Gamboa, Princess Eliza F.
BSA-4A
Scenario 1: Your client is a school using shared Wi-Fi and unlicensed Windows OS. Identify
at least 3 audit findings and your recommendations.
I think the audit findings here are first, if the school is only using one shared
Wi-Fi for everybody such as teachers, staff, and students. This is risky
because confidential files, like grades and school records, can be exposed
when there is no separation. Anyone connected to the Wi-Fi could possibly
get access to things they should not see. Second, The use of unlicensed
Windows OS is another big issue. Since it’s not genuine, it will not receive
important updates and security patches. This means the computers are open
to viruses, and even hacking attempts. Third, Their Wi-Fi passwords are
probably weak and not changed often. If the password is leaked or guessed
by outsiders, it would allow unauthorized people to connect freely. I would
recommend to the school that they should create separate Wi-Fi networks
like one for admin and staff, another for teachers, and a public one for
students. Because this separation prevents sensitive data from being
exposed. Second, Use licensed Windows OS so that the system receives the
proper updates and protections from Microsoft. Lastly, To create a strong
password policy for Wi-Fi access and make sure that the passwords are
updated every month. This will reduce unauthorized use.
Scenario 2: A company uses VPN access for remote employees. What controls should you
verify as an auditor?
When a company uses VPN, the main purpose is to allow employees to
connect safely to the company’s systems even when they are working at
home or outside the office. As an auditor, I should first check if the VPN
connection is encrypted, because without encryption, hackers could spy and
steal the data being sent. Second, I will check if employees have their own
accounts. Sharing accounts in VPN is risky because if something happens, it
will be impossible to trace the responsible user. Third, authentication should
be required, so even if someone steals the password, they cannot log in
without the second security code. Lastly, I would check the VPN logs. These
logs record who connected, at what time, and from where. Having this
record helps the company detect suspicious access.
Scenario 3: During an audit, you discovered multiple generic user accounts in the server.
What risk does this pose and what control is lacking?
Finding multiple generic accounts in a server is a big red flag. I think the
problem here is accountability because generic accounts mean accounts that
are shared by many people and the account name is not their name it was
some kind of code. If something happens, like important files are deleted or
changed, the organization cannot trace who really did it. I think he control
that is missing here separation of account and authorized access so that each
person should have their own login credentials so their activities can be
monitored. Also, audit logs should be enabled to record all actions.
Scenario 4: A café offering free Wi-Fi processes online payments. Identify possible risks
and how you would audit network security.
I think this is very risky because first, there is the risk of hackers connecting
to the same Wi-Fi and stealing credit card details from customers. Also, for
possible hacker where they create fake wifi that it looks like the café
network and if the customer connect there they can steal the money. Lastly,
it is prone to viruses and the wifi to be available to anyone. As an auditor, I
would check if the cafe payment system and free Wi-Fi are on different
networks. This ensures that customer transactions are safe from the public
network. I would make sure that the systems are installed with updated
antivirus and firewalls. Also, I would review network logs and security
reports to see if there were attempts of intrusion or unusual activities
Scenario 5: Based on the Data Privacy Act, what controls should auditors check to ensure
protection of client data stored in servers?
The Data Privacy Act requires organizations to protect personal and
confidential information of clients. As an auditor, First, I should see if data
stored in the servers is encrypted, meaning even if someone manages to
steal it, the information cannot be read. Data should also be encrypted while
being transmitted over the network. Second, access to client data should be
to the authorized personnel only. This means only authorized people, like
finance or admin staff, can access the files they need. Not everyone in the
company should have access to all client records. Third, I would check if
there are regular backups of the data and if those backups are stored
securely, maybe offsite or in the cloud. Backups are important because in
case of system failure, the data can be recovered. Lastly, there should be
audit logs that track who accessed the data, when, and what changes were
made.
