Auditing Archive

John Joseph Flood asked:




You’re sitting at your desk when the telephone rings. The Department of Transportation has just told you that a safety audit will be done on your transportation company. Is your company prepared?

If you’re an owner or a manager of a trucking company, you do not have to panic when the time comes for a DOT audit. Properly training your management team so that they understand the DOT regulations will ensure that your company is operating in compliance at all times. When a trucking management team fully understands what the DOT expects, an unexpected check of the records can be painless and stress free for everyone that is involved.

What is the purpose of a DOT safety audit?

When DOT performs a their check they are there to evaluate the company’s performance in safety and to ensure that all record-keeping meets their requirements. Below is a review that covers the typical safety audit, and what they look for. The audits vary from state to state. There packets are available in every state that will instruct you on how to keep in compliance.

It is recommended that you ask for a DOT safety audit packet that is relevant for your area of operations. The packet will explain all DOT regulations that you must follow.

An audit typically involves six categories that will be inspected. General, Driver, Operational, Vehicle, Hazardous Materials and Accidents.

General:

A company needs to show that they have proper liability coverage. All required documentation will be listed in the packet that covers your area. Dot safety auditors will also request to view the company’s accident register. All recordable DOT accidents must be listed. The accident register has to be in place, even if there are no recordable accidents.

Under the general review, vehicle markings could also be inspected to ensure proper markings on all commercial vehicles. DOT will also review all training records that involve transportation safety and any other training records that involve their regulations.

Driver

DOT safety audits will review every driver’s CDL, qualifications, and alcohol and drug testing records. Management must also have a means of tracking CDL expiration dates. Under the driver category, there are several mandatory documents that are required. You can get the full list of requirements in a DOT safety audit packet.

Operational

Any company that operates a commercial motor vehicle must have record-keeping detailing driver’s hours of service. DOT safety auditors expect at least 6 months of driver logs.

Vehicles

In this category, DOT safety audits want to see detailed record-keeping of each commercial vehicle that includes maintenance, repairs and inspections.

Hazardous materials

DOT safety auditors will want to review all Hazmat related documentation that can include licenses, storage, labels, placards, training and endorsements.

Accidents

Because safety is the main concern, all driver accidents and injuries will be reviewed for proper documentation to ensure all regulations were met.

A company that has a management team that follows all regulations when handling everyday operations will likely be in compliance during a safety audit. Company’s can request a DOT safety audit packet through their state Department Of Transportation office and the packets are also available online.

Create a video blog

Francisco Segura asked:




Auditing Software is the charter accountants of future. Computer being a very important mode of calculation in the field of science also plays an important role in internal accounts of any business. Paperless auditing is no more a term for future. IT sector is backbone of any company and for any country. But we also know that software’s are more risk prone in case of security .But to maintain the efficiency they take such risks and make their own software’s. Any software used to keep a check on daily happenings of the company n record the transactions are called accounting software’s. But the most important part of any accounting year is final audit.It is seen or maybe noticed that human ability of auditing can have some disadvantages and are less efficient and also time consuming. In many of the companies all main and important transactions are handled by IT systems. This ensures good management, speedy decision making. To trust on such systems companies keeps a check by regularly testing internal controls within their IT technology department. Auditing Software is a revolution in the field of accountancy.Technology and software’s have played a remarkable role in practice of internal audit. It has increased efficiency and consumes less time than humans.But what is audit software?Due to audit software’s, technology has taken over humans. This has reduced the number of audit professionals in the company and increased productivity without a corresponding staff. Obviously role of such auditing software is increasing; many internal audit departments are frequent users of IT systems in their organization. They even share their information electronically. They even use telecommunication services. Such innovations have increased the efficiency of internal audit. Before auditors had to fax the information to head office now with the help of auditing software with just a click the information is sent across countries. Many auditors are using auditing software to change the role of internal audit in their organizations.Using Such Auditing software auditors are able to provide more valuable services to management1. Standardization2. Elimination of human process3. making database of international information4. Showing if any risk.Most significant boon of such accounting software’s is that it is less time consuming. An auditor spends maximum time on site at different locations. This means taking less time we can increase our productivityAfter the process of audit it is communicated to different locations. The data can be communicated in the form of Video conference. Audit work or work samples can also be sent via email and file transfer. Audit analysis can also be saved in personal computer thus it can be accessed many times.But a number of auditors feel that software has a very little effect on the efficiency of audit analysis. How ever it has helped many companies to finish their work in time and increased productivity.

Caffeinated Content – Members-Only Content for WordPress

Marc Trimble asked:




The name PCI which means Payment Card Industry is created by the major credit card industry namely Visa, MasterCard and American express. The PCI DSS is compliance for all merchants and all business owners who offer a credit card as the payment option for transaction over the internet. Demand of this type of compliance is increased as the cases of security breaches and fraudulent transaction are increasing over internet.

This compliance will ensure the buyer that the credit card information he is using to buy a product will be secure and the data stored on merchant’s side will not be used without the permission of card owner. There are many cases in which the merchants who have been failed to comply with these regulations have ended up with stolen data or sensitive information of customers.

If you offer a product of your business on internet, it is very essential that a secure portal must be maintained. Means a portal which store or processes the credit card data of a customer must be encrypted or secured by other means. Many online transaction the servers on which the product website is hosted, become the security issue for the user world. There are hosting provider which ensure the security by SSL (secure socket layer) or by other means. But all these security can be breached. With the advancement in technology it is no longer an issue for a hacker to stole your personal data even it is stored on your personal laptop and your network do not have any firewall installed on it.

The merchants are obliged to store or process the consumer’s data securely. The web servers on which the data or a card owner is stored must be tested on regularly basis in addition to this it must be monitored with daily activity using ASV.

Always keep in mind if you are getting the PCI compliant it is just like an investment which get you the trust of your customers and ensuring the security. If your business is PCI compliant your consumers will have assurance and confidence in using their credit cards for transactions.

Kansieo.com

Mark Kedgley asked:




The security standard calls for a broad range of security measures, but beyond the use of firewalling, intrusion protection systems and anti-virus software, the understanding of the requirements and responsibilities of the merchant are very often poorly understood.

This guide simplifies the scope of the balance of PCI DSS measures to just four areas.
- File Integrity monitoring
- Event Log centralization
- Security Vulnerability scanning for device hardening
- Change Management process
Understanding and implementing measures to address these four areas will make any QSA happy and get you compliant – and keep you compliant – in no time at all.

File Integrity Monitoring

As a mandated dimension of the PCI DSS, FIM verifies that program and operating system files have not been compromised.

Why is this important? The principal benefit of using FIM technology is to ensure that malicious code has not been embedded within critical application and operating system files. The insertion of a ‘backdoor’ or Trojan into core program files is one of the more audacious and elegant forms of hacking, and also one of the most dangerous.

The PCI DSS (Payment Card Industry Data Security Standard) specifies the following “Deploy file-integrity monitoring software to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly” and also that for log files “Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)”.

Contemporary compliance management technology will provide pre-defined templates for all folders and files that should be tracked for File-Integrity, also allowing you to specify additional program folders and files unique to your environment, for instance, your core business applications.

File Integrity Monitoring technology conducts an initial inventory of all filesystems specified and ‘fingerprints’ all files using secure hashing technology, generating a unique checksum for each file. The system will then audit all files being tracked on a scheduled basis every 24 hours (even though the PCI DSS calls only for weekly checks) with any changes, additions, deletions or modifications being reported to you.

The latest generation of File Integrity Monitoring software also operate in a ‘live tracking’ mode for ultra-secure environments where file changes are detected and reported in real-time.
Other options to consider are to track and identify actual changes to file contents, useful when tracking configuration files to provide you with a complete audit trail of change history – this can be applied to any form of files such as text and xml.

Continuous Vulnerability Scanning

All security standards and Corporate Governance Compliance Policies such as PCI DSS, GCSx CoCo, SOX (Sarbanes Oxley), NERC CIP, HIPAA, HITECH, ISO27000 and FISMA require Windows and Unix Servers, workstations, and firewalls, routers and switches to be secure in order that they protect and secure confidential data.

‘Hardening’ a device requires known security ‘vulnerabilities’ to be eliminated or mitigated. A vulnerability is any weakness or flaw in the software design, implementation or administration of a system that provides a mechanism for a threat to exploit the weakness of a system or process. For the PCI DSS, it is a requirement that all ‘within scope’ sites are scanned for vulnerabilities every quarter. This gets expensive in a large scale, multi-site estates, as well as being a time-consuming management overhead.

Perhaps the biggest issue is that the results of any scan are only accurate at the time of the scan – any configuration changes made after the scan could render devices vulnerable and in a worst case scenario, devices could be left vulnerable to attack for a 3 month period. The ideal solution is to continuously track configuration changes. This is the only real way to guarantee the security of your IT estate is maintained. Using continuous configuration tracking technology allows you at any time to see the Compliance Score of any server and which settings need to be changed to re-harden the config. Any changes made should be reported, including Planned Changes which should also be reconciled with the original Request For Change or RFC record.

Secure, Centralized Event Log Management

Log analysis is a key weapon in the fight against any cyberattack. By gathering logs from all unix and windows servers, applications and databases, firewalls and routers, the method and pattern of an attack can be understood. Identifying the method and source of any attack allows preventative measures to be continually improved. This is why all security policies place log retention at their core. PCI DSS compliance requires logs to be gathered and reviewed daily, and retained for at least one year. Similarly for GCSx Code of Connection or CoCo compliance – Audit logs recording user activities, exceptions and information security events are to be retained for at least 6 months.

For any compliance initiative, it will be necessary to gather logs from all
- Network Devices
- Windows, Unix and Linux servers
- Firewall or IPS and IDS devices, Email and Web Servers
- Database and Application servers – even IBM Mainframes
- All other potentially useful sources of log information

Although the scope of most compliance standards will be largely satisfied at this stage, far greater value can be extracted from Centralizing Event Logs. Contemporary event and audit log management technology ensures all event logs are analyzed and correlated automatically, applying a comprehensive series of rules pertinent to any Security or Governance policy. Any breach of compliance will be alerted immediately allowing pre-emptive action to be taken before a problem arises. The best log management solutions provide pre-defined rules templates, allowing you to be in control of compliance straight out of the box.

The following is a checklist of features available in today’s best log management software –
- All Security and Governance Policies supported via pre-packed Compliance Rule Templates
- Real Time Security Warnings i.e. violation of file integrity monitoring rules
- PCI DSS and GCSx Code of Connection supported ‘out of the box’
- Web-based Dashboard and integration with Servicedesk as standard
- Powerful, keyword-based Event Log mining across any combination of devices and applications
- Complete solution for all Security Information and Event Management (SIEM) requirements

The latest generation of centralized log server software allows you to focus on true exceptions and important events by masking off the sometimes overwhelming flood of logs. Use the pre-built Compliance Templates and build your own keyword and logic-based correlation rules, allowing you to manage what really matters to your organization from a security and compliance standpoint.

Change and Configuration Management

ITIL Best Practises identify Change Management as one of the key, central processes that should be understood and assimilated into an IT Service Delivery operation. Change Management as a process is intended to ensure that when changes are made, they are first verified as being completely necessary and adding some value to the organization, and if so, that changes are then well planned, documented and clearly communicated to ensure any potential negative impact from the change is understood and eliminated or minimized. The entire experience and knowledge of the enterprise is harnessed and greater efficiencies can be gained from ‘one visit’ fixes – i.e. a number of required changes can all be delivered during one planned maintenance window. A well maintained Configuration Management Database (CMDB) will often be used as a means of better understanding the ‘downstream’ effects of changes and or their impact on a number of critical business services.

Crucially for any organization subject to Corporate Governance-driven security standards, changes to any IT system can affect its security. Installing application updates may introduce new vulnerabilities and making any configuration change may also render systems less secure and more prone to a security breach. The latest change and configuration management software tracks all changes to your infrastructure, exposing all unplanned changes and reporting clearly on the intended – and uniquely, the actual outcome – of any planned change. All network device configurations are automatically and securely backed up, with the option to remediate any unauthorized configuration change. Server configurations are tracked against either pre-defined security policies or your own personalized policy, with any deviations highlighted.

And once firewalls, servers, workstations, switches and routers are all in a compliant state, you need to ensure they remain that way. The only way to do this is to automatically verify configuration settings on a regular basis. Why? Because unplanned, undocumented changes will always be made while somebody has the admin rights to do so – legal or otherwise! The configuration change tracking solution will alert you when any unplanned changes are detected as well as keeping an audit trail of planned changes, reconciled with the request for change details.

This provides a unique ‘Closed-Loop Change-Management Safety Net’ – when changes need to be made to a device it is vital to ensure that changes are approved and documented – we make this easy and straightforward, reconciling all changes made with the RFC or Change Approval record. An open API allows integration with most service/help desks or other change management systems to establish a link between the change approval process and the actual changes that are made.

Caffeinated Content – Members-Only Content for WordPress

Charles J Denyer asked:




What’s important to note about PCI DSS 1.2 compliance is that its much more than firewalls, routers, switches, and numerous other network devices; commonly called “system components” in the world of PCI.