I am an auditor for IT and Cybersecurity.

I am often at client site where I have to review settings on servers and computers, all different operating systems, Oracle databases, even legacy like Solaris.

The job of checking compliance takes hours by hand and is a waste of productivity. Essentially, it is a colouring in exercise where I compare their setting (password uses reversible encryption) to the CIS standard (do not use reversible encryption) which in this case would be a fail.

While I think what I am asking for is possible with Nessus, clients are often unhelpful and instead I have to go through several word and excel files by hand. It is tedious comparing each thing to our hardening standard (CIS hardening standard) and highlighting red if they do not meet it.

I am planning to write a script in python but I doubt the clients would be helpful and allow us to use it.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.