IT Audit checklist

Question

I recently have taken on the position of a one man show for a company that is going to have an audit. The network isn't anywhere close to prepared and I have been looking for a general audit checklist since one hasn't been provided by the auditors and haven't found much good information out there. Does anyone have a nice template that will give me a good starting point. I know that this will be highly customized to the company but a starting point will be helpful to outline to management just how much work is needed.

Thanks,

Answer 1

I have been looking for a general audit checklist since one hasn't been provided by the auditors

That is disappointing. I did this for quite a few years, and it was common practice for us to provide a detailed overview of what would be assessed and why (methodology). We submitted formal requests for information, provided tools for the IT staff to run and collect data, including any potential impact of the collection process (if any). We also had to schedule meetings complete with detailed agendas, which usually meant they knew what to expect. There's no constructive purpose served in sandbagging someone in an initiative like this. Issues are usually aplenty, and most IT staff are open to discussing them if the engagement is kicked off properly.

That said, there are plenty of checklists out there if you look. But the primary goal of this effort should be to surface as many issues as possible, prioritize them, and develop action plans for remediation. I wouldn't be too concerned about being "prepared". Since you have started recently, there should be an understanding that the place didn't fall apart overnight.

If the network that you acknowledge is in need of improvement receives a good report, that would probably be a waste of the company's money.

Answer 2

I'm going to make a rash assumption and assume that you're asking about how to prepare for an internal security audit with a focus on technology, perhaps even a penetration test.

How you prepare for a security audit on the technology side is going to depend on the goal of the audit. If the goal is for it to define the specification for how you improve your infrastructure, you might do nothing. If the goal is to insure that no gaps remain, I'd recommend performing a gap analysis before the audit and correcting any gaps discovered.

For fundamental IT best practices I'd recommend referencing the PCI DSS. Of course, it includes obvious things you should be doing already like patching your software for security vulnerabilities.

To replicate a security audit I'd start with reviewing the penetration testing methodology detailed in the Open Source Security Testing Methodology Manual. (OSSTMM)

If you are looking for further details, I would encourage you to re-write your question to be less ambiguous.

Answer 3

When you're building machines out you should make sure you hit as many points in the NSA's security guide as is practical (some things may be overkill for your situation):

http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/

And when you do set up machines, you should do so in an automated fashion to each is a cookie cutter of every other to start with. Building "by hand" via installation media can be error prone where you miss things.

Automate! Automate! Automate!

Any semi-regular procedure should be scripted as much as possible. This includes system installation, patching, vulnerability scans/audits, password strength testing.

Answer 4

I recommend you to spent some time reading COBIT, that is Control OBjectives for IT. In fact it's used by many auditing companies to audit IT area.

I also recommend you to use tools such as nessus (that will check your network/servers for vulnerabilities) or mbsa (microsoft baseline security analyser), but it will only check windows hardware.

Since you asked for a starting point, I think this could help you.

Answer 5

In my experience when an audit is requested without specifications it generally means an asset audit. This is the worst kind because you then need to find out exactly what the company does have and perhaps whether it's legitimate or not.

Personally, I like to point out that the term "audit" is generic and requires elaboration. I officially do nothing more till I get further and a clearer direction. Unofficially I get real busy and try to make sure anything under my control that could be audited is in as good a shape as I can make it, just to be sure my butt is covered. Then, when I find out what they are actually after, I hand them the most relevant of the audits I have previously prepared on the quite.

Answer 6

It isn't practical to go to each machine to make sure its fully updated. This is why OpenVAS exists(OpenVAS is the new free version of Nessus). You can tell OpenVAS to scan every machine on your internal network to identify problem areas. You also need to run it remotely to get an idea of your remote attack surface. You will find problems with your firewall rule sets and machines that are vulnerable to attack.

Answer 7

I would be looking to put together a statement of how you do business. What the current process (if any exists) and what it should/will be future. If it was a penetration test or security type audit they would have told you that and it wouldnt have reach across other departments. probably also need to be prepared to talk about how you can support regulatory compliance for other business units depending on the regulations your company might be under.