A significant number of security breaches that compromise information assets occur due to human error and the failure to secure the physical aspects of the network environment.

An Environmental Audit examines the physical aspects of the network to uncover weaknesses and human error before they can be exploited. Below is a sampling of the areas commonly included in an audit by Leading Change, Inc.

Phase 1: Initial Discovery

• Review all current literature, work papers and org charts of the enterprise
• Review all network maps and building room charts/layouts
• Identify all system security software packages used at the enterprise
• Review all connectivity points to the network
• Review all controls, including wire line circuits, client/server LAN connections, WAN connections, trading partner and vendor connections, temporary connections, undocumented connectivity (rogue modems), security and connectivity contracts paying special attention to:
  • a. Usage, access and traffic details
  • b. Monitoring of Traffic
  • c. Status of licenses and agreements
  • d. SLA performance issues
  • e. Telecom agreements and SLA
• Review results from any prior system or physical audits
• Meet with all network/IS management to outline objectives of audit
• Meet with outside vendors to discuss their role in handling traffic
  • Monitoring and maintenance of firewall
  • Document their Intrusion Detection System and ask to access the logs to review traffic
  • Obtain permission to run a Vulnerability Assessment on the external IP addresses at no charge to outside vendor

Phase 2: Completing Discovery/Analysis

• Review future expansion plans for the organization or anticipated changes affecting the network with IS Management
• Review any existing Disaster Recovery and Business Continuity Plans currently in place or under development
• Review any existing security policies for network, Internet, telecom and environment of the enterprise
• Review all storage/backup procedures in place/offsite/onsite
• Review job descriptions of personnel connected with network management and review access levels of all personnel connected to the IS function
• Retain and examine all network traffic logs (determine time period based on activity and size of network) looking for system performance reports of service levels
• Determine what DBMS security features are now being utilized
• Review all known operating system vulnerabilities and query management on system performance
• Review all user password policies and physical access policies if not addressed in any existing network security policy
• Review all daily processes for database start-up, shut down, special requests, and problem tracking and resolution
• Is the network segmented?
• Are there any internal firewalls?
• What routers, hubs, muxes or data circuit equipment is on premise?
• Analyze all OS and network data recovered in phase one; design prevention/maintenance plan to include in audit

Return to SecureIT