Home Applications Meeting CobIT Control Objectives with Microsoft Terminal Services

Meeting CobIT Control Objectives with Microsoft Terminal Services

0
0

Meeting CobIT Control Objectives 
with Microsoft Terminal Services
Last Update 05-05-2010
Table of Contents:
 
 
This article will introduce how Microsoft Terminal Services can help organizations of any size meet regulatory mandates by following the CobIT methodology. The CobIT methodology, which is referenced via the Sarbanes-Oxley legislation, provides 215 control objectives in four high level domains. This article highlights how 52 of the control objectives are meet by using Microsoft Terminal Services and the server based computing model.
 
CobIT is a mature, control framework, first released in 1996 by the Information Systems Audit and Control Association (ISACA). Since its origin its evolved with a second edition in 1998, a third in 2000, and a fourth edition in November 2005. CobIT is maintained by the IT Governance Institute (ITGI) and Information Systems Audit and Control Association (ISACA). ISACA describes CobIT as a "framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks" (ref: ISACA). CobIT has become the de facto standard for auditors and Sarbanes-Oxley compliance, which has significantly increased its visibility and use. CobIT has been widely mapped against the “big three” standards, COSO, ITIL, ISO 17799.
 
CobIT is comprised of six documents. List 1.2 shows the six documents:
  • Management Guidelines
  • Implementation ToolSet
  • Executive Summary
  • Framework
  • Control Objectives
  • Audit Guidelines
 
From a structural perspective CobIT consists of a set of 215 Control Objectives for information technology, intended to enable auditing. The Control Objectives are guidance, in that they describe what should be accomplished.
 
The inherent advantages with Terminal Services in regards to compliance stems from the server based computing model, which allows centralized provisioning, operations and management of the entire Windows application and desktop environment from the data center. Access to information systems is provided by a single piece of client software namely the RDC client, which is hardware and operating system independent. With Terminal Services all of applications and Windows desktops are centrally managed in the datacenter. This also allows centralization of security and reglatory compliance policies such as segregation of duties, authentication and access control, patch management, change management, virus scans, data retention, access and transaction auditing, and business continuity. By leveraging Terminal Services’ centralized management capabilities organizations can simplify access controls and system auditing for employees as well as business partners.
 
Auditing corporate information systems for Sarbanes-Oxley compliance can be an overwhelming task due in part to the lack of a definitave Sarbanes-Oxley compliance road map. Organizations turn to 3rd party auditors, which tipically uncover deficiencies in the areas of segregation of duties, change control, and strong password policy enforcement.
 
As with information security, compliance is not a one-time event. Ongoing testing of existing controls must occur yearly and modifications will require additional testing and validation. The consensus is that the scope of audits as well as the expectation of controls will continue to increase. 
 
The current emphasis on audits is baseline security as it pertains to access control, identity management, and audit level visibility of user interactions with corporate systems. Subsequent audits will likely explore the need for a stronger identity management supporting non-repudiation of executive signoffs of financial statements and internal approvals of transactions within the scope of Sarbanes-Oxley Act section 302 and 404. 

Detailed responses to CobIT audit points 

To read the entire article at its source, please refer to Meeting CobIT Control Objectives  with Microsoft Terminal Services

Resources:
Oracle VM (The Underground Oracle VM Manual)

Featured Resources:

Related Articles:

Categories:
DABCC DABCC.com, the world leader in sharing the finest Virtualization & Cloud news and support resources. #Citrix, #VMware, #Microsoft, #Mobility and much more! Brought to you by @douglasabrown & team!
| LATEST RESOURCES

White Papers

    Top 7 Challenges Migrating to the Cloud White Paper

    Moving mission-critical workloads to the cloud delivers a range of compelling business benefits, including increased agility, pay-as-you-go cost structures, and the ability to leverage the provider’s system administration experts to keep your systems up, running, and patched. But migrating to the cloud is not without its challenges. Focus on solving these known challenges to make […]

    Downloads

      Download ScaleArc Database Performance and Load Balancing Sofware

      ScaleArc offer’s a free, easy, fully featured and supported 30-day trial of the ScaleArc software (formerly iDB). ScaleArc is incredibly easy to implement, with most customers able to get their first cluster up and running in less than 15 minutes from install. Available as an easy to use VM Image, an Amazon AMI, or an […]

      On-Demand Webinars

        Latest Videos

          NVIDIA: Deep Learning Visualizing Heart Activity In 3D

          AI startup Genetesis is creating deep learning solutions that allow physicians to detect and localize sources of abnormality in the heart within dynamic 3D maps. Explore more about AI and Deep Learning: https://www.nvidia.com/en-us/deep-learning-ai/ This video is via NVIDIA.

          Views All IT News on DABCC.com
          Views All IT Videos on DABCC.com
          Win a Tesla P100D

          Visit our Sponsors!


          Close