Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] ISC: Network Infrastructure and Security Controls for IT Audits
Transcript
- Marcus: Welcome back to VoraPrep Audio's Office Hours. Today, we're talking about a topic that can feel a bit technical for many candidates: network infrastructure. Ava: It really can. And it’s easy to wonder, as a future CPA, why do I need to be a network engineer? But the source material for this lesson starts with a story. It’s about a retailer that lost fifty thousand customer records. And it wasn't some super-sophisticated hack. Marcus: Exactly. It was a single, misconfigured firewall rule. Just one line of code. It was changed by accident during a late-night update, and it cost the company millions. That’s why we need to understand this. Our job is to see how the systems connect. We need to spot where a simple failure can become a catastrophe. Ava: So let's start with the basics. We hear these terms thrown around. Information Systems, IT. Infrastructure, Networking. How do they all fit together? Marcus: Let's use an analogy. Think of building a house. The Information System is the entire purpose of the house. It’s the family living inside, the furniture, the meals they cook. It’s the life that happens there. In business, that's your whole accounting system, like SAP. It’s the people, the processes, and the technology all working together. Ava: Okay, the whole living, breathing system. So what's the IT. Infrastructure? Marcus: That’s the foundation, the walls, the roof, and the utilities of the house. It's the hardware and software everything else is built on. The servers, the storage, the core services. Ava: And that leaves networking. Marcus: Networking is the plumbing and the electrical wiring. It’s the part of the infrastructure that lets all the other pieces communicate. Data flows through the network like water through pipes. If the plumbing is leaky or the wiring is faulty, the whole house stops functioning. Ava: That makes perfect sense. The wiring that connects everything. So, when we audit this "wiring," what kind of structures are we looking at? I see terms like LAN and WAN. Marcus: Those are about geographic scope. A LAN, or Local Area Network, is the network inside a single building. It’s high-speed, and the company owns all the equipment. Ava: So as an auditor, I'd be looking at things like physical security for that equipment? Who can get into the server room? Marcus: Precisely. And then there’s the WAN, or Wide Area Network. It connects multiple LAN.s. For example, linking the New York office to the London office. It often uses third-party circuits, like the internet. Ava: Which sounds riskier. The data is going out over public lines. Marcus: It is. So for a WAN, our audit focus shifts. We're evaluating controls like VPN.s and encryption. We need to make sure that data is protected while it's in transit. Ava: The source material also mentions VLAN.s and a DMZ. These feel more about internal architecture. What's a VLAN.? Marcus: A VLAN is a Virtual LAN. It's a powerful control. It lets you take one physical network—one set of switches and cables—and logically divide it. You can split it into multiple, separate networks. Ava: Why would a company want to do that? Marcus: It’s about the principle of least privilege. You can put the Finance department on one VLAN and the Human Resources department on another. Their computers might be plugged into the same physical hardware. But the VLAN.s act like digital walls between them. The data can't cross over. Ava: So if a workstation in HR gets compromised, the attacker can't immediately see or access the finance servers. Marcus: Exactly. It contains the damage. As an auditor, you verify that segmentation is actually in place and configured correctly. Ava: Okay, and what about the DMZ.? That sounds like a military term. Marcus: It stands for Demilitarized Zone, and the concept is similar. It's a small, isolated network. You place it between your internal, trusted network and the untrusted internet. This is where you put your public-facing servers, like the company's website. Ava: So the web server lives in the DMZ. It’s not on the main internal network with the accounting system. Marcus: Correct. The critical rule for a DMZ is this. You should never allow traffic to be initiated from the DMZ to your internal network. Someone on the internal network can request data from the web server. But the web server can't just decide to start a conversation with your financial database. Ava: I see. So if that public web server gets hacked, the attacker is trapped in the DMZ. They can't use it as a pivot point to get to the crown jewels inside. Marcus: That is the entire goal. It's a fundamental preventative control. Ava: To understand how all these controls work, the source material introduces the OSI model. It looks… layered. And complex. Marcus: It can seem that way, but it’s really just a conceptual framework. A map. It breaks down the complex process of sending data across a network. It splits it into seven distinct layers. For us as auditors, it’s a tool. It helps us understand where specific controls operate and where things can go wrong. Ava: Okay, a map. So where on this map do we find controls like physical security? Marcus: That’s right at the bottom, Layer 1, the Physical layer. This is the actual hardware. The cables, the Wi-Fi antennas. Your controls here are things like locked server rooms and secure cable runs. Ava: And what about those VLAN.s we just talked about, the network segmentation? Marcus: That happens at Layer 2, the Data Link layer. This layer deals with how devices on the same physical network find each other. They use things like MAC addresses. Switches operate here. And that's where you configure VLAN.s to create those logical walls. Ava: Okay, moving up. What happens at Layer 3? Marcus: Layer 3 is the Network layer. This is where routing happens. It’s about getting data from one network to another, using IP addresses. This is one of the main places firewalls operate. They filter traffic based on source and destination IP addresses. Ava: So a firewall rule that says "Block all traffic from this known malicious network" is a Layer 3 control. Marcus: Exactly. Then Layer 4, the Transport layer, gets more specific. It manages the connection and uses port numbers. Think of the IP address as the building's street address. And the port number is the specific apartment number inside. Ava: Ah, so that's how a firewall can block everything except for web traffic. It's looking at the port numbers. Marcus: Precisely. It allows traffic to ports 80 and 443 for web servers but blocks everything else. That's a Layer 4 control. The higher layers are Session, Presentation, and Application. They're more about the data itself. They manage the connection, encrypt data with SSL./TLS, and handle user-facing protocols like HTTP for web browsing. Ava: That's a lot to keep straight. Is there a way to remember the order of the layers? Marcus: There is. A classic mnemonic, starting from the bottom, Layer 1, and going up to Layer 7: Please Do Not Throw Sausage Pizza Away. Ava: Please Do Not Throw Sausage Pizza Away. Physical, Data Link, Network, Transport, Session, Presentation, Application. Got it. Okay, that's the model. How do we apply this to an exam question? Marcus: There's a four-step framework you can use for any scenario-based question on network controls. First, identify the core asset and the objective. What are you trying to protect? Customer data? Financial records? And what's the goal? Confidentiality? Availability? Ava: Step one: know what you're protecting and why. What's next? Marcus: Step two: analyze the control's placement and type. Is it a firewall at the perimeter? Is it a VLAN doing internal segmentation? This tells you its intended function. Ava: And step three? Marcus: This is the most critical one: scrutinize the configuration. It’s not enough that a firewall exists. You have to look at the rules. The exam will often trap you with an overly permissive rule. Ava: And the final step? Marcus: Step four is to distinguish between preventative and detective controls. A preventative control, like a firewall rule that blocks traffic, actually stops an attack. A detective control, like a log or an alert, just tells you an attack happened. Preventative is always stronger. Ava: Let's walk through the example from the source material. It's an audit of a firewall for a financial reporting server. Marcus: Right. The server's IP address is 10 dot 10 dot 20 dot 5. And we have three firewall rules. They’re processed in order from top to bottom. Ava: Okay, Rule 1 says to allow traffic from the finance network, which is 10 dot 10 dot 10 dot 0 slash 24. It allows traffic to the financial server on the SQL database port. That seems to make sense. Marcus: It does. The finance team needs to access their database. That rule looks appropriate. Ava: Rule 2 allows traffic from that same finance network to the server's Remote Desktop port. That feels a little risky, letting people manage the server remotely. Marcus: It is risky, and it should be tightly monitored. But it's a specific rule for a specific administrative purpose. It might be a weakness, but we need to see the whole picture. Let's look at the last rule. Ava: Rule 3. Source: Any. Destination: Any. Port: Any. Action: Allow. That… looks really bad. Marcus: It's catastrophic. This is the 'allow any any' rule. Because the rules are processed in order, this is what happens. Any traffic that isn't for the database or for remote desktop will hit Rule 3. And that traffic, from anywhere in the world, will be allowed through. Ava: So it completely negates the security of the first two rules for any other type of traffic. It blows the doors wide open. Marcus: That's why it's the most significant weakness. The tempting wrong answer is to focus on Rule 2, the Remote Desktop access. But the 'allow any' rule is a total failure of the control. A secure firewall always ends with an explicit 'deny all' rule. This is known as default-deny. Anything not specifically allowed is blocked. Ava: You mentioned the difference between preventative and detective controls. The source material highlights a common point of confusion here: IDS versus IPS. Marcus: Yes. An Intrusion Detection System, or IDS, is a detective control. It's like a security camera. It watches the network traffic. If it sees something suspicious, it records it and sends an alert. But it doesn't stop it. Ava: So it tells you you're being robbed, but it doesn't stop the robber. Marcus: Perfect analogy. An Intrusion Prevention System, or IPS, is a preventative control. It sits in-line with the traffic, like a security guard at the door. It not only detects the suspicious traffic. It can also actively block it from ever reaching its destination. For an audit, an IPS is a much stronger control. Ava: Let's shift to wireless networks. They seem inherently riskier. There are no physical cables defining the boundary. What are the key controls there? Marcus: First is the encryption standard itself. The current, strongest standard is WPA.3. Anything older, especially WEP or WPA.2, is not sufficient for a corporate environment. Ava: So WPA.3 is the non-negotiable standard. What else? Marcus: The same idea of segmentation we talked about earlier. If you offer a guest wireless network for visitors, it must be completely isolated. It needs to be separate from the internal corporate network. It should only provide a path to the internet, and nothing else. Ava: And what about for employees connecting to the main corporate Wi-Fi? Marcus: You can't use a single shared password. That's a huge security risk. The standard for corporate environments is WPA.3-Enterprise. It uses something called 802 dot 1 X. This forces every single user to log in with their own unique network credentials. That provides individual accountability. Marcus: Now is a good time for our active learner prompt. Pause and ask yourself: If a company's public-facing web server is compromised, what single network control would be most effective at preventing the attacker from accessing the internal accounting system? Ava: That's a great question. It pulls together a few concepts we've discussed. And it brings up a bigger exam-day tip from the source material. It's not just about knowing these controls exist, is it? Marcus: Not at all. The key on the exam is to think 'configuration,' not just 'existence.' A question might have a distractor that says, 'The company has a firewall.' That tells you nothing. The correct answer will almost always focus on a weakness in the rules of that firewall. The mere presence of a control is not assurance. Its effective configuration is what matters. Ava: So we've covered the core concepts, the OSI model, a practical framework for exam questions, and specific controls for wired and wireless networks. It's a lot, but seeing how it all connects is key. Marcus: It is. The key takeaway is that effective network security relies on the 'default-deny' principle. You have to block everything unless you have a specific, justified reason to allow it. Ava: That's the foundation of it all. Be skeptical of any rule that says 'allow,' and be very skeptical of any rule that says 'any.' Marcus: Great advice. That’s all the time we have for this session. Thanks for listening to VoraPrep Audio's Office Hours. Ava: Keep up the great work. We'll talk to you next time. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.