Question

Problem 2. DATA CENTER SECURITY The auditors of a financial Investment firm located in Tulsa, Oklahoma, have serious concerns regarding the computing facilities of their client. They point to the following key issues:

·        The company's data center is in the basement of a rented building. Company management believes that the location is secure enough to protect their data from physical threats.

·        The servers are housed in a room that has smoke detectors and associated sprinklers.

·        Client investment and account information are stored on these servers. This information includes the total value of the portfolio, type of investments made, the income structure of each client, and associated tax liabilities.

The auditors are concerned that these practices are inadequate and that more secure alternatives should be explored. Management has expressed counter concerns about the high cost of purchasing new equipment and relocating its data center.

Required:

a.      What risks currently exist that are of concern to the auditors?

b.      Describe control features that contribute to the physical security of the computer center.

c.       Discuss some options open to company that may reduce their operating costs and provide the security the auditors seek.

Answer 1

a. The risks that currently exists and to which auditors are concerned is the security risk.

According to the auditors, the the data center and the server should be made to be placed at a place which is secure enough to contribute in data security.

Auditors do not feel that basement and a rented house property is a safe place to keep data information which is right as these data contains high secured informations relating to companies.

And any leak of information would bring company in trouble. Thus auditors do not want to take chance for data mishandling and data being revealed to unauthorized sources.

b. The control features that contribute to the physical security of computer center are :

• The networks or servers in the centers should be strongly password protected so that no one other than the people authorized to use the server can be able to operate with the server.
• In the center only individuals who are concerned with the auditing and need to operate in the centers are provided with the system passwords and should have been given the assess and no one else.
• There should be detective controls installed in all systems to detect any activity as soon as it takes place and verify if it's done by the company officials or some outsider. This would also check that the entries in the system are done right or not.

These control features would contribute to physical security of computer center.

c. Options to reduce operating costs in opening a company in order to increase security are :

• There should be minimum systems installed which are necessary and no extra system required if they would not be in use. As it would give ni profur and will require cost in installing.
• Materials and equipments that were used in previous centers and which can be transfered without any loss to new centers should be made to transfer as manufacturing same would cost more.

These are the options to reduce the operating cost of new center.