Resources

Due to our society’s increasing interconnection, protecting one’s digital identity has become increasingly important. The authentication approach is often regarded as the most crucial component of information security since it serves to authenticate an individual’s stated identity. The most often used authentication mechanisms are multi-factor authentication (MFA) and single-factor authentication (SFA). 

• Single-factor Authentication (SFA): The traditional SFA authentication method, is based on a single, commonly recognized piece. Individuals may recognize, or have easy access to, this specific element. The data in question could be a personal identification number (PIN), a password, or any other type of information that is unique to the person doing the authentication.
• Multi-factor Authentication (MFA): As its name would suggest, MFA requires two or more factors for access. For this reason MFA is regarded preferable to SFA for enhanced security. The attributes of authentication are typically classified into three main groups: possession (also known as ownership), knowledge (also known as cognition), and biometric (also known as intrinsic traits).

To protect the security of one’s online presence, it is critical to have a thorough grasp of the advantages and disadvantages between the many solutions accessible. A brief comparison analysis of the benefits and downsides of these authentication methods warrants a self-evident conclusion: SFA is the most viable authentication approach but has the most drawbacks.

Single-factor Authentication (SFA): The Weakest Link

SFA is the most viable authentication approach due to its simplicity. Users are only required to enter a single piece of information, such as a password, in order to obtain access to their accounts. Despite its widespread acceptance and ease of use, SFA has some important drawbacks:

• Risk of Password Breaches: The weakness in SFA’s security is its password management system. Passwords have become a prominent target for hackers due to their susceptibility to misuse, theft, or compromise via data intrusions. If a password is overly simple or commonly used, its strength may be undermined.
• Limited Security: Because of its single ingredient, SFA can only provide limited protection. If an adversary successfully discovers the password, obtaining unauthorized access would be simple.
• Lack of Adaptability: The SFA needs to react more effectively to the ever-changing terrain of developing issues. The current level of security needs to be improved to combat the two sophisticated attacks of credential stuffing and phishing.

In view of these urgent threats, businesses are rapidly adopting MFA as a more reliable security approach.

Multi-factor Authentication (MFA): Layered Security

Implementing MFA improves security by adding levels of protection to solve the shortcomings of SFA. When users must meet multiple conditions, enemies find it much more difficult to get unauthorized access. Additional benefits to MFA include:

• Enhanced Security: The use of MFA improves security by requesting the user to prompt multiple authentication factors at the same time. If a potential unauthorized user possesses only one of the crucial elements, such as a password, their ability to gain access to the system is reduced.

• Resistance to Phishing: When done correctly, MFA can effectively prevent fraudulent attempts. If the user unintentionally discloses their password, the offender will have difficulties accessing the account without additional verification measures, such as a fingerprint or a paired smartphone. Despite the possibility of password leakage, the use of these supplemental components is still required.
• Adaptive Security: The MFA program is capable of adapting and responding to various risk conditions. In the event a login attempt comes from a suspicious device or location, MFA can be enabled.

Common Mistakes in Installing Multi-Factor Authentication

Although MFA is recognized to considerably improve security, organizations should avoid making the following mistakes:

• Weak Recovery Processes: Employers have the burden of ensuring secure access to user accounts, even when one of the authentication components is unavailable. More mechanisms for recovering lost or stolen accounts may expose a system to security risks if not properly secured.
• Inadequate or Lack of Training: Inadequate MFA implementation can cause user confusion and displeasure. These difficulties can be avoided with proper user education. MFA program participants require extensive rules and thorough education.
• Limited Device Options: Companies must provide a comprehensive range of MFA device solutions in order to meet the diverse demands and preferences of their clientele. This requires several authentication methods such as text message codes, mobile authenticator apps, biometrics, and hardware tokens.
• Complexity of Implementation:  The effectiveness of overly sophisticated MFA systems is likely to be reduced. When it comes to accessing their accounts, the smooth coexistence of security and usability should not impose additional costs on consumers.

Balancing Security and User Experience

MFA provides a strong security mechanism; nonetheless, organizations should remember the importance of addressing the user experience. Users are likely to be dissatisfied if MFA solutions prove difficult to use or involve an excessive number of steps. The ideal balance between user experience and data security is critical in the effective deployment of MFA.

Conclusion: The Power of Multi-Factor Authentication

MFA has evolved into a dependable protection for our digital identities in the digital world resulting from the rising diversity of cyberattacks. This is because MFA needs the confirmation of many data elements. MFA fortifies a system’s defenses and boosts its resilience against a wide range of attacks by requiring the usage of several authentication factors.

Although single-element authentication is widely used, it is incapable of withstanding the frequent and sophisticated attacks that are common in today’s culture. Therefore, MFA should be part of every individual’s and organization’s security policy.

References

Cherry, D. (2022). Multi-Factor Authentication. In Enterprise-Grade IT Security for Small and Medium        Businesses: Building Security Systems, in Plain English (pp. 83–96). Berkeley, CA: Apress.

Karie, N. M., Kebande, V. R., Ikuesan, R. A., Sookhak, M., & Venter, H. S. (2020, March). Hardening SAML by Integrating SSO and Multi-Factor Authentication (MFA) in the Cloud. In Proceedings of the 3rd International Conference on Networking, Information Systems & Security (pp. 1–6).

Sharphathy, M. N., & Sumalatha, V. (2023, July). SSS-EC: Cryptographic-based Single-Factor Authentication for Fingerprint Data with Machine Learning Technique. In 2023 2nd International Conference on Edge Computing and Applications (ICECAA) (pp. 308–315). IEEE.

As colleges and universities continue to experience a changing operating environment and the world experiences political and economic challenges, higher education institutions are looking for ways to gain efficiencies within their processes and procedures. At the same time, in the past year, the world has been introduced to astounding technological advancements with the public launch of ChatGPT and availability and improvement of similar Generative Pre-Trained (GPT) Transformers.

As institutions are identifying ways to leverage technology in many areas of operations, Internal Audit also has the opportunity to enhance the efficiency and effectiveness of its work. The use of technology and data analytics have transformed the internal audit function by enabling data-driven insights into new and emerging risks, productivity gains with the automation of labor-intensive audit tasks, increased risk coverage, and repeatable processes for continuous risk monitoring.

The Evolution of Internal Audit

Internal audit functions play a crucial role in ensuring the integrity, compliance, and effectiveness of an organization’s operations. However, Internal Audit is no longer tasked with simply performing evaluations and assessing the effectiveness of risk management, control, and governance processes. Internal auditors are now being tasked with playing a more active role in guiding executive decision-making, leveraging data to identify anomalies and vulnerabilities as well as identifying opportunities to optimize operations across the organization. Further, the nature of risks or activities in which internal audit engagements have become more dynamic and complex.

With the rapid advancements in technology and the rise of artificial intelligence (AI), internal auditors now have powerful tools at their disposal to enhance their work. Today’s technology and digital tools can be utilized throughout the internal audit lifecycle: from information gathering and goal setting, development of risk assessments and audit plans, assessments of plans, performing audits, and reporting results. Automated workflows and data visualizations have improved the process to be more cost-effective and collaborative to allow for more informed decisions.

Leveraging Technology for Internal Audit Effectiveness and Efficiency

When fully integrated, technology tools can be embedded into all elements of the audit lifecycle providing valuable efficiencies and risk insights in the areas below:

Planning & Scoping

Auditors can use technology tools to provide a deeper view of risk when conducting annual audit planning or in scoping each individual audit:

• Enterprise Risk Assessment and Audit Plan Creation: AI and GPT tools can be used to brainstorm risk areas or industry challenges or assist in creating questions to ask in risk assessment surveys or interviews. Data analytics can be leveraged to help institutions quickly gain insights into enterprise risks and controls, and to prioritize management’s actions by analyzing historical risk factors or identifying areas of lesser controls or ineffectiveness. Technology tools can also be leveraged to provide data visualization of key performance indicators (KPIs) that more readily identify outliers or target areas of greater performance challenges.
• Audit Planning: Like the items noted above, technology tools can be leveraged for planning specific audits as well. Providing deeper insight into transactional information to better understand key operational activities and risks involved in the audit area allows auditors to prioritize and focus efforts. Further, GPT-style tools can help auditors to develop draft audit plans and identify work steps.

Fieldwork

Technology tools can deeply enhance and streamline fieldwork activities, primarily through leveraging data analysis. Examples below highlight how analytics can be used across a number of common audit areas to provide greater coverage and visibility, with the potential to leverage such actions either for building continuous monitoring programs or for completing distinct audits within the plan.

• General Ledger Close and Financial Reporting: Analysis of journal entry data can assist institutions in quickly identifying unusual and unauthorized journal entries, automate completeness tests, and prioritize reviews based on risks.
• Payroll: Payroll data can be visualized to obtain a high-level overview of payroll activity by employee, level, and location including deductions, pay rates, and overtime payments. Testing can be automated to identify payments made before hire date or after termination, excessive overtime per pay period and off-cycle payments.
• Travel and Entertainment Expense Process: Analytics on travel and expense data can help institutions perform a more targeted and automated review of employee expenses by reviewing data by employee, period, and expense type. Search functions and drill down capabilities can help identify excessive spending, inaccurate or duplicate submissions, and non-compliance with company policy. Results can also be used to select a more targeted sample for detailed testing.
• Vendor Master Management: An analytic of vendor master data can provide insights into top vendors, inactive vendors, and vendor data integrity. Predetermined tests can identify vendors with missing, inaccurate, or duplicate data which may lead to an inefficient business process or potential fraudulent business activity. 
• Accounts Payable Process: Data analytics enables institutions to quickly identify inaccurate or duplicate payments, invoice processing delays, segregation of duties conflicts, and distribution of invoices processed and paid for a scope period. These results allow management the ability to drill down to root cause and perform timely resolution of risk areas.
• Research Expenditures: Expenses charged to sponsored research activities can be reviewed to identify cost allowability concerns or provide opportunities for stronger risk identification. Tools can be deployed to evaluate against common standards (such as the Uniform Guidance or institutional policies) as well as built to leverage system data to check against items like an award’s specific budget.
• System Access: Data analytics can be leveraged to ensure user access to enterprise systems is accurate and adherence to corporate policy is managed correctly during employee terminations and transfers.
• Fraud Detection: Machine learning algorithms can learn from historical data to detect new and emerging fraud patterns, enabling auditors to stay ahead of fraudsters. By leveraging AI for fraud detection, internal auditors can enhance their ability to identify and investigate potential fraud, ultimately safeguarding the organization’s assets and reputation. 

Reporting

• Drafting Reports: GPT technology can be used to write first drafts of audit reports or details for specific findings and recommendations.
• Action & Issues Tracking: Analytics can be leveraged to continuously monitor audit issues and action plans to drive behavioral change with how issues are remediated.
• Executive Reporting: The use of technology can optimize Board and Audit Committee reporting on the status of the overall internal audit program to guide executive decision making.

The integration of technology and AI tools in Internal Audit has the potential to revolutionize the profession. Advancements in digital technology can empower institutions to conduct detailed self-audits at regular intervals and continuously monitor risk in a timely, cost-effective, and collaborative manner.

However, internal audit functions must carefully consider how and where they deploy technology tools, especially GPT-type assistance. After attending the recent AuditCon in Miami and hearing the Tuesday morning keynote session from Paul Roetzer, it is clear that with great power comes great responsibility. Users of AI and other technology aided audit processes must ensure there is proper governance in place to support the use of such tools. Internal audit functions must consider any risks associated with the use of tools or other policies or restrictions implemented for their organization, and always remember that GPT-style tools are merely another tool in an auditor’s toolkit and not a fully vetted answer. Challenges include relevancy of data (most tools were last trained on comprehensive data sets from 2021) and accuracy and verifiability of the results provided. Additionally, many data analytics technologies or machine learning models require specialized skillsets and knowledge to appropriately design and deploy.

While the rapidly evolving enhancements to technology capabilities present a bevy of opportunities to increase audit efficiency and effectiveness, it must be done in a thoughtful and intentional manner to best elevate your specific audit function.

Audits tend to fall into two categories: process and departmental. Process audits focus on a single university process using a highly unique audit program. These often involve many clients and can take a lot of time. Departmental audits focus on a single client. These tend to be shorter engagements with repeatable processes, with the intent of systematically providing similar coverage for all departments. This article focuses on IT tests that can be applied at the departmental level by both IT and non-IT auditors.

Challenges in Creating a Departmental IT Program

The first challenge faced when creating an IT audit program for use in repeatable departmental audits is making assumptions about the computing environment. A typical office has numerous devices including laptops, desktop computers, and potentially tablets. The environment may also involve remote work, capabilities, employee-owned smartphones, one or more printers, workgroup storage, essential applications, a local network, internet access, and a source of technical support.

The next challenge is aligning information security goals to the environment. While our emphasis tends to focus on the disclosure of sensitive information, auditors should also consider the impact of disruptions to the availability of data and the computing environment. Auditors should be willing to look beyond cybersecurity to the physical world. Information on paper can be equally sensitive and unauthorized physical access to computers is undesirable.

Another challenge revolves around defining accountability for the state of the computing environment. Auditors may discover the business unit believes the IT department is responsible while the IT department believes it is the business unit’s responsibility. In reality, the responsibility is shared. The business unit establishes goals, manages day-to-day operations, and delegates technical issues to the IT department. The ultimate responsibility for securely handling sensitive information belongs to the business unit because they control the entire process.

Simplified IT Audit Tests

 What follows is a brief discussion of a number of tests that can be part of an IT audit program for a departmental audit that could be structured in a way to not need an experienced IT auditor.

Computer Inventories – A maxim posed by the Center for Internet Security is “you cannot manage what you don’t know you have.” Conducting an inventory can determine if the client is aware of      their entire computing environment. There can be computers that were never registered with IT and do not receive periodic updates. There can be computers transferred between departments that still show on the original department’s inventory. There can be mothballed computers which still contain sensitive data sitting on shelves or forgotten in closets with weak physical security. By rigorously maintaining an up-to-date inventory, organizations can ensure every component of their computing environment is accounted for and secured.

Review Installed Software – Collaboration with the IT department is crucial to reviewing installed software. Once an accurate inventory of computers is established in systems such as Microsoft Endpoint Configuration Manager (MEMCM) and/or Jamf (for Mac/IoS devices), those systems can provide lists of software installed. You can compare installed versions of operating systems and software packages to what is currently supported by their vendors. You will have to select software packages to monitor. Packages of concern are usually browsers (Chrome, Edge, Firefox, Safari, etc.) and applications used to interact with Internet content, such as Adobe Acrobat and other PDF readers.
You may find there is no existing standard embodied in your University’s policies or in industry best practices. In such cases, auditors must establish their own criteria. For instance, you may wish to accept that 90% of the installed browsers must be either the most current version or a version that was supported within the last 60 days. Achieving 100% compliance is impractical due to inevitable exceptions and the volume of ongoing updates across a sizable computer population.

The best results from this test will be realized over many departmental audits, perhaps combined with a periodic University-wide IT General Controls audit. While a one-time cleanup is beneficial, a sustained and widespread series of audits yields more substantial long-term benefits.

Auditors may find it best to partner with an Information Security Office to interpret the results. It is important for non-IT auditors and client departments to recognize that automation is the key to applying updates at scale. Reliance on manual updates is untenable across large populations of computers due to the sheer volume of patches required.

Review Service Level Agreements and Contracts – Internal agreements and external contracts that apply to computing devices or services can indicate who is responsible for maintenance and how frequently the maintenance should take place. Maintenance is important in eliminating known vulnerabilities. The lack of internal agreements is not necessarily an issue by itself as many internal processes are informal. The lack of a contract with an external source would be unusual.

Websites – Departmental websites present two principal risks: unintentional disclosure of sensitive data and non-compliance with accessibility standards. In both cases, specialized tools are needed to make an assessment because of the volume of pages and documents to be reviewed. A tool like Spirion can crawl through websites looking for unprotected sensitive data.

An audit function can partner with an accessibility office who might have a tool to generate accessibility reports that produce a scorecard to compare to Web Content Accessibility Guidelines (WCAG) and organizational goals. Auditors are likely to need assistance from an accessibility specialist to interpret details of the report. Expect accessibility issues to be persistent, expensive, and dependent on tools and vendors.

Social Media – A department may manage numerous social media accounts across various platforms. Additionally, there may be old or forgotten accounts, which can pose challenges in terms of tracking and management. Sometimes, the credentials for these accounts may be lost, especially if the individual managing the account has left the organization. In such cases, the recovery of account access might require collaboration with the legal department.

To ensure proper use of social media accounts, it is beneficial to conduct regular audits comparing account activity to the standards set by the University’s communications team. This can help identify any discrepancies or areas of non-compliance.

However, departments must also be mindful of privacy and reputation management. Sharing sensitive or inappropriate content can lead to privacy breaches. Additionally, how a departmental account interacts with individuals, such as students, on social media can impact the department’s image. For instance, a departmental account following students and engaging with their personal content could raise concerns and should be approached with caution.

Public Computers – Departments often provide kiosks and public computers to enhance customer convenience. A frequent issue arises when all users share a common account, potentially leaving files, including those with sensitive data, accessible to subsequent users. Additionally, there is the risk of these public computers being used for unintended purposes.
Conducting an audit on public computers need not be a complex task. Simple checks, such as inspecting download folders for sensitive data and testing browser settings to assess access to potentially inappropriate content, can yield valuable insights into the security and proper use of these resources.

Physical Security – The replacement cost of a computer may only be a few thousand dollars, but the value of sensitive data it holds could potentially lead to millions of dollars in damages if compromised. Additionally, the theft or vandalism of computing equipment can result in significant productivity losses due to the unavailability of essential tools.

Enhancing physical security doesn’t necessarily require advanced penetration testing skills. Simple tools such as traveler’s hooks, J-tools, and under-door tools, which can be acquired for around $100, can be used to assess the vulnerability of doors. Furthermore, conducting an after-hours walkthrough can reveal unlocked doors and windows, highlighting areas in need of improved security measures.

It’s also crucial to evaluate the management of physical keys, including maintaining an up-to-date inventory and records of issued keys, to ensure that only authorized individuals have access to secure areas.

Adding basic IT tests into departmental audits creates a repeatable process that increases your IT coverage across campus.