The Mythical Audit, IT Security Conf., Oct. 2002

The Mythical Audit PointMignona CoteSenior Manager,Security VulnerabilitiesNortel NetworksWhy this Topic?Agenda• The Control Expert• One Size Fits All• The Real World• A Case Study• Let’s ProgressThe Control Expert• Knowledge• Training• Experience• ChecklistsFirewallDatabaseApplication ServersRemote AccessKnowledgeBusiness Back Office ApplicationsPartnerRASFront Office SystemsWireless AccessUNIX, Windows NT,VPNOutlook, DevelopmentInternetRemote UsersDo we know the controls tosecure this environment?TrainingHave we been trainedto understand themagnitude of risk?ExperienceWhere do we draw the line?Does our experience within technologylet us know the acceptable risk?let us know the acceptable risk?ChecklistsMAJOR CONTROL CATEGORIES BaaN SAP 1.5 Security AdministrationDocumentation Process and Standards XX XCorporate ProceduresCorporate StandardsLogin Controls XPracticesChange Control ProceduresOS Controls X Verify UNIX Directory Structure1.6 AuthenticationVerify root login disabledChange Control XX Xroot login limited to console on HP systemsIdentify users with root accessDisaster Recovery Planning XDatabase Management / Controls XTransport of Data XX XDeveloper Access Controls XExemptions XApplication Auditing Processes XX XNext Scheduled Revalidation 28-Dec-02 28-Aug-02One Size Fits AllAudit ReportPerform Any Function ApplicationWe recommend:– Privileged access be limitedto a prime and a backup– DRP be ...