Section: Information System Operations, Maintenance and Support

Explanation/Reference:
Explanation:
The best way to ensure confidentiality and integrity of data is to encrypt it using virtual private network (VPN) tunnels. This is the most common and convenient way to encrypt the data traveling over the network. Data encryption within the application is less efficient than VPN. The other options are good practices, but they do not directly prevent the loss of data Integrity and confidentiality during communication through a network.

Explanation/Reference:
Explanation:
From an IS auditor's perspective, the primary objective of auditing the management of service providers should be to determine if the services that were requested were provided in a way that is acceptable, seamless and in line with contractual agreements. Minimizing costs, if applicable and achievable (depending on the customer's need) is traditionally not part of an IS auditor's job. This would normally be done by a line management function within the IT department. Furthermore, during an audit, it is too late to minimize the costs for existing provider arrangements. Subcontracting providers could be a concern, but it would not be the primary concern. Transferring knowledge to the internal IT department might be desirable under certain circumstances, but should not be the primary concern of an IS auditor when auditing IT service providers and the management thereof.

Section: Protection of Information Assets
Explanation:
Parameters allow a standard piece of software to be customized for diverse environments and are
important in determining how a system runs. The parameter settings should be appropriate to an
organization's workload and control environment, improper implementation and/or monitoring of operating
systems can result in undetected errors and corruption of the data being processed, as well as lead to
unauthorized access and inaccurate logging of system usage. Transaction logs are used to analyze
transactions in master and/or transaction files. Authorization tables are used to verify implementation of
logical access controls and will not be of much help when reviewing control features of an operating
system. Routing tables do not contain information about the operating system and, therefore, provide no
information to aid in the evaluation of controls.