Home Applications Meeting CobIT Control Objectives with Microsoft Terminal Services

Meeting CobIT Control Objectives with Microsoft Terminal Services

0
0

Meeting CobIT Control Objectives 
with Microsoft Terminal Services
Last Update 05-05-2010
Table of Contents:
 
 
This article will introduce how Microsoft Terminal Services can help organizations of any size meet regulatory mandates by following the CobIT methodology. The CobIT methodology, which is referenced via the Sarbanes-Oxley legislation, provides 215 control objectives in four high level domains. This article highlights how 52 of the control objectives are meet by using Microsoft Terminal Services and the server based computing model.
 
CobIT is a mature, control framework, first released in 1996 by the Information Systems Audit and Control Association (ISACA). Since its origin its evolved with a second edition in 1998, a third in 2000, and a fourth edition in November 2005. CobIT is maintained by the IT Governance Institute (ITGI) and Information Systems Audit and Control Association (ISACA). ISACA describes CobIT as a "framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks" (ref: ISACA). CobIT has become the de facto standard for auditors and Sarbanes-Oxley compliance, which has significantly increased its visibility and use. CobIT has been widely mapped against the “big three” standards, COSO, ITIL, ISO 17799.
 
CobIT is comprised of six documents. List 1.2 shows the six documents:
  • Management Guidelines
  • Implementation ToolSet
  • Executive Summary
  • Framework
  • Control Objectives
  • Audit Guidelines
 
From a structural perspective CobIT consists of a set of 215 Control Objectives for information technology, intended to enable auditing. The Control Objectives are guidance, in that they describe what should be accomplished.
 
The inherent advantages with Terminal Services in regards to compliance stems from the server based computing model, which allows centralized provisioning, operations and management of the entire Windows application and desktop environment from the data center. Access to information systems is provided by a single piece of client software namely the RDC client, which is hardware and operating system independent. With Terminal Services all of applications and Windows desktops are centrally managed in the datacenter. This also allows centralization of security and reglatory compliance policies such as segregation of duties, authentication and access control, patch management, change management, virus scans, data retention, access and transaction auditing, and business continuity. By leveraging Terminal Services’ centralized management capabilities organizations can simplify access controls and system auditing for employees as well as business partners.
 
Auditing corporate information systems for Sarbanes-Oxley compliance can be an overwhelming task due in part to the lack of a definitave Sarbanes-Oxley compliance road map. Organizations turn to 3rd party auditors, which tipically uncover deficiencies in the areas of segregation of duties, change control, and strong password policy enforcement.
 
As with information security, compliance is not a one-time event. Ongoing testing of existing controls must occur yearly and modifications will require additional testing and validation. The consensus is that the scope of audits as well as the expectation of controls will continue to increase. 
 
The current emphasis on audits is baseline security as it pertains to access control, identity management, and audit level visibility of user interactions with corporate systems. Subsequent audits will likely explore the need for a stronger identity management supporting non-repudiation of executive signoffs of financial statements and internal approvals of transactions within the scope of Sarbanes-Oxley Act section 302 and 404. 

Detailed responses to CobIT audit points 

To read the entire article at its source, please refer to Meeting CobIT Control Objectives  with Microsoft Terminal Services

Resources:
Oracle VM (The Underground Oracle VM Manual)

Featured Resources:

Related Articles:

Categories:
DABCC DABCC.com, the world leader in sharing the finest Virtualization & Cloud news and support resources. #Citrix, #VMware, #Microsoft, #Mobility and much more! Brought to you by @douglasabrown & team!
| LATEST RESOURCES

White Papers

    Microsoft Reference Architecture for a High Availability SharePoint Server 2016 Farm in Azure

    The Azure CAT Patterns & Practices team has published a new reference architecture for deploying and running a high availability SharePoint Server 2016 farm in Azure. It provides prescriptive guidance including the following topics: Architecture resources necessary for the deployment, including resources. Scalability considerations. Availability considerations. Manageability considerations. Security considerations. Like all reference architectures that […]

    Downloads

      FREE eG Enterprise Logon Simulator for Citrix XenApp and XenDesktop

      Fast, free and incredibly useful. Coming in summer 2017. 14Synthetic logon simulation tool for monitoring, diagnosis, alerting and reporting of Citrix logon performance Quick SaaS deployment – be up and running in minutes Web-based monitoring console Supports logon through StoreFront or NetScaler Gateway Best-suited for Citrix XenApp 6.5, 7.x and XenDesktop 7.x Free forever, no […]

      On-Demand Webinars

        Latest Videos

          Microsoft Video: Brad Anderson’s Lunch Break / s6 e6 / Jacob Morgan, Author, Futurist (Part 2)

          In part 2 of Brad’s discussion with Jacob Morgan (best-selling author, futurist) they discuss the ramifications of investing IT and its impact on retaining or driving away talent. They also talk about fake business advice books, and how to intelligently and strategically select which emerging technologies are worthy of investment. To Learn more about Microsoft […]

          Views All IT News on DABCC.com
          Views All IT Videos on DABCC.com
          Win a Tesla P100D

          Visit our Sponsors!

          Close