Home Applications Meeting CobIT Control Objectives with Microsoft Terminal Services

Meeting CobIT Control Objectives with Microsoft Terminal Services

0
0

Meeting CobIT Control Objectives 
with Microsoft Terminal Services
Last Update 05-05-2010
Table of Contents:
 
 
This article will introduce how Microsoft Terminal Services can help organizations of any size meet regulatory mandates by following the CobIT methodology. The CobIT methodology, which is referenced via the Sarbanes-Oxley legislation, provides 215 control objectives in four high level domains. This article highlights how 52 of the control objectives are meet by using Microsoft Terminal Services and the server based computing model.
 
CobIT is a mature, control framework, first released in 1996 by the Information Systems Audit and Control Association (ISACA). Since its origin its evolved with a second edition in 1998, a third in 2000, and a fourth edition in November 2005. CobIT is maintained by the IT Governance Institute (ITGI) and Information Systems Audit and Control Association (ISACA). ISACA describes CobIT as a "framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks" (ref: ISACA). CobIT has become the de facto standard for auditors and Sarbanes-Oxley compliance, which has significantly increased its visibility and use. CobIT has been widely mapped against the “big three” standards, COSO, ITIL, ISO 17799.
 
CobIT is comprised of six documents. List 1.2 shows the six documents:
  • Management Guidelines
  • Implementation ToolSet
  • Executive Summary
  • Framework
  • Control Objectives
  • Audit Guidelines
 
From a structural perspective CobIT consists of a set of 215 Control Objectives for information technology, intended to enable auditing. The Control Objectives are guidance, in that they describe what should be accomplished.
 
The inherent advantages with Terminal Services in regards to compliance stems from the server based computing model, which allows centralized provisioning, operations and management of the entire Windows application and desktop environment from the data center. Access to information systems is provided by a single piece of client software namely the RDC client, which is hardware and operating system independent. With Terminal Services all of applications and Windows desktops are centrally managed in the datacenter. This also allows centralization of security and reglatory compliance policies such as segregation of duties, authentication and access control, patch management, change management, virus scans, data retention, access and transaction auditing, and business continuity. By leveraging Terminal Services’ centralized management capabilities organizations can simplify access controls and system auditing for employees as well as business partners.
 
Auditing corporate information systems for Sarbanes-Oxley compliance can be an overwhelming task due in part to the lack of a definitave Sarbanes-Oxley compliance road map. Organizations turn to 3rd party auditors, which tipically uncover deficiencies in the areas of segregation of duties, change control, and strong password policy enforcement.
 
As with information security, compliance is not a one-time event. Ongoing testing of existing controls must occur yearly and modifications will require additional testing and validation. The consensus is that the scope of audits as well as the expectation of controls will continue to increase. 
 
The current emphasis on audits is baseline security as it pertains to access control, identity management, and audit level visibility of user interactions with corporate systems. Subsequent audits will likely explore the need for a stronger identity management supporting non-repudiation of executive signoffs of financial statements and internal approvals of transactions within the scope of Sarbanes-Oxley Act section 302 and 404. 

Detailed responses to CobIT audit points 

To read the entire article at its source, please refer to Meeting CobIT Control Objectives  with Microsoft Terminal Services

Resources:
Oracle VM (The Underground Oracle VM Manual)

 

More Resources:

Categories:
DABCC DABCC.com, the world leader in sharing the finest Virtualization & Cloud news and support resources. #Citrix, #VMware, #Microsoft, #Mobility and much more! Brought to you by @douglasabrown & team!
| LATEST RESOURCES

White Papers

    Optimizing Virtual Infrastructure Storage Systems with Xangati ESP

    IN SEARCH OF BETTER TOOLS FOR OPTIMIZING EXPANSIVE ENTERPRISE STORAGE Virtualized infrastructures span servers, switches, storage systems and client devices. Of these four categories, storage systems are the most challenging to correctly size, configure and operate. That’s why IT administrators who manage complex virtual and cloud environments rely on Xangati ESP. Xangati’s real-time monitoring and analysis platform […]

    Downloads

      Download AppEnsure Free Application Response Time And Throughput In Virtualized And Cloud Environments

      Download AppEnsure: Application Response Time And Throughput In Virtualized And Cloud Environments.  AppEnsure is a Citrix Startup Accelerator company! AppEnsure provides APM for IT Operations to proactively manage end-user experience. AppEnsure uniquely correlates the real end-user response time experience with the application-delivery infrastructure performance, providing contextual, actionable intelligence to reduce resolution time by 95% of […]

      On-Demand Webinars

        Sneak Peek: Blob Storage for SoftNAS Cloud on Azure – The Video

        We’re always adding new and exciting features to SoftNAS Cloud. In this video, we show you a sneak peek of how SoftNAS Cloud front ends Azure Blob Storage with NFS, CIFS/SMB, iSCSI and AFP support. Learn more at www.softnas.com/azure


        Close