ElectronicCommerce Infrastructure and Security Management-第八讲.pdfVIP

IS6523/6522: Electronic Commerce Infrastructure and Security Management Session 8: Control and Audit (II) by Dr. Daniel Tse 1 Application Controls •Boundary •Input •Communication •Processing •Database •Output 2 Boundary Controls • They are used to identify and authenticate users and to assign them action privileges • Several types – Cryptographic controls – used to protect integrity of data used within the boundary – Access controls – used to prevent unauthorized access to and use of resources – Events in the boundary must be recorded in an audit trail – Existence controls – used to restore the boundary subsystem in the event of failure 3 Input Controls • Data codes are used to identify an entity uniquely or to identify an entity as a member of a group or set; poorly designed codes are error prone, poorly designed codes cause recording and keying processes to be inefficient • Check digits are redundant digits added to data codes that enable the accuracy of other digits in the code to be checked. When the code is entered, a program recalculates the check digit to determine whether the entered check digit and the calculated check digit are the same 4 Input Controls (Con’t) • Batching is the grouping together of transactions that bear some type of relationship to each other. 2 types of batches – Physical – in which transactions in the batch constitute some type of physical unit – Logical – in which transactions in the