INTEGRITY AND INTERNAL CONTROL IN INFORMATION SYSTEMS V

Transcription

1 INTEGRITY AND INTERNAL CONTROL IN INFORMATION SYSTEMS V

2 IFIP - The International Federation for Information Processing IFIP was founded in 1960 under the auspices of UNESCO, following the First World Computer Congress held in Paris the previous year. An umbrella organization for societies working in information processing, IFIP's aim is two-fold: to support information processing within its member countries and to encourage technology transfer to developing nations. As its mission statement clearly states, [FIP's mission is to be the leading, truly international, apolitical organization which encourages and assists in the development, exploitation and application of information technology for the benefit of all people. IFIP is a non-profitmaking organization, run almost solely by 2500 volunteers. It operates through a number of technical committees, which organize events and publications. IFIP's events range from an international congress to local seminars, but the most important are: The IFIP World Computer Congress, held every second year; Open conferences; Working conferences. The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high. As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed. The working conferences are structured differently. They are usually run by a working group and attendance is small and by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is less rigorous and papers are subjected to extensive group discussion. Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers. Any national society whose primary activity is in information may apply to become a full member ofifip, although full membership is restricted to one society per country. Full members are entitled to vote at the annual General Assembly, National societies preferring a less committed involvement may apply for associate or corresponding membership. Associate members enjoy the same benefits as full members, but without voting rights. Corresponding members are not represented in IFIP bodies. Affiliated membership is open to non-national societies, and individual and honorary membership schemes are also offered.

3 INTEGRITY AND INTERNAL CONTROL IN INFORMATION SYSTEMS V IFlP TCI1 / WGI1.S Fifth Working Conference on Integrity and Internal Control in Information Systems (/I CIS) November 11-12, 2002, Bonn, Germany Edited by Michael Gertz University of California at Davis USA... " Springer Science+Business Media, LLC

4 Library of Congress Cataloging-in-Publication Data A C.I.P. Catalogue record for this book is available from the Library of Congress. Integrity and Intemal Control in Information Systems V Edited by Michael Gertz ISBN ISBN (ebook) DOI / Copyright 2003 by Springer Science+Business Media New York Originally published by Kluwer Academic Publishers in 2003 AII rights reserved. No part of this work may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, microfilming, recording, or otherwise, without written permission from the Publisher Springer Science+Business Media, LLC with the exception of any material supplied specifically for the purpose ofbeing entered and executed on a computer system, for exclusive use by the purchaser of the work. Printed on acid-free paper.

5 The original version of the book frontmatter was revised: The copyright line was incorrect. The Erratum to the book frontmatter is available at DOI: / _16

6 CONTENTS Preface Acknowledgements vii ix Part One. Refereed Papers 1 1. Concurrent Checking of Global Cross-database Integrity Constraints 3 Stefan Bottcher 2. Increasing the Accuracy of Time-tabled Condition Monitoring 21 Binling lin and Suzanne M. Embury 3. Designing High Integrity Systems Using Aspects 37 Geri Georg, Robert France, and lndrakshi Ray 4. Towards Effect Preservation of Updates with Loops 59 Steffen lurk and Mira Balaban 5. Application Controls in a Client/Server Environment 77 Fred de Koning 6. Protecting Java Component Integrity Against Trojan Horse Programs 99 Marcel Winandy, Armin B. Cremers, Hanno Langweg, and Adrian Spalka 7. Information Security: A Corporate Governance Issue 115 Elmarie Kritzinger-von Solms and Leon A.M. Straus Part Two. Invited Papers The Very Brief History of Digital Evidence Standards 137 Mark M. Pollitt 9. Multi-representation: A New Paradigm for Databases 145 Stefano Spaccapietra, Christelle Vangenot, and Christine Parent 10. The Impact of Web Services on Audit 151 Cristina Buchholz

7 Vl Integrity and Interna[ Control in Information Systems Part Three. Vendor White Papers Integrity Mechanisms in German and International Payment Systems 175 Detlef Kraus 12. Monitaring Mission Critical Data for Integrity and Availability 189 Michael Gertz and George Csaba Part Four. Totorial "The Subversive Spreadsheet " Stop that Subversive Spreadsheet! 205 David Chadwick 14. A Typical Model Audit Approach 213 Grenville ]. Croll Part Five. Panel Opportunities and Challenges in Tracing Security Breaches 223 Michael Gertz Erratum to: Integrity and Internat Control in Information Systems V EI Index of Contributors 227 Index of Keywords 229

8 PREFACE Today's information system infrastructures are becoming more and more complex. The increasing demand for extensible, Web-aware, and scalable information systems has spured the development of numerous new forms of middleware layers and information system architectures. Naturally, the development and integration of integrity and internal control mechanisms into such systems is a challenge for researchers, IT personel, and auditors. Among other information security issues, this international working conference explores recent developments in integrity and internal control research currently conducted in academia and industry. In particular, the goals of this conference are to address the following issues: what are the new challenges IT industry is facing in ensuring the integrity of mission critical data managed in their information systems; what are the status and directions of research and development in the area of integrity and internal control; where are the gaps between business needs on the one hand and research / development on the other; what needs to be done to bridge these gaps. The contributions to this fifth working conference have been organized into the following sections: Refereed papers. These are papers that have been selected through a blind refereeing process by an international program committee. Each paper has been reviewed by at least three reviewers. Invited papers. Well-known experts in the area of information systems security present practice and research papers upon invitation by the program committee. Tutorial. Two papers describe the challenges and approaches to deal with integrity and internal control issues in spreadsheets. Vendor white papers. Vendors of software products dealing with data integrity requirements present the background and philosophy of their products. Panel discussion. We want to recommend this book to researchers conducting work in the area of information systems security, IT auditors and security specialists, who want to learn more about the various business concerns and requirements related to integrity. The reader will also value this book for the excellent papers presenting research in new techniques and methods for designing and realizing integrity and internal control mechanisms in a variety of real world settings.

9 Vlll Integrity and Internal Control in Information Systems It is the hope of the conference organizers, sponsors and authors that these proceedings will inspire readers to join the organizers for the next conference on integrity and internal control in information systems. You are invited to take the opportunity to contribute to next year's debate with colleagues and submit a paper or attend the working conference. Check the websites given below regularly for the latest information. We thank all those who have helped to develop these proceedings and the conference. First of all, we thank all the authors who submitted papers as well as the keynote and invited speakers, and those who presented papers and participated in the panel. Finally, we would like to thank all conference participants, IFIP and the sponsors and supporters of this conference. November 2002 Michael Gertz IFIP TC-ll Working Group IFIP TC-ll IFIP

10 ACKNOWLEDGEMENTS Conference Chair: Armin B. Cremers, University of Bonn, Germany Program Committee: Chair: Michael Gertz, University of California at Davis, USA Members/Reviewers: David Chadwick, University of Greenwich, UK Sushi! Jajodia, George Mason University, USA Udo Lipeck, University of Hannover, Germany William List, Wm. List & Co, UK Patrizia Asirelli, Istituto di Elaborazione dell'informazione, Pisa, Italy Rainer Manthey, University of Bonn, Germany Hartmut Pohl, Fachhochschule Bonn-Rhein-Sieg, Germany Kai Rannenberg, Goethe University Frankfurt, Germany Isabel Muench, BSI - Bundesamt fur Sicherheit in der IT, Germany Indrakshi Ray, Colorado State University, USA Arnon Rosenthal, The MITRE Corporation, USA Adrian Spalka, University of Bonn, Germany Leon Strous, De Nederlandsche Bank, The Netherlands Bhavani Thuraisingham, MITRE and National Science Foundation, USA Oliver Weissmann, atsec information security GmbH, Germany Organizing Committee: Adrian Spalka (Chair), University of Bonn, Germany Hanno Langweg, University of Bonn, Germany Organized by: IFIP TC-ll Working Group 11.5

11 x Integrity and Internal Control in Information Systems Sponsored by: IPLocks Inc. ( SRC Security Research and Consulting GmbH (src-gmbh.de) ThunderStore ( Supported by: BSI Federal Office for Security in Information Technology (Bundesamt fiir Sicherheit in der Informationstechnik, Germany) GI-SICHERHEIT Security Group -- Protection and Reliability (Section of the German Computer Society, Fachbereich Sicherheit-Schutz und ZuverHissigkeit) ISACA Information Systems Audit & Control Association, German Chapter