Hot Topics in IT. CUAV Conference May 2012

Hot Topics in IT CUAV Conference May 2012 Baker Tilly Virchow Krause, LLP Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International.

Who Are We? Mike Cullen Manager 10+ years IT Audit Jarrett Blankenship Senior Consultant 6+ years IT Audit www.bakertilly.com

Agenda Cloud Computing Contracts Big Data Security Changing Role of IT

Agenda More IT Topics Lightning Round Hacking FISMA Social Media Mobile Devices

CLOUD COMPUTING

Cloud Topics Contracts Big Data Security Changing Role of IT

Cloud Contracts What is it? Service level agreements Data processing and storage Infrastructure/security requirements Vendor relationship

Cloud Contracts What are the issues? Ownership of data Disposition of data Data breaches Data segregation Data location Data portability Legal/government requests for access to data

Cloud Contracts How can you audit/provide value? Ensure vendor/contracts process involves all stakeholders (e.g., units, legal, IT, finance, audit) Audit should be involved in negotiations to provide expertise on contract audit clauses and vendor certification programs (e.g., SSAE 16, PCI) Ensure there is a clear business owner of the vendor relationship Validate due diligence commiserate with the strategic importance and sensitivity of the data

Cloud Big Data What is it? Finding Meaning in Lots and Lots of Data Generated from Enterprise Systems Databases Social Networks Search Engines Etc, etc, etc

Cloud Big Data What are the issues? How do you balance the collection of information on students, alumni, faculty, or others with their rights to privacy? How do you measure the accuracy of the inferences from big data analysis?

Cloud Big Data How can you audit/provide value? Review controls for information privacy and security of data based on risk and regulatory requirements Validate data owners are aware of data usage Future need = Optimized use of Information, such as: Enrollment Retention Alumni Networking Fundraising Things we can t imagine right now

Cloud Security What is it? The growing challenge of securing data and information systems through collaboration with third parties providing services to the organization

Cloud Security What are the issues? Is Cloud security different than other Information Security? How can you be sure that data is secure in the Cloud? Who is responsible for what during a security breach? The Big Question: Is the Cloud more or less secure?

Cloud Security How can you audit/provide value? Conduct a Risk Assessment before moving a service to the cloud Review Vendor s Independent Certifications (e.g., SSAE 16, PCI) Ensure there are strong internal Data Security policies and procedures Thought: What is the right amount of due diligence to perform for a cloud provider?

Cloud Changing Role of IT What is it? IT as a Commodity that is flexible instead of a capital expense that is slow to change If the University moves everything to the Cloud, do we need a CIO? Do we even need an IT department?

Cloud Changing Role of IT What are the issues? IT s evolving role could be to: Set strategic priorities of technology for the organization Maintain a unified and efficient technology ecosystem Focus on developing new competitive advantages Provide advice and guidance on how to securely and efficiently leverage the cloud Innovators and Consultants instead of Doers and Managers

Cloud Changing Role of IT How can you audit/provide value? Validate IT strategy alignment to organization mission and goals Help IT define strategic roadmaps and plans to ensure risks are addressed Partner with IT to audit/review vendors, help create a vendor management program

SIDEBAR ON SERVICE ORGANIZATION CONTROLS (SOC) REPORTING

SOC Reports SOC 1 SOC 2 SOC 3 Purpose Reports on the controls of the service organization that are relevant to the user organization s financial reporting Reports on the effectiveness of the controls of the service organization related to compliance or operations, including trust services principles and criteria* Same purpose as SOC 2 *Trust services principles and criteria is security, availability, processing integrity, confidentiality, and/or privacy. The security, availability, and processing integrity criteria are related to the controls system and the confidentiality and privacy criteria are related to the information processed by the system.

SOC Reports SOC 1 SOC 2 SOC 3 Info required Details on the system, controls, and tests performed by the service auditor, and results of those tests Details on the system, controls, and tests performed by the service auditor, and results of those tests Same information as SOC 2, but with a less detailed description of the controls of the service organization Audience User organization s controllers, compliance officers, CFO, CIO, and financial statement auditors User organization s controllers, compliance officers, CFO, CIO, vendor management executives, regulators, other specified parties, and appropriate business partners Unrestricted and can be viewed by anyone who would like confidence in the controls of the service organization