-: Auditing; auditing is a technical assessment
conducted on applications, systems, or networks.
Auditing is essentially a detective control.
We're looking to make sure everything
was being done correctly, and if anything went wrong,
we can go back and put together those pieces.
Now when you think about auditing,
auditing can be conducted manually or using tools.
For a manual audit, you're going to review
the organization's security logs,
access control lists, user rights and permissions,
their group policies, their vulnerability scans,
their written organizational policies,
and you may interview personnel.
When I think of auditing, especially on the exam,
think of the fact that logs are part of auditing
because those get tied together very frequently
inside the auditing concept.
Now when we talk about auditing, there's also software tools
that we can use to conduct auditing.
Programs like the built in auditing and logging features
inside Windows and Linux are really useful,
but there's also complex auditing suites available
that you can buy as commercially available products.
As I said, auditing can be a manual process
or an automated one, but usually it's a combination of both.
When I conduct security audits
of an organization's security,
I usually first sit down with their leadership
and determine what the scope of the audit is going to be.
I want to ensure that they have good backups
of the network before I get started.
Then I'll scan their network for vulnerabilities
using a vulnerability scanning tool,
and while that's being run, then I'll go back
and I'll start looking at their policies
and interviewing their people and doing all that
offline type of stuff.
Then I can bring it all back together,
collate all that data, come up with a prioritized plan
of action, and then I can tell them
what kind of risks they need to mitigate first,
and which are the things they need to put money towards
to best secure their network much more quickly
and more efficiently.
This is the whole idea of auditing.
It's when you go into a network
and you start figuring out exactly what
that security posture is, and make sure
things are being done right, and logs
are a big part of that, because it's going to tell you
whether things really are being done that way,
or if they're not.
(digital buzzing)