Internal Control Environment Establishment of Internal Controls 0 Non-existent There is no recognition of the need for internal control. Control is not part of the organization s culture or mission. There is a high risk of control deficiencies and incidents. There is no intent to assess the need for internal control. Incidents are dealt with as they arise. 1 Initial/ad hoc There is some recognition of the need for internal control. The approach to risk and control requirements is ad hoc and disorganized, without communication or monitoring. Deficiencies are not identified. Employees are not aware of their responsibilities. There is no awareness of the need for assessment of what is needed in terms of IT controls. When performed, it is only on an ad hoc basis, at a high level and in reaction to significant incidents. Assessment addresses only the actual incident. 2 Repeatable but Intuitive Controls are in place but are not documented. Their operation is dependent on the knowledge and motivation of individuals. Effectiveness is not adequately evaluated. Many control weaknesses exist and are not adequately addressed; the impact can be severe. Management actions to resolve control issues are not prioritized or consistent. Employees may not be aware of their responsibilities. Assessment of control needs occurs only when needed for selected IT processes to determine the current level of control maturity, the target level that should be reached and the gaps that exist. An informal workshop approach, involving IT managers and the team involved in the process, is used to define an adequate approach to controls for the process and to motivate an agreed-upon action plan. 3 Defined Controls are in place and adequately documented. Operating effectiveness is evaluated on a periodic basis and there is an average number of issues. However, the evaluation process is not documented. While management is able to deal predictably with most control issues, some control weaknesses persist and impacts could still be severe. Employees are aware of their responsibilities for control. Critical IT processes are identified based on value and risk drivers. A detailed analysis is performed to identify control requirements and the root cause of gaps and to develop improvement opportunities. In addition to facilitated workshops, tools are used and interviews are performed to support the analysis and ensure that an IT process owner owns and drives the assessment and improvement process. 4 Managed and Measurable There is an effective internal control and risk management environment. A formal, documented evaluation of controls occurs frequently. Many controls are automated and regularly reviewed. Management is likely to detect most control issues, but not all issues are routinely identified. There is consistent follow-up to address identified control weaknesses. A limited, tactical use of technology is applied to automate controls. IT process criticality is regularly defined with full support and agreement from the relevant business process owners. Assessment of control requirements is based on policy and the actual maturity of these processes, following a thorough and measured analysis involving key stakeholders. Accountability for these assessments is clear and enforced. Improvement strategies are supported by business cases. Performance in achieving the desired outcomes is consistently monitored. External control reviews are organized occasionally ISACA. All rights reserved. Page 9

10 Figure 2 Maturity Model for Internal Control Maturity Level Status of the Internal Control Environment Establishment of Internal Controls 5 Optimized An enterprise wide risk and control program provides continuous and effective control and risk issues resolution. Internal control and risk management are integrated with enterprise practices, supported with automated real-time monitoring with full accountability for control monitoring, risk management and compliance enforcement. Control evaluation is continuous, based on self-assessments and gap and root cause analyses. Employees are proactively involved in control improvements. Business changes consider the criticality of IT processes and cover any need to reassess process control capability. IT process owners regularly perform self-assessments to confirm that controls are at the right level of maturity to meet business needs and they consider maturity attributes to find ways to make controls more efficient and effective. The organization benchmarks to external best practices and seeks external advice on internal control effectiveness. For critical processes, independent reviews take place to provide assurance that the controls remain at the desired level of maturity and continue operating as planned. The maturity model evaluation is one of the final steps in the evaluation process. The IT audit and assurance professional can address the key controls within the scope of the work program and formulate an objective assessment of the maturity levels of the control practices. The maturity assessment can be a part of the audit/assurance report and can be used as a metric from year to year to document progress in the enhancement of controls. However, the perception of the maturity level may vary between the process/it asset owner and the auditor. Therefore, an auditor should obtain the concerned stakeholder s concurrence before submitting the final report to management. At the conclusion of the review, once all findings and recommendations are completed, the professional assesses the current state of the COBIT control framework and assigns it a maturity level using the sixlevel scale. Some practitioners utilize decimals (x.25, x.5, x.75) to indicate gradations in the maturity model. As a further reference, COBIT provides a definition of the maturity designations by control objective. While this approach is not mandatory, the process is provided as a separate section at the end of the audit/assurance program for those enterprises that wish to implement it. It is suggested that a maturity assessment be made at the COBIT control level. To provide further value to the client/customer, the professional can also obtain maturity targets from the client/customer. Using the assessed and target maturity levels, the professional can create an effective graphic presentation that describes the achievement or gaps between the actual and targeted maturity goals. A graphic is provided in section VIII, based on sample assessments. Note that this assessment addresses the Microsoft SQL Server database only; there are generally other operating systems (OSs) in the enterprise. IV. Assurance and Control Framework ISACA IT Assurance Framework and Standards ITAF section Operating Systems (OSs) Management and Controls is relevant to Microsoft SQL Server Database security. ISACA has long recognized the specialized nature of IT assurance and strives to advance globally applicable standards. Guidelines and procedures provide detailed guidance on how to follow those standards. IS Auditing Standard S15 IT Controls and IS Auditing Guideline G38 Access Controls are relevant to this audit/assurance program. ISACA Controls Framework COBIT is a framework for the governance of IT and a supporting tool set that allows managers to bridge the gap among control requirements, technical issues and business risks. COBIT enables clear policy development and good practice for IT control throughout enterprises ISACA. All rights reserved. Page 10

11 Utilizing COBIT as the control framework from which IT audit/assurance activities are based aligns IT audit/assurance with good practices as developed by the enterprise. The COBIT IT process DS9 Manage the configuration, from the Deliver and Support (DS) domain, addresses good practices for ensuring the integrity of hardware and software configurations. This requires the establishment and maintenance of an accurate and complete configuration repository..3 Identity management and.4 User account management address user identity, and the IT process AI6 Manage changes, from the Acquire and Implement (AI) domain, specifically addresses change management. Relevant COBIT control objectives are: AI6.1 Change standards and procedures Set up formal change management procedures to handle in a standardized manner all requests (including maintenance and patches) for changes to applications, procedures, processes, system and service parameters, and the underlying platforms. AI6.2 Impact assessment, prioritisation and authorisation Assess all requests for change in a structured way to determine the impact on the operational system and its functionality. Ensure that changes are categorised, prioritised, and authorised. AI6.4 Change status tracking and reporting Establish a tracking and reporting system to document rejected changes, communicate the status of approved and in-process changes, and complete changes. Make certain that approved changes are implemented as planned..3 Identity management 1 Ensure that all users (internal, external and temporary) and their activity on IT systems (business application, IT environment, system operations, development and maintenance) are uniquely identifiable. Enable user identities via authentication mechanisms. Confirm that user access rights to systems and data are in line with defined and documented business needs and that job requirements are attached to user identities. Ensure that user access rights are requested by user management, approved by system owners and implemented by the securityresponsible person. Maintain user identities and access rights in a central repository. Deploy costeffective technical and procedural measures, and keep them current to establish user identification, implement authentication and enforce access rights..4 User account management 2 Address requesting, establishing, issuing, suspending, modifying and closing user accounts and related user privileges with a set of user account management procedures. Include an approval procedure outlining the data or system owner granting the access privileges. These procedures should apply for all users, including administrators (privileged users) and internal and external users, for normal and emergency cases. Rights and obligations relative to access to enterprise systems and information should be contractually arranged for all types of users. Perform regular management review of all accounts and related privileges. DS9.1 Configuration repository and baseline Establish a supporting tool and a central repository to contain all relevant information on configuration items. Monitor and record all assets and changes to assets. Maintain a baseline of configuration items for every system and service as a checkpoint to which to return after changes. DS9.2 Identification and maintenance of configuration items Establish configuration procedures to support management and logging of all changes to the configuration repository. Integrate these procedures with change management, incident management and problem management procedures. DS9.3 Configuration integrity review Periodically review the configuration data to verify and confirm the integrity of the current and historical configuration. Periodically review installed software against the policy for software usage to identify personal or unlicensed software or any software instances in excess of current license agreements. Report, act on and correct errors and deviations. 1 Scope limitation: Identity management as it relates to superusers having access to the OS 2 Scope limitation: User account management as it relates to users accessing system functions 2011 ISACA. All rights reserved. Page 11

12 Refer to the ISACA publication COBIT Control Practices: Guidance to Achieve Control Objectives for Successful IT Governance, 2 nd Edition, published in 2007, for the related control practice value and risk drivers. V. Executive Summary of Audit/Assurance Focus Microsoft SQL Server Database Configuration The review of the Microsoft SQL Server database provides the basis for an assessment of the effectiveness of internal controls and operating efficiency. In the enterprise, Windows is one of the underlying computing platforms for servers that execute essential business applications (both centralized and distributed), database servers that manage the massive databases used to store business data, and web servers that provide the public face of the business on the Internet and process transactions. Generally accepted standards of control including but not limited to, COBIT recognize that the source of the Microsoft SQL Server database distribution be known and that controls provide reasonable assurance that only authorized and tested functions, processes and configuration changes enter the production environment. Business Impact and Risk Microsoft SQL Server is widely used in the enterprise operating environment. The failure to properly configure the Microsoft SQL Server and its related database instances could result in the inability of the business to execute its critical processes. Unless Microsoft SQL Server and its database instances are controlled and managed, dangerous processes could be introduced into the OS. Microsoft SQL Server database risks resulting from ineffective or incorrect database configuration settings could permit the restricted tables, databases and data to become compromised, resulting in, but not necessarily limited to, the following: Disclosure of privileged information, Loss of physical assets, Loss of intellectual property, Loss of competitive advantage, Loss of customer confidence, Violation of regulatory requirements, Disruption of the computer infrastructure, resulting in the inability to perform critical business functions. Objective and Scope Objective The objective of the Microsoft SQL Server database audit/assurance review is to provide management with an independent assessment relating to the effectiveness of configuration and security of the Microsoft SQL Server database systems within the enterprise s computing environment. Scope The Microsoft SQL Server Database Audit/Assurance Program is designed to provide a relatively complete guide to the audit of SQL Server. This audit/assurance program focuses on configuration of the relevant Microsoft SQL Server database implementations. The selection of the applications/functions and specific servers will be based on the SQL-Server-related risks to which these systems expose the enterprise. The authors recognize that each audit team will customize this audit/assurance program to fit the specific circumstances of the project and enterprise. Some enterprises will choose to audit SQL Server in phases; some may address SQL Server in a single project. Perhaps most important, the authors recognize that 2011 ISACA. All rights reserved. Page 12

13 SQL Server will probably change somewhat more frequently than this audit guide and program. Thus, each audit team that uses this audit/assurance program must perform its own research to gain reasonable assurance that it addresses the most relevant and current SQL Server risks. Some sections of this audit/assurance program address ancillary functions such as access control, computer operations and physical security. The authors attempted to limit this audit/assurance program to risks unique to or introduced into those areas by SQL Server. Thus, this audit/assurance program does not purport to act as a comprehensive guide to auditing those other areas, some of which could require a project as large as the audit of SQL Server itself. Example resources, current as of August 2010, include, but are not limited to the ISACA: Information Security Management Audit/Assurance Program For the review of processes associated with governance, policy, monitoring, incident management and management of the information security function; the implementation of security configurations; and the selection and maintenance of security technologies Network Perimeter Security Audit/Assurance Program For the review of network perimeter security, including associated policies, standards and procedures and the effectiveness of the security implementation Change Management Audit/Assurance Program For the review of change management process and incident management Minimum Audit Skills This review is considered highly technical. The IT audit and assurance professional must have an understanding of the Microsoft SQL Server and Windows processes and requirements and must be highly conversant with Microsoft SQL Server database tools, exposures and functionality ISACA. All rights reserved. Page 13

14 VI. Audit/Assurance Program The purpose of this audit/assurance program is to provide the audit, control and security professional with a methodology for evaluating the Microsoft SQL Server database. It examines key issues and components that need to be considered for this topic and was developed and reviewed with regard to COBIT. Note: The professional should customize the audit/assurance program to address constraints, policies and practices of each specific enterprise. Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue 1. PLANNING AND SCOPING THE AUDIT 1.1 Define audit/assurance objectives. The audit/assurance objectives are high level and describe the overall audit goals Review the audit/assurance objectives in the introduction to this audit/assurance program Modify the audit/assurance objectives, and align them with the audit/assurance universe, annual plan, charter and specific objectives of the current project. 1.2 Define boundaries of review. The review must have a defined scope. Gain an understanding of the operating environment; prepare a risk assessment of the SQL Server environment; and, subject to management approval and budgetary constraints and considering historical audit results, prepare a proposed scope document Obtain and review the Microsoft SQL Server database system security and management policies Obtain and document the following information about the Microsoft SQL server database environment Version, release and Microsoft support status of the underlying OS A list of Microsoft SQL Server database servers, version numbers, server locations, and applications each server processes or supports and whether the database versions are current and supported by Microsoft Total number of named users (for comparison with logical access security testing results) Number of database instances. For each instance, or for a sample of instances, determine the following ISACA. All rights reserved. Page 14

15 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue The applications and related versions accessing the database (e.g., enterprise resource planning [ERP], web application, data warehouse) Utilities used to log on to and manage the database (e.g., Rapid SQL) For any servers hosted by third-party vendors, obtain and review: Vendor management policies Service level agreements (SLAs) Statements on Standards for Attestation Engagements (SSAE 16) previously referenced as Statement of Auditing Standard No. 70 (SAS 70) Reports Vendor contracts Establish preliminary boundaries of the review. Include references for issues such as: Areas to be audited High-level objectives and scope of work Budget, resource allocation schedules Report deliverables Identify any known constraints that could or would limit the audit of specific systems, processes or functions. 1.3 Define assurance. The review requires at least two sources of standards: a. Corporate standards, as defined in the policy and procedure documentation, that establish corporate expectations. At a minimum, the enterprise should have implemented standards. b. One or more best-practice references, which can help define generally accepted control standards (best practices). If gaps exist between enterprise standards and best practices, consider proposing enhancements ISACA. All rights reserved. Page 15

16 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Obtain and review Microsoft SQL Server database security and configuration best practices. Microsoft generally publishes a security guide for SQL Server; however, the auditor may want to determine whether better sources exist Obtain and review corporate Microsoft SQL Server database configuration policies, procedures and standards Identify any potential gaps between, or conflicts with, corporate policies, procedures, or standards and best practices. 1.4 Identify and document risks. The risk assessment can help in evaluating where audit resources should be focused. In most enterprises, audit resources are not available for all processes. The risk-based approach helps ensure an effective utilization of audit resources Using the list of servers identified in step 1.2.2, assign each server to a risk category and create a prioritized list of servers to assess Review any previous audits or other assessments of the Microsoft SQL Server databases and the underlying OS for the potential impact of any finding on the SQL Server environment Determine the status of any agreed-on corrective actions for issues identified in earlier audits Evaluate the overall risk factors affecting the various SQL Server functions, including, but not limited to: Areas or business functions to be audited Amount of time and resources allocated to the review Audit procedures in this guide Discuss the risks with IT, business and audit management, and adjust the risk assessment as necessary Discuss possible changes in the scope of the review based on the final risk assessment, with audit management and adjust the scope accordingly. 1.5 Define the audit change process. The initial audit approach depends on the reviewer s understanding of the operating environment and associated risk. Further research and analysis may lead to changes in the scope and approach Identify the senior IT assurance resource responsible for the review. ME ISACA. All rights reserved. Page 16

17 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Establish the process for suggesting and implementing changes to the audit/assurance program and authorizations required. 1.6 Define the audit/assurance resources required. The required resources are defined in the introduction to this audit/assurance program Determine estimated total resources (personnel, staff-hours) and time frame (start and end dates) required for review Determine the audit/assurance skills necessary for review. Propose changes to management if currently assigned resources appear inadequate. 1.7 Define deliverables. The set of deliverables is not limited to the final report. Communication among the audit/assurance teams and the process owner is essential to assignment success Determine the interim deliverables, including initial findings, status reports, draft reports, due dates for response and the final report. 1.8 Communicate The audit/assurance process is clearly communicated to the customer/client. Communication among the audit/assurance teams and the process owner is essential to assignment success Conduct an opening conference in accordance with audit/assurance standards to discuss the review objectives with the executive responsible. 2. PREPARTORY STEPS 2.1 Define the Microsoft SQL Server database environment. Gain an understanding of the Microsoft SQL Server database environment Conduct an independent survey of the environment Interview system administrators, database administrators (DBAs) and security administrators to determine the level of overall security awareness and knowledge of corporate policies and procedures. ME2.1 ME2.1 ME2.1 PO8 PO9 AI1 to 7 DS1 to 5 DS7 to 9 ME ISACA. All rights reserved. Page 17

18 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Assess key risks and determine key controls or control weaknesses with regard to the following factors: The controls culture of the enterprise (e.g., a just-enough-control philosophy) The need to exercise judgement to determine the key controls in the process and whether the control structure is adequate Identify SQL Server configurable controls to test Obtain a list of triggers in the database, and discuss with the DBA and security administrator how they are used. If an external package is used to monitor changes to the tables, review the external package settings. (Note: A trigger is a stored procedure that executes when specified rows or fields in a table are modified. Triggers are often created to enforce referential integrity or consistency among logically related data in different tables. Triggers can also alert management to rare and highly risky actions.) Verify the existence of a database maintenance plan. Obtain any SLAs and support contracts (SLAs executed by the DBAs with end user clients). Review the SLAs to determine whether they include the following provisions: Maintain documentation for the secure configuration of the system. Actively monitor systems for security violations, and report any potential or proven violations to the enterprise. Test and load security patches within the period defined by enterprise standards for the type of release in question, e.g., standard maintenance vs. High-security risk. Maintain system uptime as defined by business requirements. Document evidence of maintenance performed. Maintain registers of history of changes and test results to perform future evaluations. 2.2 Physical facilities and access to database systems are secured. Control: Physical facilities should restrict access to authorized personnel only. DS4 DS12 ME ISACA. All rights reserved. Page 18

19 Audit/Assurance Program Step Tour the data center and identify the location of key database systems. Ensure that the systems are housed in a secure environment and that console settings specify password-protected screen savers. Refer to the latest audit of physical security and/or data centre environmental controls if available Verify the existence of a physical security audit. 3. ACCESS AND AUTHORIZATION COBIT Control Environment Risk Assessment COSO 3.1 Appropriate access and authorisations are in place. Control: Ensure that all users (internal, external and temporary) and their activity on IT systems are uniquely identifiable. Recommended Additional Resource: ISACA Information Security Management Audit/Assurance Program Discuss procedures used to log on to SQL database systems with the DBA. Determine whether users logon to SQL databases using SQL Authentication, Active Directory accounts or both Obtain copies of approval documentation for users who can access the SQL databases directly Identify all users/members mapped to the db_owner role, and verify that only the privileged users identified as authorized have direct access to the database. Determine the reasons for any variances found Obtain a list of users who can access the SQL database(s) by executing the following SQL command from MS SQL Server Management Studio: sp_helplogins; Review the list of SQL Server users to ensure that generic accounts are not used (e.g., test, guest or shared accounts) Verify that default accounts and default passwords are not used by attempting to log on to the database using known defaults Review a sample of user accounts, and evaluate the appropriateness of access profiles assigned to each sample item Discuss the process for establishing an initial password with the DBA. Determine whether generic passwords or passwords that can be easily guessed are used. Control Activities Information and Communication Monitoring Issue 2011 ISACA. All rights reserved. Page 19

20 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Password attributes Control: Password attributes (frequency of change, length of password, reuse of passwords) are established according to policy and according to the sensitivity of the information available to the user Review the following profile settings to verify that password controls conform to current best practices and that resource limits exist and appear reasonable Enforce password history (recommend 24) Maximum password age (recommend 42) Minimum password age (recommend 1) Minimum password length (recommend 8) Password must meet complexity requirements (recommend Yes) Store password using reversible encryption for all users in the domain (Disabled) Discuss the processes for obtaining emergency access to SQL Server databases with the DBA and the security administrator. Determine whether procedures meet the following criteria Define methods and controls over emergency access Require documentation for each use of emergency access Require access termination after the business issue is resolved Require a manager s post-access review and approval if prior authorization is not feasible Procedures are included in the disaster recovery plan. 3.2 Remote Access to the Database Control: Remote access to the database(s) should be well defined and managed Determine if remote access to the SQL Server database is enabled (see appendix 1 for suggested steps as of the last update of this audit/assurance program). If remote access is enabled, discuss the business requirements with the DBA, information security officer and business owner. 3.3 Access for Third Parties Control: Access for third parties should be properly managed. DS9 AI6.4 DS4 DS10 AI ISACA. All rights reserved. Page 20

21 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue With the DBA, discuss the processes in place to grant and terminate access for vendors, contractors and consultants Verify that access is granted only when it is commensurate with job responsibilities Verify that the controls provide reasonable assurance that access is terminated in a timely manner after it is no longer needed. 4. SECURITY PROCESSES AND MONITORING 4.1 Users' access is commensurate with their job responsibilities. Control: Processes exist to ensure that access granted to both general and privileged users is appropriate and is removed when no longer needed. Recommended Additional Resource: ISACA Information Security Management Audit/Assurance Program Review processes for granting, updating and terminating user access Obtain a list or file containing information on current database users and administrators and their roles Obtain a list or file containing information on current local Windows Server groups and the members of each group Determine if privileges to access objects or statements are assigned directly to users, then if appropriate: Obtain a list or file containing information on users with individual privileges and the related objects to which they have access. Evaluate the access based on job descriptions and the access granted. Examine related access requests for reasonableness and proper authorization. Discuss possible excessive access rights with DBAs, information security officers and business owners as dictated by the circumstances. PO4 PO6 AI6 DS13 ME2 PO2 PO4 PO7 DS7 DS ISACA. All rights reserved. Page 21

22 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Review privileges assigned to users and roles. Discuss with the DBA and data owner any privileges directly assigned to users rather than to roles Select a sample of user access requests and verify that access is approved by the appropriate data owners Review the roles and privileges assigned to a sample of users. Ensure that the users access is commensurate with their job responsibilities Obtain a list or file of terminated employees from human resources (HR). Compare the terminated employee list or file to the list or a table of database users to ensure that accounts are terminated in a timely manner Review the assignment of fixed server roles (sysadmin, serveradmin, etc.) to provide reasonable assurance that procedures specify these roles are used only in support of DBA activity Review any roles and/or user accounts that are assigned create, alter or drop privileges. Discuss the business requirements for these types of highly privileged access with the DBA and other affected manager(s) Review accounts that are assigned highly privileged roles such as sysadmin. Discuss the requirement for this type of access with the DBA and information security officer. Assess each for possible segregation of duties (SoD) issues Verify that the guest user is removed from or disabled in all databases. Discuss any exceptions with the DBA Verify that public or guest user IDs that remain in the database and are enabled, do not grant access to any objects Verify that the database owner (dbo) owns all user-created database schemas Review the security over access to OS executables (cmd.exe, explorer.exe, etc.) on the SQL Server and the SQL Server install directories. Ensure that users unique or group permissions do not grant full control Review assignment of the grant object permission to verify that it is not assigned to users or roles. Discuss any of these existing privileges with the DBA ISACA. All rights reserved. Page 22

23 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue 4.2 Resolve instances of inappropriate access and SQL Server processing problems and anomalies. Control: Processes exist to provide reasonable assurance that DBAs, security personnel or system administrators would discover, investigate and resolve instances of apparent inappropriate access and SQL Server processing problems and anomalies Evaluate procedures and processes for monitoring key database functions and security-related events to determine the adequacy and frequency of system activity monitoring. The evaluation would normally include, but not be limited to the following. DS1 DS12 ME1 ME Compare existing practices to best practices Gather a sample of important reports, queries, alarm settings and monitoring tool outputs used by the DBA, the information security staff or other operating personnel Report deficiencies, if appropriate Discuss with the DBA. 5. BACKUP AND RECOVERY 5.1 A backup and recovery strategy exists and is tested. Control: A regularly reviewed and approved backup and recovery strategy should exist Gather the Microsoft SQL Server database application SLAs. Verify that Microsoft SQL Server database implementations and/or systems are included in the SLAs Gather the Microsoft SQL Server business continuity plan. Verify that the business continuity plan includes backup and restoration procedures for Microsoft SQL Server database implementations and systems. Verify that the backup and restoration procedures cover access authorisation and system configuration files. DS1 DS4 DS1 DS ISACA. All rights reserved. Page 23

24 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Determine for a sample of database instances if a reasonable database backup recovery model is being used. Verify that SLAs match the model for either full simple or bulk-logged Ensure that backup file copies are stored at a location separate from the location of the servers Discuss the strategy with the DBA for backup and recovery of the database. Confirm with the DBA that the backup procedures and data are tested regularly. Review procedure documents, and discuss the results of the most recent test Review offsite backup and recovery procedures. Ensure that offsite backups are part of disaster recovery testing Review the most recent backup history, and verify that backups are recoverable within the acceptable data loss timeframe defined in the SLA Verify that system master and model server database (MSDB) databases are being backed up. DS4 DS Verify that transaction log files are being backed up Discuss procedures for regularly backing up transaction logs to offline media with the DBA. Determine procedures for securely protecting and disposing of offline media Determine whether procedures require encrypting sensitive and confidential data on backup media Obtain the path of the Microsoft SQL Server data and log files for each database. Ensure that these files are protected and do not exist on the same physical disk to which backups were saved Obtain copies of backup schedules. Verify that log backups are scheduled before full backups; this improves recovery time Verify that scheduled backups are performed when database activity is low; this will improve backup performance Check to see if Page_Verify option S is set to Checksum or if Torn_Page_Detection mode is being used. For databases with these settings, ensure backups are run using the Checksum option to verify the integrity of the backup ISACA. All rights reserved. Page 24

25 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue 6. ENCRYPTION 6.1 An encryption strategy exists and is implemented to protect confidential information where appropriate. Control: Encryption is used whenever there is a business need for securing privileged information Discuss the use of encryption within the database with the DBA. Determine if a third-party package or the native package is used to implement encryption Review and evaluate enterprise data classification standards and encryption requirements Discuss with the DBA any application, information security or database development standards that mandate the use of encryption to protect information Review a sample of records that contain sensitive information to determine that the information is encrypted. 7. TRUSTED RELATIONSHIPS 7.1 Trusted Relationships are restricted and protected. Control: Trust relationships are established only if there is an approved business need Obtain a list of any database link server services used within the database from the DBA. For each service, conduct the following Discuss the business purpose of each link with the DBA Confirm the business need of each link with the business owner(s) Obtain any available documentation or other information about the use and purpose of each trusted database from the DBA Verify the validity and business purpose of each user s access to the table(s) Obtain and review the procedures and processes for managing trusted relationships. Verify that there is an appropriate process in place for granting and changing trust processes. In general, only people who have a DBA or system administrative role should have access to add or update trusted connections. AI2 AI2 PO2 AI ISACA. All rights reserved. Page 25

26 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Verify that procedures provide reasonable assurance that Windows Active Directory is in sync with both the domain servers and SQL Server when building trusted relationships, based on business need Verify that SQL Server maintains its list of authorized users who can connect to the server if trusted connections are used Verify that the SQL Server maintains its list of authorized application servers that can connect. Check the application server, or a sample of application servers, to ensure that those in scope have the codes to establish the trust. 8. NETWORK SECURITY 8.1 Database information communicated over a network is protected. Control: Configuration settings follow sound control practices. Recommended Additional Resource: ISACA Network Perimeter Security Audit/Assurance Program Obtain or create and then evaluate a network architecture diagram that depicts the logical relationship between the database and other systems and networks within the enterprise Determine whether the database is protected by a firewall from any third-party or Internet-access points Determine whether the database is protected from any external networks by network segmentation using ingress and egress filters or an equivalent technology Determine whether master key creation and key management meet the following Follow written procedures Encrypt sensitive fields with documented encryption functions. PO2 AI2 AI2 AI3 DS9 ME1 ME1 ME ISACA. All rights reserved. Page 26

27 Audit/Assurance Program Step COBIT Control Environment Risk Assessment COSO Control Activities Information and Communication Monitoring Issue Discuss with the DBA, procedures for applying critical and noncritical patches and service packs including, but not limited to, controls to provide reasonable assurance that patches are installed in a timely manner. Identify the business need for not applying service packs and patches that Microsoft has identified as important or critical. Verify proper management review and approval of unapplied patches Review network protocols supported using the SQL Server Configuration Manager or other equivalent tool Verify that active ports or services are supported according to documented and approved use Verify that only approved services are in use Verify that only ports documented as valid are in use Investigate and discuss any undocumented connections with the DBA. Recommend turning off, documenting or gaining approval for any undocumented connections found Verify that security enabled ports follow enterprise security standards, e.g., encryption Verify that each network instance, or a sample of network instances, is configured as described in the documentation: From the SQL Server Configuration Manager, expand the SQL Server Network Configuration. Click Protocols for <instance_name>, and verify that each one is configured as described..10 DS9 ME Scan ports, and run a vulnerability assessment to check for security exposures Obtain and review documentation of running services, and conduct the.10 following Verify documented services are running or normally run Consider recommending stopping services that appear to be unneeded Verify that different login IDs and complex passwords are used for critical.10 services Verify that policies, procedures and standards specify denying unneeded connect permission to endpoints ISACA. All rights reserved. Page 27

28 VII. Maturity Assessment The maturity assessment is an opportunity for the reviewer to assess the maturity of the processes reviewed. Based on the results of the audit/assurance review and the reviewer s observations, assign a maturity level to each of the following COBIT control practices. COBIT Control Practice AI6.1 Change Standards and Procedures 1. Develop, document and promulgate a change management framework that specifies the policies and processes, including: Roles and responsibilities Classification and prioritisation of all changes based on business risk Assessment of impact Authorisation and approval of all changes by the business process owners and IT Tracking and status of changes Impact on data integrity (e.g., all changes to data files being made under system and application control rather than by direct user intervention) 2. Establish and maintain version control over all changes. 3. Implement roles and responsibilities that involve business process owners and appropriate technical IT functions. Ensure appropriate segregation of duties. 4. Establish appropriate record management practices and audit trails to record key steps in the change management process. Ensure timely closure of changes. Elevate and report to management changes that are not closed in a timely fashion. 5. Consider the impact of contracted services providers (e.g., of infrastructure, application development and shared services) on the change management process. Consider integration of organisational change management processes with change management processes of service providers. Consider the impact of the organisational change management process on contractual terms and SLAs. AI6.2 Impact Assessment, Prioritisation and Authorisation 1. Develop a process to allow business process owners and IT to request changes to infrastructure, systems or applications. Develop controls to ensure that all such changes arise only through the change request management process. 2. Categorize all requested changes (e.g., infrastructure, operating systems, networks, application systems, purchased/packaged application software). 3. Prioritise all requested changes. Ensure that the change management process identifies both the business and technical needs for the change. Consider legal, regulatory and contractual reasons for the requested change. 4. Assess all requests in a structured fashion. Ensure that the assessment process addresses impact analysis on infrastructure, systems and applications. Consider security, legal, contractual and compliance implications of the requested change. Consider also interdependencies among changes. Involve business process owners in the assessment process, as appropriate. Assessed Maturity Target Maturity 2011 ISACA. All rights reserved. Page 28

29 COBIT Control Practice 5. Ensure that each change is formally approved by business process owners and IT technical stakeholders, as appropriate. AI6.4 Change Status Tracking and Reporting 1. Establish a process to allow requestors and stakeholders to track the status of requests throughout the various stages of the change management process. 2. Categorise change requests in the tracking process (e.g., rejected, approved but not yet initiated, approved and in process, and closed). 3. Implement change status reports with performance metrics to enable management review and monitoring of both the detailed status of changes and the overall state (e.g., aged analysis of change requests). Ensure that status reports form an audit trail so changes can subsequently be tracked from inception to eventual disposition. 4. Monitor open changes to ensure that all approved changes are closed in a timely fashion, depending on priority..3 Identity Management 1. Establish and communicate policies and procedures to uniquely identify, authenticate and authorise access mechanisms and access rights for all users on a need-to-know/need-to-have basis, based on predetermined and preapproved roles. Clearly state accountability of any user for any action on any of the systems and/or applications involved. 2. Ensure that roles and access authorisation criteria for assigning user access rights take into account: Sensitivity of information and applications involved (data classification) Policies for information protection and dissemination (legal, regulatory, internal policies and contractual requirements) Roles and responsibilities as defined within the enterprise The need-to-have access rights associated with the function Standard but individual user access profiles for common job roles in the organisation Requirements to guarantee appropriate segregation of duties 3. Establish a method for authenticating and authorising users to establish responsibility and enforce access rights in line with sensitivity of information and functional application requirements and infrastructure components, and in compliance with applicable laws, regulations, internal policies and contractual agreements. 4. Define and implement a procedure for identifying new users and recording, approving and maintaining access rights. This needs to be requested by user management, approved by the system owner and implemented by the responsible security person. 5. Ensure that a timely information flow is in place that reports changes in jobs (i.e., people in, people out, people change). Grant, revoke and adapt user access rights in co-ordination with human resources and user departments for users who are new, who have left the organisation, or who have changed roles or jobs. Assessed Maturity Target Maturity 2011 ISACA. All rights reserved. Page 29

30 COBIT Control Practice.4 User Account Management 1. Ensure that access control procedures include but are not limited to: Using unique user IDs to enable users to be linked to and held accountable for their actions Awareness that the use of group IDs results in the loss of individual accountability and are permitted only when justified for business or operational reasons and compensated by mitigating controls. Group IDs must be approved and documented. Checking that the user has authorisation from the system owner for the use of the information system or service, and the level of access granted is appropriate to the business purpose and consistent with the organisational security policy A procedure to require users to understand and acknowledge their access rights and the conditions of such access Ensuring that internal and external service providers do not provide access until authorisation procedures have been completed Maintaining a formal record, including access levels, of all persons registered to use the service A timely and regular review of user IDs and access rights 2. Ensure that management reviews or reallocates user access rights at regular intervals using a formal process. User access rights should be reviewed or reallocated after any job changes, such as transfer, promotion, demotion or termination of employment. Authorisations for special privileged access rights should be reviewed independently at more frequent intervals. DS9.1 Configuration Repository and Baseline 1. Implement a configuration repository to capture and maintain configuration management items. The repository should include hardware; application software; middleware; parameters; documentation; procedures; and tools for operating, accessing and using the systems, services, version numbers and licensing details. 2. Implement a tool to enable the effective logging of configuration management information within a repository. 3. Provide a unique identifier to a configuration item so the item can be easily tracked and related to physical asset tags and financial records. 4. Define and document configuration baselines for components across development, test and production environments, to enable identification of system configuration at specific points in time (past, present and planned). 5. Establish a process to revert to the baseline configuration in the event of problems, if determined appropriate after initial investigation. 6. Install mechanisms to monitor changes against the defined repository and baseline. Provide management reports for exceptions, reconciliation and decision making. Assessed Maturity Target Maturity 2011 ISACA. All rights reserved. Page 30

31 COBIT Control Practice DS9.2 Identification and Maintenance of Configuration Items 1. Define and implement a policy requiring all configuration items and their attributes and versions to be identified and maintained. 2. Tag physical assets according to a defined policy. Consider using an automated mechanism, such as barcodes. 3. Define a policy that integrates incident, change and problem management procedures with the maintenance of the configuration repository. 4. Define a process to record new, modified and deleted configuration items and their relative attributes and versions. Identify and maintain the relationships between configuration items in the configuration repository. 5. Establish a process to maintain an audit trail for all changes to configuration items. 6. Define a process to identify critical configuration items in relationship to business functions (component failure impact analysis). 7. Record all assets including new hardware and software, procured or internally developed within the configuration management data repository. 8. Define and implement a process to ensure that valid licences are in place to prevent the inclusion of unauthorised software. DS9.3 Configuration Integrity Review 1. To validate the integrity of configuration data, implement a process to ensure that configuration items are monitored. Compare recorded data against actual physical existence, and ensure that errors and deviations are reported and corrected. 2. Using automated discovery tools where appropriate, reconcile actual installed software and hardware periodically against the configuration database, licence records and physical tags. 3. Periodically review against the policy for software usage the existence of any software in violation or in excess of current policies and licence agreements. Report deviations for correction. Assessed Maturity Target Maturity 2011 ISACA. All rights reserved. Page 31

32 VIII. Assessment Maturity vs. Target Maturity This spider graph is an example of the assessment results and maturity target for a specific enterprise. DS9.1 Configuration Repository and Baseline 5 AI6.4 Change Status Tracking and Reporting 4 3 DS9.2 Identification and Maintenance of Configuration Items 2 1 AI6.2 Impact Assessment, Prioritisation and Authorisation 0 DS9.3 Configuration Integrity Review AI6.1 Change Standards and Procedures.3 Identity Management.4 User Account Management Target Assessment 2011 ISACA. All rights reserved. Page 32

33 IX. s and Resources Andrews, Chip; SQL Security.com, July 1999, Lee, Il-Sung; Art Rask; Auditing in SQL Server 2008, February 2009, ISACA, Change Management Audit/Assurance Program, USA, 2009 ISACA, Information Security Management Audit/Assurance Program, USA, 2010 ISACA, MySQL Audit/Assurance Program, USA, 2010 ISACA, Network Perimeter Security Audit/Assurance Program, USA, 2009 X. Technical Appendix Suggested technical tests are current as of August 2010, the last update of this audit/assurance program. Remote Access 1. To determine if Remote Access is enabled: a. Click Start i. Click to Programs ii. Click to Microsoft SQL Server 2005 iii. Click to Configuration Tools iv. Click SQL Server Surface Area Configuration. b. On the SQL Server 2005 Surface Area Configuration page, click Surface Area Configuration for Services and Connections. c. On the Surface Area Configuration for Services and Connections page, expand Database Engine, click Remote Connections. d. Determine if Local and remote connections is enabled; that setting allows remote and local connections. Local connections is default. 2. To determine if the service is running: a. Type sqlcmd S(local)\SQLEXPRESS at the command prompt. If you see 1> that means that you managed to connect. b. Type exit to exit the sqlcmd program ISACA. All rights reserved. Page 33