【導(dǎo)讀】Chapter3. 2020CISAREVIEW. MovetoNextLevel. ZhaoyangWang. CISSP,CISA. 2. ChapterOverview. 3. ChapterObjective. testing,implementation,maintenance,anddisposalof. objectives.‖。4. ChapterSummary. Around32questions. 5. –Programmanagement. anddeliverables. content. 6. 7. 8. GeneralAspects. –Definitionof―project‖。9. 10

　　

【正文】 existing staff ? Training and hiring requirements ? Future growth needs ? Impact on system and work performance 64 Infrastructure Development / Acquisition Practices ?System Software Implementation ?System Software Change Control Procedures – Change control procedures are designed to ensure that – ? Changes are authorized ? Do not disrupt processing 65 Information Systems Maintenance Practices 66 Information Systems Maintenance Practices ? Change Management Process Overview – System maintenance practices refer primarily to – ? The process of managing change to application systems ? The process of maintaining the integity of both the production source and executable code ? To ensure the system changes are appropriate to the needs of the organization, approriately authorized, documented, thoroughly tested and approved by mangement. ? The process typically is established in the design phase of the application, when application system requirements are baselined. 67 Information Systems Maintenance Practices ?Change Management Process Overview – Steps ? Request – Formal form or ? Approval of systems and business management ? Development ? Testing ? Approval ? Versioning ? Deployment – This process bees more important when the segregation of duties cannot be established. 68 Information Systems Maintenance Practices ?Change Management Process Overview – Deploying Changes ? Deploying happens after the user is satisfied with the system test results and adequacy of the system documentation, and the approval is obtained. – Documentation ? Update System documentation ? Update offsite documentation ? Documentation may consist of program and/or system flowcharts, program narratives, data dictionaries, entity relationship models, DFD, operator run books and enduser procedural manuals. 69 ? Change Management Process Overview (cont.) – Testing changed program ? Ensure functionality not damaged by change ? System performance not degraded from change ? No security exposures created from change – Auditing Program Changes ? Access to libraries restricted. ? Supervisory reviews should be conducted. ? Change requests should be approved and documented (on a standard form). ? Potential impact of changes should be assessed. ? Change are appropriately approved Information Systems Maintenance Practices 70 ? Change Management Process Overview (cont.) – Emergency changes ? Emergency ID access should be logged and carefully monitored ? Afterthefact and followup procedures to ensure that all normal change management controls are retroactively applied. – Deploying changes back into production ? A group that is independent of puter programming should perform the migration of programs from test to production. – Change exposures (unauthorized changes) Information Systems Maintenance Practices 71 ? Configuration Management – Involves procedures throughout the software life cycle – Identify, define and baseline software items in the system – Provides a basis for problem management, change management and release management. – Once an item is developed and approved, it is handed over to a configuration management team for safekeeping and assigned a reference number. – Once baselined, an item should only be changed through a formal change control process – A new version of the system should only be built from the baselined items. Information Systems Maintenance Practices 72 System Development Tools and Productivity Aids 73 System Dev Tools and Productivity Aids ? Code Generators ? ComputerAided Software Engineering (CASE) – Upper CASE (requirements), Middle CASE (design), Lower CASE (code) – Allows teams to produce a plete system from Data Flows – CASE tools help in the application design process, but do not ensure that the design, programs and systems are correct or that they fully meet the needs of the organization 74 System Dev Tools and Productivity Aids ?FourthGeneration Languages (4GLs) – Inability to perform data intensive and online operations because they lack the lower level detail mands necessary to perfomr these operations. – Common Characteristics ? NonProcedural Language ? Environmental Independence (Portability) ? Software Facilities ? Programmer Workbench Concepts ? Simple Language Subsets – Classification ? Query and Report Generators ? Embedded Database 4GLs ? Relational Database 4GLs ? Application Generators 75 Process Improvement Practices 76 Process Improvement Practices ?Business Process Reengineering and Process Change Projects – PDCA cycle, PlanDoCheckAction – The existing baseline processes must be documented, so they can be pared to the processes after reengineering. – Auditor’s concerns ? Key controls may be reengineered out of a business process ? The auditor must ensure that management is aware of the removal of the control and that the management is willing to accept the potential material risk of not having that control. 77 Process Improvement Practices ?Business Process Reengineering and Process Change Projects (cont.) – BPR Methods and Techniques ? Benchmarking Process – Plan (identify critical prcoess for benchmarking exercise) – Research (own baseline data collecting, benchmarking partners) – Observe (partner’s baseline data collecting, visit partners) – Analyze (gap analysis) – Adapt (translate the findings, principlesstrategiesaction plan) – Improve – BPR Audit and Evaluation Techniques 78 Process Improvement Practices ?ISO 9126 – ISO 9126 provides the definition of the characteristics and associated quality evaluation process to be used when specifying the requirements for and evaluating the quality of software products throughout their life cycle