conducting a security audit question...

I have a question, that I bet lots of people probably have too........when a security professional, or a security analyst conducts an audit on a given company, what are the areas of network security/pentesting that the audit will be based on, and also what are the most common tools employed, would you have to go through huge amounts of log files, and what will the report say?...I know is kind of complex and large question, but if someone with the knowledge and possible the experience could elaborate.

thanks in advance

It depends on what the company wants and what the pen tester can do.

That's like asking someone how to fix a car....

Quote:

---

but if someone with the knowledge and possible the experience could elaborate.

---

Gladly, but only in very general terms as the scope of your question is too large to be answered properly on a forum?

1. An auditor has a "letter of appointment". This document defines:

(a) What the auditor will do.
(b) What the auditor won't do.
(c) What the auditor can do.
(d) What the auditor can't do.
(e) Client responsibilities.
(f ) Payment terms and conditions.

This is agreed with the client and forms a formal contract.

2. There are audits that are either statutorily mandated, or relate to regulatory compliance. In these cases the requirements and activities are defined either by the Law or the rules of the regulatory body. In this context think IRS, SEC, HIAPPA, Sarbanes-Oxley and so forth. ;)

Non-mandatory audits are very much an individual thing. Remember that the auditor has six prime objectives:

1. Get in.
2. Get out.
3. Get away with it.
4. Get the money.
5. Get laid.
6. Get drunk.

In order to satisfy #1 & #4 above, and to prepare an acceptable letter of appointment, it is usually a good idea to start with some sort of risk analysis modelling exercise specific to the target of the audit.

:cool:

nihil. best.answer.ever

Audits are a puppet show based on what nihil says.

One & four? Get in and get the money? Let's not
get carried away.

There's no substitute for good admin. A good admin
will take all the help he can get. Including audits.

There is NO magic (i.e., silver) bullet. Including audits...

Quote:

---

Audits are a puppet show based on what nihil says.

---

Unfortunately so................. there must have been quite a few "puppet shows" at Enron and TK Max for example, as their problems were not one-offs or overnight events? :p:D

The first thing to audit is the security policy. If any 'holes' are found then ultimately it is the security policy that is at fault, or the security policy has not been adhered to....