Information Systems Security and Controls
Controls
Information Systems Security and Controls
Syllabus tag: KASNEB CPA | Foundation Level | CA16 Information Communication Technology | Topic 7 Information Systems Security and Controls
Lesson objectives
By the end of this topic, you will be able to:
- State the three objectives of information security
- Distinguish general from application controls
- Classify controls as preventive, detective or corrective
- Identify the main threats and the controls that address each
- Explain backup, disaster recovery and business continuity
Why this matters
An accountant relies on figures produced by a system they did not build. Whether those figures can be trusted depends entirely on the controls around that system — which is why this topic reappears in CA24 Auditing.
The three objectives
C-I-A, and every control serves at least one:
- Confidentiality — only authorised people see the data
- Integrity — the data is accurate, complete and unaltered
- Availability — the data is there when it is needed
The three can conflict. Encrypting everything and locking the server room serves confidentiality and may damage availability. Security design is a balance, not a maximum.
General and application controls
General controls apply across the whole environment: physical security, access control, change management, segregation of duties in the IT function, and backup procedures.
Application controls apply to a specific system, and follow the shape of processing:
| Stage | Control | Purpose |
|---|---|---|
| Input | Validation checks, batch totals, authorisation | Data entered is complete and accurate |
| Processing | Run-to-run totals, reasonableness checks | Data is not corrupted in processing |
| Output | Distribution lists, reconciliation, review | Results reach the right people intact |
General controls come first in importance. Application controls in a system anyone can bypass at the operating system level protect nothing — the same reasoning by which CA24 puts the control environment ahead of individual control activities.
Validation checks
An examinable list, and the distinctions matter:
| Check | Tests |
|---|---|
| Range check | Value falls between limits — a month between 1 and 12 |
| Format check | Data matches a pattern — a PIN of the right shape |
| Existence check | Code appears in a master file — a real customer number |
| Check digit | An extra digit computed from the others detects transposition |
| Completeness check | A mandatory field is not blank |
| Reasonableness check | Value is plausible in context — 200 hours in a week is not |
The check digit is the one worth understanding. It catches the error people make most: typing 4372 as 4732. A range check would pass both; only a check digit spots the transposition.
No validation check verifies truth. A correctly formatted, in-range, existing customer code can still be the wrong customer. Validation tests plausibility, not accuracy — which is why reconciliation and review remain necessary.
:::checkpoint An operator enters an employee number as 5183 instead of 5138, and both are valid employee numbers. State which validation checks would pass, which would fail, and what control would eventually detect the error. :::
Preventive, detective and corrective
| Type | Purpose | Example |
|---|---|---|
| Preventive | Stop the problem occurring | Passwords, firewalls, locked doors |
| Detective | Identify it when it happens | Audit logs, exception reports, reconciliations |
| Corrective | Restore the position afterwards | Backups, disaster recovery, patches |
All three are needed. Preventive controls fail; detective controls without corrective ones tell you about a disaster you cannot fix.
Threats
| Threat | Description |
|---|---|
| Malware | Viruses, worms, trojans, spyware |
| Ransomware | Data encrypted and a payment demanded |
| Phishing | Fraudulent messages inducing disclosure of credentials |
| Social engineering | Manipulating people rather than systems |
| Hacking | Unauthorised access |
| Denial of service | Overwhelming a system so it cannot serve users |
| Insider threat | Misuse by an authorised person |
| Physical | Fire, flood, theft, power failure |
Social engineering and phishing target people, not technology, and no firewall stops an employee who is persuaded to hand over a password. Staff training is therefore a security control, not an HR activity — a point examiners look for.
Access control
Authentication establishes who you are; authorisation determines what you may do. They are different steps and candidates conflate them.
Authentication factors: something you know (password), something you have (a token or phone), something you are (biometric). Multi-factor authentication combines two or more, which is why a stolen password alone no longer suffices.
Least privilege — a user receives only the access their role requires — limits the damage from any single compromised account.
Backup and recovery
The 3-2-1 rule: three copies of the data, on two different media, with one held off-site.
Backup types: full (everything, slow but simple), incremental (changes since the last backup of any kind, fast to write and slow to restore), and differential (changes since the last full backup).
A backup that has never been restored is not a backup. Testing the restore is the control; taking the copy is only half of it, and untested backups fail at exactly the moment they are needed.
Disaster recovery concerns restoring the systems. Business continuity is broader — keeping the organisation operating while they are down, which may mean manual procedures, alternative premises and communication with customers.
:::checkpoint A company takes nightly backups to a server in the same building, and has never attempted a restore. Identify two distinct weaknesses and state what each could cost the company. :::