18
votes

I recently have taken on the position of a one man show for a company that is going to have an audit. The network isn't anywhere close to prepared and I have been looking for a general audit checklist since one hasn't been provided by the auditors and haven't found much good information out there. Does anyone have a nice template that will give me a good starting point. I know that this will be highly customized to the company but a starting point will be helpful to outline to management just how much work is needed.

6
  • 3
    What type of audit? There's a multitude of things that could be audited.
    – Warner
    May 17, 2010 at 20:04
  • I would love to know that as well but I haven't been able to get any responses from the auditors to get an idea of the scope.
    – PHLiGHT
    May 17, 2010 at 20:11
  • 5
    Financial audit, security, process and controls audit.. some audits wouldn't even fall under the average IT purview.
    – Warner
    May 17, 2010 at 20:17
  • 2
    If they haven't asked you for documentation they can't be auditing your processes/controls
    – Jim B
    May 17, 2010 at 21:34
  • 3
    I feel like I should point out that if you perform any kind of preparation for an audit (beyond anything requested by the auditors), then the audit is completely compromised. It's supposed to be an evaluation of your environment as it currently stands, not a dog-and-pony show where you gloss over the true state of play. Sorry, just ranting ;) May 18, 2010 at 2:51

8 Answers 8

6
votes

I have been looking for a general audit checklist since one hasn't been provided by the auditors

That is disappointing. I did this for quite a few years, and it was common practice for us to provide a detailed overview of what would be assessed and why (methodology). We submitted formal requests for information, provided tools for the IT staff to run and collect data, including any potential impact of the collection process (if any). We also had to schedule meetings complete with detailed agendas, which usually meant they knew what to expect. There's no constructive purpose served in sandbagging someone in an initiative like this. Issues are usually aplenty, and most IT staff are open to discussing them if the engagement is kicked off properly.

That said, there are plenty of checklists out there if you look. But the primary goal of this effort should be to surface as many issues as possible, prioritize them, and develop action plans for remediation. I wouldn't be too concerned about being "prepared". Since you have started recently, there should be an understanding that the place didn't fall apart overnight.

If the network that you acknowledge is in need of improvement receives a good report, that would probably be a waste of the company's money.

3
  • Agreed. This is a company wide audit and the rest of the departments aren't being given anymore information than I am. The only thing we seem to know for sure is that it is 3 weeks long.
    – PHLiGHT
    May 17, 2010 at 23:54
  • 1
    That sounds like an "efficiency" audit.
    – Warner
    May 18, 2010 at 3:20
  • 2
    Or someone thinking of buying the company. May 18, 2010 at 5:38
8
votes

I'm going to make a rash assumption and assume that you're asking about how to prepare for an internal security audit with a focus on technology, perhaps even a penetration test.

How you prepare for a security audit on the technology side is going to depend on the goal of the audit. If the goal is for it to define the specification for how you improve your infrastructure, you might do nothing. If the goal is to insure that no gaps remain, I'd recommend performing a gap analysis before the audit and correcting any gaps discovered.

For fundamental IT best practices I'd recommend referencing the PCI DSS. Of course, it includes obvious things you should be doing already like patching your software for security vulnerabilities.

To replicate a security audit I'd start with reviewing the penetration testing methodology detailed in the Open Source Security Testing Methodology Manual. (OSSTMM)

If you are looking for further details, I would encourage you to re-write your question to be less ambiguous.

2
  • 4
    +1 "I would encourage you to re-write your question to be less ambiguous." - Auditors don't just show up demanding things. They're hired by someone to test a particular facet of the business; start with who hired them and why; every auditor I've know communicates very well when you simply pick up the phone and call them.
    – Chris S
    May 18, 2010 at 1:53
  • @Chris, you obviously haven't had to deal with the same auditors I've come across. Like any other group of humans, they vary greatly in their ability to communicate. May 18, 2010 at 5:37
5
votes

When you're building machines out you should make sure you hit as many points in the NSA's security guide as is practical (some things may be overkill for your situation):

http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/

And when you do set up machines, you should do so in an automated fashion to each is a cookie cutter of every other to start with. Building "by hand" via installation media can be error prone where you miss things.

Automate! Automate! Automate!

Any semi-regular procedure should be scripted as much as possible. This includes system installation, patching, vulnerability scans/audits, password strength testing.

1
  • 1
    +1 for the great link.
    – nedm
    Sep 5, 2010 at 7:40
2
votes

I recommend you to spent some time reading COBIT, that is Control OBjectives for IT. In fact it's used by many auditing companies to audit IT area.

I also recommend you to use tools such as nessus (that will check your network/servers for vulnerabilities) or mbsa (microsoft baseline security analyser), but it will only check windows hardware.

Since you asked for a starting point, I think this could help you.

1
vote

In my experience when an audit is requested without specifications it generally means an asset audit. This is the worst kind because you then need to find out exactly what the company does have and perhaps whether it's legitimate or not.

Personally, I like to point out that the term "audit" is generic and requires elaboration. I officially do nothing more till I get further and a clearer direction. Unofficially I get real busy and try to make sure anything under my control that could be audited is in as good a shape as I can make it, just to be sure my butt is covered. Then, when I find out what they are actually after, I hand them the most relevant of the audits I have previously prepared on the quite.

0
votes

It isn't practical to go to each machine to make sure its fully updated. This is why OpenVAS exists(OpenVAS is the new free version of Nessus). You can tell OpenVAS to scan every machine on your internal network to identify problem areas. You also need to run it remotely to get an idea of your remote attack surface. You will find problems with your firewall rule sets and machines that are vulnerable to attack.

2
  • I have purchased Kaseya and will be rolling that out soon to address client patching among other things.
    – PHLiGHT
    May 17, 2010 at 20:12
  • @PHLiGHT To be honest paying money for something doesn't always make it better.
    – Rook
    May 17, 2010 at 20:44
0
votes

I would be looking to put together a statement of how you do business. What the current process (if any exists) and what it should/will be future. If it was a penetration test or security type audit they would have told you that and it wouldnt have reach across other departments. probably also need to be prepared to talk about how you can support regulatory compliance for other business units depending on the regulations your company might be under.

0
votes

If I understood well, you need a sort of check list and that seems like a good starting point. There are many suggested ones you can dig out using Internet, but I prefer this one. Along with the auditing topics, you can find additional ones that will be required in time, too

Not the answer you're looking for? Browse other questions tagged .