‫Now, a computer security audit is a manual or systematic, measurable technical assessment of its system
‫or application.
‫Security audit assessments include reforming security vulnerability scans for best practices.
‫Interviewing staff to understand the level of information security awareness.
‫Reviewing the access controls of the applications and operating systems and analyzing the physical access
‫to those systems.
‫An important point to take into consideration is in order to be able to get the most accurate results,
‫we should perform the security audits with admin privileges.
‫Now, perhaps a major question is, where can we find the best practices to perform security audits?
‫Good question.
‫Thankfully, there are some organizations and consortiums which regularly publish and update the security
‫audit checklists of IT systems.
‫And these are the most popular organizations to collect checklists from.
‫The center of Internet Security is a non-profit organization formed in October of 2000.
‫Its mission is to quote, identify, develop, validate, promote and sustain best practice solutions
‫for cyber defense and build and lead communities to enable an environment of trust in cyberspace.
‫End quote.
‫Now they call checklists benchmarks, but benchmarks are not the only thing that they're known for.
‫In fact, if you are administering IT systems.
‫See, I security dawg should be one of your home pages.
‫Bookmark it right now.
‫I'll wait for you.
‫And I asked the National Institute of Standards and Technology, it's a physical sciences laboratory,
‫as well as a non regulatory agency of the United States Department of Commerce.
‫Its mission is to promote innovation and industrial competitiveness.
‫If you visit their website shown in the slide here, you'll find that national checklist program repository
‫of their national vulnerability database program.
‫They have a wide range of up to date checklists.
‫To help system admins automates the audit.
‫A couple of checklist formats have been created by these organizations.
‫If you can create your own programs or scripts, according to these standards, you'll be able to use
‫a massive number of checklists to audit your systems.
‫I'll let you know what some of the best known checklist standards are.
‫Ex CC KDF, the EX CDF acronym, stands for Extensible Configuration Checklist Description Format.
‫Mm hmm.
‫However, as the name suggests, the language is used to describe the security checklists, the language
‫designed to support information interchange document generation, organizational and situational tailoring,
‫automated compliance testing and compliance scoring.
‫Oval, the Oval acronym, stands for open vulnerability and assessment language.
‫Oval is declared of language for making logical assertions about the state of a system.
‫Its main component is this cap standard.
‫It's used to describe security vulnerabilities or desired configuration of systems.
‫Oval definitions define secure state of some of the objects in a computer, for example, configuration
‫files, file permissions, processes, oval definitions are evaluated using an interpreter called scanner.
‫You can, of course, create your own tool to automate your audits or use the tools created before CIA
‫security has a tool.
‫It's called cis cat.
‫CI Security Configuration Assessment Tool, which automates benchmarking of a number of operating systems.