Skip to content
Class Presentation

IT asset management

Explore IT asset management, software licensing, system interface risks, and audit best practices. Learn to assess job scheduling, data integrity, security updates, and compliance in enterprise IT environments.

Preview 13 of 43 pages

See the first 13 pages exactly as they appear in the document.

  1. Page 1
    Read page 1 as text

    IT Asset Management (Day2)

  2. Page 2
    Read page 2 as text

    What Is an IT Asset? An asset is something of tangible or intangible value that is worth protecting, including people, information, infrastructure ,finances, and reputation To protect and manage an asset, an inventory must be completed that identifies the asset, specifies its location, and indicates whether it has been assigned an owner. The first steps in IT asset management are identifying all IT assets and creating an inventory of IT assets. EY

  3. Page 3
    Read page 3 as text

    Inventory Record

  4. Page 4
    Read page 4 as text

    Discussion Question During an assessment of software development practices, an information systems (IS) auditor finds that open-source software components were used in an application designed for a client. What is the GREATESTconcem that the auditor has about the use of open-source software? The client did not pay for the open-source software components. The organization and client must comply with open-source software license terms. Open-source software has security vulnerabilities. Open-source software is unreliable for commercial use. EY

  5. Page 5
    Read page 5 as text

    Discussion Question A major benefit of using open-source software is that it is free. The client is not required to pay for the open-source software components; however, both the developing organization and the client should be concerned about the licensing terms and conditions of the open source software components that are being used. There are many types of open-source software licenses and each has different terms and conditions. Some open-source software licensing allows use of the open-source software component freely but requires that the completed software product must also allow the same rights. This is known as viral licensing, and if the development organization is not careful, its products can violate licensing terms by selling the product for profit. The information systems (IS) auditor should be most concerned with open- source software licensing compliance to avoid unintended intellectual property risk or legal consequences. Open-source software, just like any software code, should be tested for security flaws and should be part of the normal system development life cycle (SDLC) process. This is not more of a concern than licensing compliance. Open-source software does not inherently lack quality. Like any software code, it should be tested for reliability and should be part of the normal SDLC process. This is not more of a concern than licensing compliance. EY

  6. Page 6
    Read page 6 as text

    Discussion Question ■ An information systems (IS) auditor conducting a review of software usage and licensing discovers that numerous PCs contain unauthorized software. Which of the following actions should the IS auditor take? Delete all copies of the unauthorized software. Recommend an automated process to monitor for compliance with software licensing. Report the use of the unauthorized software and the need to prevent recurrence. Warn the end users about the risk of using illegal software. EY

  7. Page 7
    Read page 7 as text

    Discussion Question An information systems (IS) auditor should not assume the role of the enforcing officer and take on any personal involvement in removing the unauthorized software. This would detect compliance with software licensing; however, an automated solution might not be the best option in all cases. The use of unauthorized or illegal software should be prohibited by an organization. An IS auditor must convince the user and management of the risk and the need to eliminate the risk. For example, software piracy can result in exposure and severe fines. Auditors must report material findings to management for action. Informing the users of risk is not the primary responsibility of the IS auditor. EY

  8. Page 8
    Read page 8 as text

    Discussion Question ■ An information systems (IS) auditor discovers that some users installed personal software on their PCs. This is not explicitly forbidden by the security policy. The BEST approach for an IS auditor is to recommend that the: IT department implement control mechanisms to prevent unauthorized software installation. Security policy be updated to include the specific language regarding unauthorized software. IT department prohibit the download of unauthorized software. Users obtain approval from an IS manager before installing nonstandard software. EY

  9. Page 9
    Read page 9 as text

    Discussion Question An information systems (IS) auditor's obligation is to report on observations noted and make the best recommendation, which is to address the situation through policy. The IT department cannot implement controls in the absence of the authority provided through policy. Lack of specific language addressing unauthorized software in the acceptable use policy is a weakness in administrative controls. The policy should be reviewed and updated to address the issue —and provide authority for the IT department to implement technical controls. Preventing downloads of unauthorized software is not the complete solution. Unauthorized software can be also introduced through compact disks (CDs) and USB drives. Requiring approval from the IS manager before installation of the nonstandard software is an exception handling control. It would not be effective unless a preventive control to prohibit user installation of unauthorized software is established first. EY

  10. Page 10
    Read page 10 as text

    Discussion Question Which of the following is a network diagnostic tool that monitors and records network information? Online monitor Downtime report Help desk report Protocol analyzer EY

  11. Page 11
    Read page 11 as text

    Discussion Question Which of the following is a network diagnostic tool that monitors and records network information? Online monitors measure telecommunication transmissions and determine whether transmissions were accurate and complete. Downtime reports track the availability of telecommunication lines and circuits. Help desk reports are prepared by the help desk, which is staffed or supported by information systems (IS) technical support personnel trained to handle problems occurring during the course of IS operations. Protocol analyzers are network diagnostic tools that monitor and record network information from packets traveling in the link to which the analyzer is attached. EY

  12. Page 12
    Read page 12 as text

    Discussion Question Which of the following is a MAJOR concern during a review of help desk activities? The help desk team could not resolve certain calls. A dedicated line is not assigned to the help desk team. Resolved incidents are closed without reference to end users. The help desk instant messaging has been down for more than six months. EY

  13. Page 13
    Read page 13 as text

    Discussion Question Which of the following is a MAJOR concern during a review of help desk activities? Although this is of concern, it should be expected. A problem escalation procedure should be developed to handle such scenarios. Ideally, a help desk team should have dedicated lines, but this exception is not as serious as the technical team unilaterally closing an incident. The help desk function is a service-oriented unit. The end users must be advised before an incident can be regarded as closed. Instant messaging is an add-on to improve the effectiveness of the help desk team. Its absence cannot be seen as a major concern if calls can still be made. EY

30 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More Information Technology study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.