Home Applications Meeting CobIT Control Objectives with Microsoft Terminal Services

Meeting CobIT Control Objectives with Microsoft Terminal Services


Meeting CobIT Control Objectives 
with Microsoft Terminal Services
Last Update 05-05-2010
Table of Contents:
This article will introduce how Microsoft Terminal Services can help organizations of any size meet regulatory mandates by following the CobIT methodology. The CobIT methodology, which is referenced via the Sarbanes-Oxley legislation, provides 215 control objectives in four high level domains. This article highlights how 52 of the control objectives are meet by using Microsoft Terminal Services and the server based computing model.
CobIT is a mature, control framework, first released in 1996 by the Information Systems Audit and Control Association (ISACA). Since its origin its evolved with a second edition in 1998, a third in 2000, and a fourth edition in November 2005. CobIT is maintained by the IT Governance Institute (ITGI) and Information Systems Audit and Control Association (ISACA). ISACA describes CobIT as a "framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks" (ref: ISACA). CobIT has become the de facto standard for auditors and Sarbanes-Oxley compliance, which has significantly increased its visibility and use. CobIT has been widely mapped against the “big three” standards, COSO, ITIL, ISO 17799.
CobIT is comprised of six documents. List 1.2 shows the six documents:
  • Management Guidelines
  • Implementation ToolSet
  • Executive Summary
  • Framework
  • Control Objectives
  • Audit Guidelines
From a structural perspective CobIT consists of a set of 215 Control Objectives for information technology, intended to enable auditing. The Control Objectives are guidance, in that they describe what should be accomplished.
The inherent advantages with Terminal Services in regards to compliance stems from the server based computing model, which allows centralized provisioning, operations and management of the entire Windows application and desktop environment from the data center. Access to information systems is provided by a single piece of client software namely the RDC client, which is hardware and operating system independent. With Terminal Services all of applications and Windows desktops are centrally managed in the datacenter. This also allows centralization of security and reglatory compliance policies such as segregation of duties, authentication and access control, patch management, change management, virus scans, data retention, access and transaction auditing, and business continuity. By leveraging Terminal Services’ centralized management capabilities organizations can simplify access controls and system auditing for employees as well as business partners.
Auditing corporate information systems for Sarbanes-Oxley compliance can be an overwhelming task due in part to the lack of a definitave Sarbanes-Oxley compliance road map. Organizations turn to 3rd party auditors, which tipically uncover deficiencies in the areas of segregation of duties, change control, and strong password policy enforcement.
As with information security, compliance is not a one-time event. Ongoing testing of existing controls must occur yearly and modifications will require additional testing and validation. The consensus is that the scope of audits as well as the expectation of controls will continue to increase. 
The current emphasis on audits is baseline security as it pertains to access control, identity management, and audit level visibility of user interactions with corporate systems. Subsequent audits will likely explore the need for a stronger identity management supporting non-repudiation of executive signoffs of financial statements and internal approvals of transactions within the scope of Sarbanes-Oxley Act section 302 and 404. 

Detailed responses to CobIT audit points 

To read the entire article at its source, please refer to Meeting CobIT Control Objectives  with Microsoft Terminal Services

Oracle VM (The Underground Oracle VM Manual)


More Resources:

DABCC DABCC.com, the world leader in sharing the finest Virtualization & Cloud news and support resources. #Citrix, #VMware, #Microsoft, #Mobility and much more! Brought to you by @douglasabrown & team!

White Papers

    Evolving Requirements of BYOD Management – White Paper

    While the bring your own device (BYOD) trend helps organizations reduces infrastructure costs, only a fraction of those organizations — 16 percent — are fully equipped to support BYOD programs. That’s one of the many findings revealed in Evolving Requirements for Bring Your Own Device (BYOD) Management,  a new white paper by leading IT research […]


      Citrix Load & Performance Testing – Download AppLoader!

      Load testing for Citrix XenApp, XenDesktop, PeopleSoft, Java, .NET, Adobe, client-server, Oracle, Siebel, SAP, web, custom apps and more Download NRG Global’s load and performance testing solution for all applications from the end user’s perspective. This easy-to-use, script-free load and performance testing solution stresses your application with real-life traffic to accurately assess end to end […]

      On-Demand Webinars

        Latest Videos

          ServiceDesk Plus – Request Management as an Administrator

          ServiceDesk Plus is a game changing IT help desk software which is used by more than 100,000 service desks across 185 countries. This video series will help you get the most out of ServiceDesk Plus. In this video you will learn how to add organisational details, import users, and configure the request management module in […]