Information Systems Operations

0:01In IT, there's lots of different types of technologies that we deal with on a daily basis. And some of these technologies actually introduce risk into our environment. So let's take a look at some of these technologies, and the risks they introduce, and what controls that we can put in place to protect us from those risks. Starting off, we're looking at some general architecture. We have first of, client server architecture, and that's where we have a client here, and a server over here, in the server houses, some kind of application or data, could be web or email or just files.

0:34And our clients over here, like our workstation, goes out to the server to access those applications, or that data. And this is a very common architecture within, pretty much, every business out there. Now, these most often run on a Windows or Linux operating system on our workstation, could be like a desktop, or it could be a laptop, as well, doesn't matter. Then, the other type of architecture we're going to discuss is mainframes. Now, these are used to house big data, they crunch a lot of data, they house a lot of data, and they have specialized operating system.

1:09And most of them are based off of Unix. So here's kind of a little image of a mainframe, they're generally pretty big, and there's lots of processing and compute within those mainframes. So they can handle all of that data, and provide us the information we need from it. So those are a couple of generalized types of architecture that we see in IT. Now, moving on USB devices. Now, there's USB keyboards, USB mice, USB everything under the sun, but what we're most concerned with are things like USB sticks.

1:44Where we plug them in to a computer, or it could be a USB drive, but either way, they house data, and they allow us to transfer data from one point to another. Now the problem with that is, there could be viruses on them, because if one has a virus, you might not know it. And as you go from computer to computer and plug it in to move data around. Well, guess what, you're infecting each of them, and that is definitely not a good thing. So that's something to keep in mind.

2:15What about data theft and data loss? Both of them dealing with, either theft of a device with data on it, or loss of a device or data on it. Well, that affects the confidentiality of that data, as well as the availability. So there's something that we need to keep in mind. The other thing is data corruption, It can happen as we move these USB sticks and drives from device to device, they can become corrupted, and then affect the availability of that data. Now what are some controls that we can put in place to help protect from some of those risks.

2:50Well, we could use encryption, because if we encrypt the data that's on this drive, and is lost or stolen, well, that data is not compromised. So that's a good thing, and that's what we want to achieve. Then, we have training, because we need to train people on how to use these properly, and what data they can store on them, because that goes straight to policy. What are our organizational policies about USB devices? Maybe, we can't use them at all, so there are no USB devices.

3:21Or if we do use them, then we can't store sensitive information on them, or they can't leave the organizational premises. And those are policies that we will put in place to help address those risks. And those policies need to be relayed to the end users through things like training. So you can see, training and policies, go hand in hand. And lastly, we're looking at hardware maintenance and hardware monitoring, because maintenance and monitoring also go hand in hand.

3:53So we have maintenance programs, and that's so that we can provide maintenance to our indoor workstations, and our network devices, and our servers, where the data is housed, so that they can live long, healthy lives, and they can be available for us. We talked about the CIA triad, that availability-- they can be available for us, by reducing the risk of downtime. So if you're an auditor at an organization, and you're looking at the maintenance program, well, first of all, you need to make sure that a formal maintenance plan exists, because without one, well, then, it's going to be hit and miss, and that's not a good thing.

4:31We also need to make sure that maintenance is logged, so it's documented, that it was completed. And we also need to look at maintenance budgets, because, if you see the budget out of control, well, that means that there's, probably, procedures not being followed. And that's because when a maintenance plan is created, a cost plan is created along with it. So we look at what maintenance will cost, and we make sure that maintenance cost doesn't exceed the amount of risk that we have, with a certain device. Because if I have a $500 switch in my environment, I'm not going to spend $5,000 a year on maintenance for it, when I can simply just get a second switch, and have it as a spare device.

5:11So cost overages can definitely indicate a lack of adherence to procedures. Then, we have hardware monitoring, because we need to monitor our hardware to make sure it's functioning properly, make sure it's available, make sure there's not errors in it. So we can do that with things like availability reports to make sure it's available, we can see it's uptime. We can identify hardware errors, and we can check out the asset management reports. You've got to have an asset management program in place, so that we know what devices are in our environment. So we can, number one, make sure they're available and being monitored, and make sure that maintenance is being performed on.

5:47And lastly utilization reports, we need to know the amount of resources being utilized in our environment, so that we can make sure that we have enough available to meet our business objectives. I hope that this has been informative for you, and I'd like to thank you for viewing.

0:01In IT environments, we work with lots of different assets. Such as servers, and network devices, and people. And a key role in IT, is to manage those assets to make sure that they last a long time and that we address any risk they introduce to the environment. But we can only do that if we know of all the assets that are there through some type of inventory. So let's take a look at asset management. So starting off, let's define what an asset is. So that's just something of value that's worth protecting, right?

0:33So that people, finances, because if we don't have finances we sure can't be in business. Our reputation, super important. Information like our data. And of course, architecture. We're talking about our workstations, and our servers, and all of our network devices, all of the infrastructure that makes up our architectures. And those are some of the assets we deal with on a day to day basis that will be part of IT Asset Management. So before we can actually protect any assets we have to identify them.

1:06We have to know what they are. So some of the things we would want to identify would be things like, who is the asset owner? How do we identify them? Is there an ID number or a serial number? What is their value to the organization? How much did we pay for it? What's it worth? And how about if we lost that device if it quit functioning what impact would that have to our organization? We need to know where it's located at? And then if there is a security classification identified with it, such as confidential or internal only then we need to know that as part of our asset inventory.

1:42Speaking of asset inventory we can either build that manually or we can use some tools. And I'd prefer to go the way of tools. So one of them that we can use is the Microsoft SCCM or you could also use something like Spiceworks, which is a free tool that you can use to manage your assets and identify what's out there in your environment. So again, you can use tools or it can be done manually, but either way it needs to be done. So as we create this asset inventory it's actually going to be the first step in lots of different processes, such as our software license management.

2:19Because we need an inventory of all the different software in our environment, so we can make sure that we have licenses for each of them. And data classification, again, we're looking to find out what is out there. So we can have an inventory of all the different types of assets, such as data and we can properly classify them. And then, of course, as I mentioned at the get go. We cannot protect an asset if we don't know it exists. So that's why IT Asset Management is such an important process in our organizations.

2:51I hope it has been informative for you and I'd like to thank you for viewing.

0:01Many years ago, I was introduced to scripting and poor Hellboy, that day a light went off of my head. And I thought I'd hit the jackpot. Because I could write scripts that could automate all the tasks that I had to do on a day to day basis that were so tedious. So let's take a look at job scripting, and automation, and what benefit it brings to us. So starting off, we're looking at jobs scheduling and that's simply scheduling some software to run scripts or batch files or batch jobs to accomplish some tasks in here's key an automated fashion.

0:39So this way, all those little tidious tasks that we have to do from day to day we can write a script that does those tasks and then we could schedule those tasks to run at periods throughout the day. Now a key to keep in mind when doing that is we need to ensure that resources are given to the higher priority jobs. And that way those that aren't so important can kind of happen after the super important tasks run. Then the other thing is that jobs need to be scheduled based on complexity and requirements, those two things.

1:16Complexity and requirements and let me explain why. The more complex jobs are most likely going to require more resources. So we see complexity canon maps over to resources. And that's why complexity is there. But what about requirements? Well, if I write a script, that say it goes out and it makes a list of all the directories on a volume. So I have all these different directories and then I have another job and it goes and it grabs this file and it goes through and run some tests for each of those directories in that file.

1:51Well, that's a requirement. I first have to have this file before the second job can run and do work against each directory listed in that file. So there some requirements or prerequisites that jobs will need to have. Now moving on, we look at job scheduling software because we can do all of this manually, but tell me tell you what, it's a pane to do it manually. Because once you really get into and you start thinking of all the things you can automate, then you're mainly going through and creating each these re-entering the same information over again, setting time, making sure things don't conflict.

2:30There's lots to take into account when you're doing the automation. So it's a great idea, not just a good idea. A Great idea to use some type of software. It provides us with many advantages, such as you only enter that data one time, then it's in the system and you can simply select it you'd want to retype it in. The other thing is intelligence within the jobs. Now we took the example over here where we created a file with one script that listed out all the directories on a volume. And then we had another job that did work on all of those listed directories.

3:06Well, if this job didn't happen, if something happen and this completely failed well, the secondary job down here, it can't run at all. And that intelligence can say hey, job 1 did not complete successfully. So therefore I'm not going to run any jobs that had job one as a prerequisite. So that's where the intelligence comes in handy. The other thing is human operators. We need to reduce our reliance on them if we can, because we are human, we make mistakes, and mistakes are not necessarily a good thing.

3:40But if we use a software program to do this forth, once we program it correctly one time it can rerun those same jobs without any errors. So we can reduce the number of errors in our activity. And lastly, these applications will create audit logs for-- so that we can look at all the activities that were performed by the system to make sure they happen correctly, we can have it create reports for us. And we can also oftentimes have it send us notifications if jobs failed.

4:13And that's why the job scheduling softwares are so done handy. I hope this has been informative for you. And I'd like to thank you for.

0:01When you were a kid you ever played the pass the message game. You know where you'd line up a bunch of people, the first person whispers a message into the second person's ear, and then that message is relayed down the line of people. Now we know that at the end that message is never the same message that we started with. Well systems pass information back and forth between each other through their system interfaces. Now let's take a look at how we can manage these system interfaces so that we can ensure the message we end up with is the same message we started with.

0:34So looking at system interfaces. This is where the data output and data input happens. So we have one system sending data to another system, and the key is we want to make sure that the data that was sent from system 1 over here as it sent is the same message received over its system 2 because that way we trust the data we know it's accurate and complete. Well how can we do that? Well, we can use input controls.

1:05One type of input control is a checksum. Then a checksum is a value that represents the data that was transmitted or a message really. So if we have a message over here and it's full of information we can run that through a mathematical formula and output what's called a hash value also known as a checksum, which is just a value, it's a bunch of numbers or letters that represent that data.

1:37And that way when the second server receives that message they run this or read the message they received through that same mathematical formula and their hash or checksum should be the same. And if it is then we know our system too knows that data is the same message that was transmitted. And that is a type of input control known as a checksum. Now organizations need to have a process or a system in place to monitor all the transfers that's happening between these systems, and it's for a specific reason or actual several reasons.

2:20Number 1, so we can see all that data transfer activity while it's happening, and there's going to be a record of that activity. Such as this who sent it? And who received it? What time did it happen? What date? What kind of data was included in it? Was there a checksum, because there should be, And what was that checksum? So this gives us records that we can go back and look at if there is a problem because if there's not a along with what happened and there's a problem then it can be really hard to figure out what the root cause of that problem was and to fix it.

2:54And it also provides a way to audit the data transfer activities so that we can verify things are working properly. Speaking of audit well, what should auditors do when looking at these system interfaces and programs used to track these system messages or transmissions. Well, first of all, you need to make sure that there is a program because if there is not that's always step 1, make sure you've got a program in place is going to track those system messages or transmissions that happen.

3:25Then we need to make sure that when that data is transmitted from one system to another, if it's going through like an internet let's say, where it could be seen by other organizations that it is encrypted appropriately. So there should be some type of encryption process that's happening to make sure that data is secured and cannot be read by anyone who might have access to that data as it traverses the internet.

3:56Now, this might not always be required. But it's something to keep in mind when you're dealing with sensitive types of data. The other thing is we need to verify authentication is used when appropriate. What I mean by that is when this system is sending data across to this system over here, how does this system too over here know that system 1 is who it should receive the message from? Well, oftentimes there's some type of system identifier that is sent along in those message transmissions.

4:29So if we were to look at a message transmission it might have as part one like a system identifier in one area of the message and then it could have the destination server as another part so it knows that when this one receives the message over here, it looks at the SID, the system identifier of the sender, and it says oh, yes, I know this sender and I am supposed to receive messages from it. Then it might look at the destination the server identifier which would be of this server here that matches from here, and it says yes that is me so I'm going to accept that message and I will now process it.

5:11And that could be a type of authentication. So authentication is oftentimes used and we need to make sure when appropriate it is used as well as, of course encryption that we talked about. . And that we have a program into place to track all that communication between the systems I hope this has been informative for you. And I'd like to thank you.

0:01Have you ever had a great idea for a computer program. But you're not a developer, so you don't know how to code it and the idea just goes by the wayside. Well the good news there's a type of systems called end user computing and they allow non developers to create applications. Well, that is not necessarily a good thing because some of those applications fall outside of the management of IT and the support of IT, so that causes problems. So let's take a look at what we should consider when managing end user computing.

0:33So end user computing as I said allows for non developers to create their own application. So that's really cool and can be super handy, however, it does bring some additional risk with it. Because again some of these applications will fall outside of the support of IT meaning IT is not included in the daily support of these applications. And that means we end up with these applications that might not be secured properly. The data that they hold might not be backed up, and the people who do support them the user who created it might not practice change management, so that could cause a loss of availability of this application.

1:16And the coding itself could contain errors since it was developed by machine and there wasn't a lot of input from an actual coder. So they have goods and bads you know, pluses and minuses. And we need to understand that so when we have these systems in our environment that we can manage them appropriately and here's key manage that risk that they bring to the environment. So as it pertains to these end user computing systems management needs to be involved and they need to determine the criticality of the application.

1:53Because if that application really does provide some special source to the business or the organization, it needs to be supported it needs to be backed up. You know we need to make sure the data in it is classified properly, we need to make sure there's proper maintenance being done to it. There's lots of things in the more critical it is, the more we attention we need to pay to it and make sure that it's supported. They also need to make sure the application is subject to any data classification policies that are in place.

2:24Because if it does hold sensitive data, it needs to be managed appropriately and data classification comes into play. And of course when we're talking about security of applications we have controls and we need to make sure that these EUC end user computing applications have the same control lists for them. Like input controls, and output controls, and authentication controls you know we can go on and on, but they need to have the same controls as all the IT supported applications because they are important to the business and the business objectives.

3:00So as an auditor what should you be looking for? Well, as an auditor you should be looking to make sure that there are end user computing policies in place. They need to be specific policies around in user computing, what is acceptable use of these systems, and what kind of information needs to be recorded about them. Who needs to know about them. When you create a new EUC application do you need to let IT know so they can add it to the data backup jobs? It's things like that.

3:31We need to have policies and procedures in place around in user computing. And then, of course, we have to have an inventory of these EUC applications. Remember a couple of videos back, we talked about asset inventory, well. These EUCs are going to be assets and we need, to have them inventoried so that we can make sure they're accounted for and they're being supported properly. And that is end user computing. I hope those has been informative for you, and I'd like to thank you for viewing.

0:00Data is a key part of many businesses and users of that data need to have confidence in the fact that that data is accurate and complete. And the only way we can do that is through managing the data. And we do that via a process called data governance. So let's take a look at data governance and data lifecycle. Data governance, if we were to say what that is in a nutshell, it's the management of data so that the users who use that data can absolutely have confidence that it is accurate and complete.

0:34And that is a key point there, accurate and complete. So that's what data governance is. Now, what that does is provide us with some things. It allows us to see and understand that this information or data is being managed through decision making. That means that the data isn't left on its own to do whatever it does. It's that management is there, they're looking at data. They're making decisions based on that data and how it's reacting to the environment.

1:09Now other than that, data governance make sure that that data that you have is meeting stakeholders needs. That means that the business is going to be able to meet objectives and use that data effectively. And lastly that the data is monitored. And when we're monitoring data, we're looking for performance to make sure it's meeting performance needs. So it's not slow for users. It's not full of a bunch of errors. And we're also looking for compliance. Now that compliance could be for sensitive data, and we have to make sure we're meeting certain regulatory compliances for that data.

1:44Or it could be that we have internal requirements so that our data must be accessed within certain time frames, or it has to be very speedy in with response time. And we could be monitoring data for those types of compliances as well. Now as an auditor, you should be looking at data quality because we need to look at that quality. And what I mean by data quality is that the data doesn't have errors.

2:17It's complete and accurate in itself. And the reason we need that quality to be there is because if it's not, the organization isn't going to be able to meet its objectives. And we said this throughout the entire course, it's all about business objectives and making sure that every different piece of the organization helps or aids the business in meeting those objectives. So as an auditor, we need to be looking at data quality so that we can make sure it's up to par so that the organization can use that data to meet its objectives.

2:52I mentioned we're going to look at data life cycle, and that's what we're looking at here. Now it's actually a five step life cycle, and it starts with planning. So in planning, we need to understand how that data is going to be used. Are we going to classify it? And is there a value to that data, meaning is that maybe our secret recipe that has 18 herbs and spices. And that's what makes our business so successful, and that's what makes it special. That's our IP or Intellectual Property.

3:25So at that point, there is a value to it. It could be, not necessarily, it doesn't have to be a recipe. It could be a way that we create something. Other people create it, but we create it in such a way that it brings additional value to our customers. And that brings value to us and the products we provide. So that's planning. We have to figure out what kind of data do we want, and what kind of classification and value is it going to provide. Then we need to either create, meaning build, or acquire this data.

3:55So we're going to create it, or we're going to go out and purchase the data. So now that we've planned for the data, we know what we're looking for, we have to create it or go and get it, or acquire it. And once we do that, then we can start to use the data. We store it in our systems. We share it between users and maybe between business partners. And of course, we use that data to provide something, perform some functionality. And once we've done that, then we're looking at the monitoring part of the lifecycle. And we're making sure that that data continues to work properly.

4:28And we talked about this in the last slide, where we're looking at management and making decisions around the data so that we can make sure it is maintaining its accuracy and completeness. And so that's where the monitoring comes into play to make sure that we can monitor data so that we can tell if there's changes that might be harming the data. And we can address those to make sure that data stays pristine for us. And lastly once we're finished with the data, we can either retain it by putting it into some type of archive, or we destroy it because we no longer need it.

5:02And that is the data lifecycle. I hope this has been informative for you. And I'd like to thank you for viewing.

0:01Every time you log into a computer, you're interacting with the operating system, which is the base of the computer system. And I'm sure you've heard lots of different types of operating systems, like, Windows and Mac and Linux. And there's others as well. So let's jump in and take a look at some of these operating systems and the importance that logging plays in the management and security of these systems. So the operating system is basically the foundational layer of code that runs on computers.

0:32And it gives users access to applications, which is key. Now, some different operating systems are Windows, Macs, and there's Android, and there's Linux, which you see represented by the penguin. Now, earlier videos, we talked about the client server architecture where we had workstations that connected and communicated with servers that housed applications and data. And we said that the workstations generally run Windows or a Linux operating system.

1:06And then we also talked about mainframes, where they handled the big data and they did lots of processing analytics, and that those generally ran on Unix systems, Unix operating systems. Now, software controls in parameters come into play when we're interacting with these operating systems. For example, they enable features, like, activity logging that is so important. And they enable other features, too, like turning printers on or configuring them, setting a wallpaper for your desktop environment, and other things, like, setting network information, network addresses, and such.

1:44So you can do lots of features and parameters can be set within your operating systems to provide different services. Now, as I said, the activity logging is one of them. And that is very important to remember. Now, you can also modify resource management, such as the power settings, like, on your workstation. You might set the power settings so that when your computer is inactive for a certain amount of time, the hard drive doesn't turn off. So that's an example of some of the resource management options that you have within operating systems.

2:18Now, operating systems logging is super important, like I said. It helps us to identify errors and malicious activity. And some of that malicious activity could be things, like, what users access to what application or data. And it could be what remote devices has a computer talked to. And that's good to know because if a computer is infected with a virus or a worm and is communicating with other hosts on the network, well, we can use the logs to try to identify where on the network that those viruses or worms have replicated to.

2:56And it also allows us to look at applications and what resources those applications have accessed. And that's important because applications can be compromised. So if I have an application installed on my computer, well, that's a program running on there. And this program here could be infected by a bad guy. And if it does, then that bad guy can use that application to access things on that computer and on the network. And it's not like a user account is doing this.

3:29It is the application itself being used as a tool by the bad guy. So that's why it's important that we're able to look at application access to resources as well as user access to resources. Now, I'm not sure if you know this or not, but most systems, like, servers on a normal infrastructure-- if you turn logging on, like, the security logging we talked about, they can easily log 10,000 events every day. And that is super easy.

3:59A lot of them will log more, like, 30,000 events per day. And that is too much for a single person to look through and identify some malicious activity or errors, right? That's just way too much. And that's just one server. Imagine if you had 100 servers. We're looking at millions of log entries every day. Well, there's a system called a SIEM. That's a security information and event management. And what that does, it's a system that you set up or you can have hosted or you could pay as a service.

4:33And what that does is all of your system logs, like, from your servers and your network devices and firewalls and such, get fed into the SIEM. And this SIEM is designed to ingest those logs and perform analysis on that data and look for malicious activities and suspicious activities and errors and alerts. And it can send notifications out a lot of times via email or through different types of communication programs to admins to let them know that something suspicious or an alarm or an alert has been identified so that we can act on it.

5:12And that system that does that is referred to as a SIEM. So the SIEM helps us to ingest and analyze all those hundreds of thousands or millions of entries of logs every day because we know we can't do that as a person. And those are some of the things we need to consider when looking at operating systems management. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00Every time you install a software, there's an end-user license agreement or EULA to agree to. And the EULA is how software vendors legally protect their applications that they produce and distribute. So let's take a look at some different types of software licensing. With software licensing, well, that's how software vendors protect their products via copyright laws and such. And there's a couple of different types of licensing agreements.

0:31First of all, we have the free. Hey, hey, I love me some free software, as long as it's software, not full of viruses and such. And those types of software are known by a couple of different names. The first of which is open source. And I'm a huge proponent of open source software. There's lots of great products out there that are open source, which means they are free. And here's the other thing, not only are they free, but the source code is openly available.

1:02So you could get a copy of the original source code, and you can edit it and make changes to it, and look at it and make it your own. You can do something called forking. And when you fork, you take the original code in there, and you just kind of tweak a little bit of it. Let's say, this bit here, we're going to change it up to meet our needs. And what we end up with is a new product that has a lot of the old code in it but also our new code, and this is a new fork. But basically open source, it's really great stuff.

1:35And it's well supported by the community, the open source community. And a lot of times is more secure than a paid closed source application because so many people actually get to look at the source code and identify problems with it. Then there's also freeware, and that's basically just free applications. You don't necessarily get the source code with that. And then we have shareware, and those where applications are freely available and shared amongst users, and again source code may not be involved with that.

2:08Then we have the paid version of software. So oftentimes when you're getting a licenses for paid software, you have to decide on what type of license you want. For example per seat, where it could be actually per computer that's there. So you could have one computer, and you license it on that computer and 10 different people use it but only one at a time. And that's because it's one computer, and it's one license. You might have to license it per CPU. Like in the past, I know Microsoft SQL has been licensed per CPU.

2:42So for example, if you had a server with four CPUs in it, you have to buy four CPU licenses to run it on that server. Otherwise you wouldn't be able to take advantage of all four of those CPUs. And these licenses change all the time, so you have to check with the vendors to see what they're using it at that point in time of purchase. But there's also concurrent users, which is a number of active users at the same time. We run into this on terminal servers a lot of times, which is a server that people remote into.

3:13So you might have a bunch of people at workstations, especially if they're working from home, and there's a server in the cloud. And they use something like remote desktop protocol to connect to it. And they run a desktop in that environment up there. And there might be 30 people on that server. So there are 30 concurrent users that could use that software. So you have to understand that there are different types of paid licensing. There's also one called enterprise or site license. And that's just generally a flat fee, and it's as many users as you want to use it within your organization.

3:50So that's a couple different types of software and some more explanation about each, you got free and paid. Now as an auditor, thinking about as an auditor, when you're looking at an organization and you're auditing their licensing. What do we need to be looking for? Well that's a great question. Well first off, we need to get a list of the software that that organization has. Because if we don't have a list that's showing all the different software they have, then how do I know what software to look for and to check for licensing.

4:22Now once I have that list in like step one, I need to go through step two. And I need to go through and verify that there is a license agreement for each of those software. So it could be an open source agreement, or it could be a paid agreement. It could be per seat, concurrent users like we talked about, or an enterprise or site license. It could be any of those. But basically we need to go through and check those often, and make sure there is a license agreement for each of those softwares. Then what we can do is if we have time, we can go out and we can from our computer, we can scan the network looking for softwares that are out there in the environment.

5:03So we can kind of make our own list, and we can match it up with the list they provide to see if we can find something that's not on their list. And that's something that we might do is to go ahead and scan the network and look for other softwares. And of course lastly, we're going to note any discrepancies or violations that we find, and we're going to report them. So really, we're looking to make sure that the customers that we're auditing, they have a list of software and license agreements for each of them.

5:34I hope this has been informative for you, and I'd like to thank you for viewing.

0:00For organizations that write applications, it's very important to ensure that the code is properly managed. And one of the ways we can do this, is through the use of a version control system. Now, these version control systems help us manage the code, and reduce the risk that's associated with managing and writing of code. So let's take a look at these version control systems, and the advantages that they provide us with. Well first of, whenever we're dealing with source code, we may need to, from time to time, use a software escrow.

0:34And that is a third party, who will hold on to software's source code, as a trusted third party. Now, this is associated with basically, purchasing applications from third party vendors. And the whole idea of the software escrow is to address the risk of the vendor going out of business. Let's say, for example, we go and buy this new great software from vendor A. And vendor A, six months later goes out of business.

1:12Well, now what? We just spent all this money on this new software product, but now, we don't have access to the source code, so we can't continue to make changes or edit this application as we see fit, to meet our business need. And that is a big sad face. So how can we avoid the risk of that happening? Well, we use what's called a software escrow, I just mentioned. And again, it's a trusted third party, that the source code gets sent to and they hold onto it.

1:44And that third party will not release that code to us, unless certain events happen, such as a vendor going out of business. And that helps us to reduce the risk of purchasing closed source software, which is software that we don't have access to the source code. But in this case, if the vendor did go out of business, we would have access to it through that escrow. Now, if we're writing applications in-house, we should be using a version control system, also known as a code repository.

2:17And these are super important, because they help reduce the risk associated with managing code. They provide us with lots of benefits, such as, some of these advantages. Such as, tracking changes that have been made to code, because every time change is made, we need to track it, so we have different versions. It allows us to have multiple people working on the same area of code at the same time, so that's concurrent coding. It allows us to roll back and go back to different versions of code that we've created in the past.

2:53It also allows us to manage something called branching. And that's when we take a piece of code, and we change a little bit of it. And now, we end up with a new piece of code. So this could be branch A, and this is branch B, and now we have a new branch of code. And that's what branching is. So let's take a look, over here on the right here, we have an example of kind of a central version control system, that's our VCS here. And you'll see down here, we've got workstations, so we've get three different coders or developers, working on some code.

3:27And up here is our central repository. And the way this works, they can all be working on code, and as this says, this workstation A over here, will have A, B, and C. A, goes and makes a change in the code, and adds the letter X to it. Well, once they commit that, it goes to the repository, and the repository pushes that update down to the other workstations. So they can continuously get updates to the code that they're working with. In that way, they're able to see the changes as they happen.

4:00And this is very important, and super handy for managing code. Now, as an auditor, what should you be concerned with, and looking to evaluate with version control systems? Well, first of all, who, as in, what developers, and what managers has access to code? Because only those who need access, should have access. You don't want your entire organization to have access to this code, because that is not good security practices. Now, the other one is, who can commit code, which means put it into production.

4:33Only certain people should be able to put code into production. And that's, for an example, you don't want all developers to be able to put new code into production, because if they were untrustworthy, they could make changes and deploy them into production and cause harm. But we have processes to prevent that, right? So you might have a group of developers who have access to the code, but then only managers can actually deploy the code. So when a developer makes code, or creates new code, they send it to the managers, who run it through test to make sure it's OK.

5:10And once it's tested, it gets deployed. Or there could be a group of testers, who are kind of the middle person, developers send to the tester, tester sends it to management for the OK, and management deploys it. Either way you don't want the developers deploying it themselves, there should be a process in place to make sure that those applications are tested, before they're deployed. And that's what we're checking for as auditors. And then, of course, make sure that they're using change management procedures. And that goes back to making changes, if we're making changes, we need to make sure they're tested and verified, before they're pushed out.

5:45And then lastly, we want to make sure, that the code is being backed up, it's being sent off-site for off-site backups, or a copy is being put into escrow, maybe. It all depends on the situation, but we need to make sure backups is happening. Now, here's one key, I want you to understand for sure. As auditors, when we're auditing a VCS, we are not, and this is a very important, look down here at the bottom. We are not concerned with who made an error in the code, or who did a coding error.

6:16We are focused on process and use of the VCS itself. So if you were there auditing, and somebody says, hey, there's a problem with the code. Well, you're not concerned with who did that, who caused that error, and who, maybe, needs additional training in the coding and processes. You are concerned, as an auditor, with the process of using that VCS, making sure that it's being used properly. And that's your role, when it comes to auditing VCS.

6:48I hope this has been informative for you, and I'd like to thank you for viewing.

0:00When it comes to our vehicles, we all keep an eye on our fuel gauge, because it's the fuel that makes our cars run, whether it be petroleum base or electricity. So we practice capacity management by managing what's in our fuel tanks. And the same thing is true for IT. We must provide capacity management services to make sure that our resources are there, and we have enough to meet our business objectives. So let's take a look at capacity management. So what is capacity management?

0:33Well, it's pretty simple. It's basically, managing, monitoring and planning of our compute and network resources to make sure that we have enough of it. We need to make sure we have enough resources, so that we can meet our day to day needs, and we can look to the future needs, and see if we have enough for upcoming projects. So there's some benefits that we get from capacity management. The First of which is cost savings. And that cost savings is because we can make sure that we're only making necessary expansions or purchases to our infrastructure.

1:10If we're practicing capacity management, we know when we need more resources. So if we don't need it, then don't spend it, and save that money. And that's where cost savings comes into play. The second benefit is resource planning, looking to the future. If I can look and say that I'm at 50% utilization today of my resources, and I know that our projected growth is X. Then I can say, hey, looking forward, we won't need to upgrade our servers or network for a good 30 months, but once we hit 30 months, we're going to be at capacity, and we're going to need to upgrade.

1:52What does that allow us to do? Well, it allows us to budget and plan appropriately to help our business succeed. And that's where resource planning comes in. So the overall goal of capacity management is to make sure that IT has all the resources it needs, to meet our business objectives. And by doing this planning, we can ensure that that will happen. Now, what are some of the things we want to monitor when we're performing capacity management?

2:22Well, we want to look at resources, like our CPU, our memory, how much storage are we using? What kind of bandwidth are we using on our network and telecommunications? These are all things we need to be monitoring. We also need to look at number of users in our environment, because if I can say, for every one user in our environment, we increase 0.2% of our resource utilization, that will help me forecast for user growth. Or I could look at the number of applications that are in use, and I can do the same thing.

2:55Maybe for every application, we increase by 5% resources. So I can use that to help me forecast, and plan for the future as needed. Moving on. Some of the things that we can look at, when we're doing the capacity management, we talked about storage. Well, when we're looking at storage, there's a couple different types. We've got server storage, and that's where you have a physical server, and it has a set number of drive bays in it, it may have four disk bays. Well, if I've got four drives in there already, well, it doesn't give me room to add more drive.

3:29So it's not going to be quite as flexible as something like a Storage Area Network or a SAN. Now, a SAN, is generally a bay of disks, it may have 16 disks in it, or it may have 24, they have different sizes. And you can hook them together to expand your storage. So you might end up with four chassis, or eight chassis, just depending on however many you need. And your servers will access this storage area network via a couple of different ways.

4:05It could be over the network, via something called iSCSI, or it could be a direct connect, via Fiber Channel, to a Fiber Channel switch. But either way, your storage resides in this storage area network here, and your servers will connect to it, and use that storage. So you've got server storage, which is a little limited, and then, you have your SAN, or storage, or network, where you can easily expand to hold more drives and more data. Then we look at CPU and memory. Now, we're going back, and we're going to take a look first, at just a standalone server.

4:38Well, they come with a motherboard in them, it holds most of the components that make up the computer. So you would have sockets for your CPUs, and slots for your memory to be plugged into. Well, that is a finite set of resources. When you purchase a server, it has X number of CPUs sockets, and X number of memory slots, once they're full, you can't add more. Now, you may be able to increase to faster memory, and faster CPUs, but that's going to be a limitation of your motherboard, and what it can do.

5:11So what I'm saying is, when you're dealing with a standalone server, you are, somewhat, limited on your expansion capabilities. Just like you were with storage. However, you can use something called a blade server, and that's something like this over here. Where each one of these blocks here-- let me use a different color. Each one of these blocks that you see here, is actually a separate motherboard, with CPU and memory slots on it. So we can actually add more cards as we need more resources.

5:42Now, there, again, is a finite number of cards you can have, yes. But the idea is you could start out with two cards, and then you add them as you need more. So that's an option when you're looking to expand or grow your capacity for CPUs in memory. Then we move on to network. And over here, we have a couple of switches. We got one here, that's switch one, we've got switch two down here. Now, when we have a connection between them, it may be a 1 gigabit connection, and that 1 gigabit gives us a gigabit speed.

6:16Well, what about when we saturate that? We are using like 900 Meg on a normal basis. Well, guess what, that's almost a gig, and it's going to start to slow things down. So what can we do? Well, in most switches, you can actually run another connection, or up to like eight connections, and you can use the coding within the switch, to do what's called, bonding of those connections. So if you did two of them. Now you would have a 2 gigabit connection.

6:46And you'll see when I'm going here-- what if we added four of them? Then you'd have a four year connection. So that you can increase the bandwidth available on the backbone of your environment. So that is something you can do in a network to help increase your available bandwidth without purchasing new equipment. Well, what about telecommunications, like our internet connections? Or we might have MPLS connections between sites or something. Well, at that point, we just need to purchase more bandwidth, because we don't manage our telecommunication providers environment.

7:23So we just have to go to them and look at what options they have. And it's probably just going to end up spending more money to get additional bandwidth. And that's how we can work with capacity management. I hope this has been informative for you, and I'd like to thank you for viewing.