Question

IT scenario

Please read the following scenario and respond to the questions at the end:

Golf Shoes is a retailer who sells shoes in over 170 stored in the Midwest. Golf Shoes accepts cash and credit cards for payment. They also have a customer loyalty program. To enroll in the customer loyalty program the customer must provide their name, home address, phone number, and date of birth.

Golf Shoes data center is located at their headquarters. Data backups occur based on a defined schedule that includes full backups at weekend and incremental backups during the week. For each backup cycle, two backups are taken where one backup is sent to DASD located in the Gulf Shoes data center while a second backup occurs to tape.

Golf Shoes has contracted with a 3^rd party to secure tape backups offsite. A courier daily arrives at 9 AM in an armored truck to pick-up and deliver backup tapes from the offsite facility. As the courier arrives at Golf Shoes they will scan each tape that is dropped and picked-up for inventory purposes. The courier will then sign for the tapes and transit the tapes to the offsite facility. At the offsite facility, the courier will then rescan each tape to ensure it is delivered and then staff at the off-site facility will secure Golf Shoes tapes in a separate area locked room that only houses Golf Shoes tapes. Annually, Golf Shows auditors will perform physical inventory of tapes at the offsite location.

A Tape Management System (TMS) is used to initiate and perform all backups. A schedule in TMS is used to create the timing and type of backup. TMS maintains a log of all backups that occur either successfully or failures. TMS console is monitored such that alerts are sent to the problem tracking system which is reviewed, and action is taken to remediate any issues. TMS maintains an inventory of all backups that occur. TMS tracks tape usage and age. All tapes sent or retrieved from the offsite facility are logged into TMS using a scanning device. Golf Shoes does periodically randomly test restores of backup tapes.

Access to TMS is restricted to only authorize personnel. Authorization to TMS must be approved by the Vice President of Infrastructure. Access to TMS is reviewed quarterly and access requires an ID and password to access TMS. TMS will also manage the encryption of any credit card and loyalty program customer data prior to it being loaded to tape.

Please respond to the following questions:

1. Please list the business risks (versus IT risks) associated with Golf Shoes backup procedures. Please list 2 risks only. (2 points)
2. Please list 3 controls for each risk noted. The control cannot be written generically but must use portions of the narrative and written per the business scenario. For example, a generic control is “Users are authorized to systems.” versus the business scenario noted above “Users are approved for access to TMS by the Vice President of Infrastructure.”
3. Please list 3 audit tests for each control presented in 2.

Provide 1 recommendation to improve the process.

Answer 1

Business Risk	IT Risk
If any type of customer data loss or leak is out in the market or media then this will be harsh of their reputation.	If any tape is destroyed or damaged during transportation than they can lost customer informations.
"The time is money" this pharse suits here. they lacking large time in transportation and all. They also use more man power which is costly.	They are using very old technology. The data can be transferd through internet with safty. Physical medium may take more time due to any reseons like traffic, vehicle problem, etc.

Controls for Risks:

1. Company should use latest technology and resources by this they save their time as well as money.
2. Audits should be analysed by superior persons of the company.
3. Tapes should check when company receive and use it after in their system, because they can be damaged of some virus may destroy data.

Audit Test:

1. Company may analyse the time and money use in both cases that is physical tape transportation and digitally transfer data through internet.
2. Audit person may cheat company, that's why companey should analyse the audit as well.
3. If tape which company receive at their data center has some issues and if person use it in company's data center then it nay damage or destroy data of customers.

Recommandation:

Company should use new technologies like cloud storage. This will save time as well as money of the company.

Thank you for asking!