Network and Telecommunications Audit Revised on 2014

Why we need to audit network? Proliferation of computers Increased integration of systems Ramification of network failure CISB424, Sulfeeza

Network Vulnerabilities Three (3) primary areas which network may be seen as vulnerable: Interception of data transmitted over the network Availability of communications for operations Unauthorized access through entry points CISB424, Sulfeeza

Network Vulnerabilities CISB424, Sulfeeza

Risks related to failures in network security Loss of reputation Loss of confidentiality Loss of information integrity User authentication failure System unavailability CISB424, Sulfeeza

1. Loss of Reputation CISB424, Sulfeeza

1. Loss of Reputation CISB424, Sulfeeza

Controls that can be implemented to reduce the risks of network failure Interception of data: Good physical and logical security of network infrastructure and equipment Eg: Firewall Encryption Eg: Digital Certificate, Digital Signature CISB424, Sulfeeza

Controls that can be implemented to reduce the risks of network failure Availability of communications: Good network architecture and monitoring. To ensure that between every resource and an access point there are redundant paths and automatic routing to switch the traffic to the available path (in case of communication failure) without loss of data or time. Every component in the network needs to be fault-tolerant or built with suitable redundancies. CISB424, Sulfeeza

Controls that can be implemented to reduce the risks of network failure Unauthorized access: Limit the type of traffic that can come in or go out of the network Limit the origin and destination of the traffic (may allow traffic only from systems with specific addresses) Installing appropriate intrusion- detection systems CISB424, Sulfeeza

Auditing Network Security Steps for IT auditors: What is network? What are the critical information assets in the network? Who has access? What are the connections to the external network? CISB424, Sulfeeza

Auditing Network Security What is network? Review extent of network by examining the network diagram Assess adequacy and accuracy of network diagram Ascertain what processes exist to update and maintain network diagram CISB424, Sulfeeza

Auditing Network Security What are the critical information assets in the network? Identify the critical assets, systems and services that need to be secured Assess whether systematic risks assessment is adopted CISB424, Sulfeeza

Auditing Network Security Who has access? Identify who has access and for what purpose? Assess adequacy of given access privilege Assess impact of given access privilege to the network security CISB424, Sulfeeza

Auditing Network Security What are the connections to the external network? Assess the security impact of connections to external network CISB424, Sulfeeza

Social Engineering Example of one of the common threats to network security Definitions: Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information (Source: http://en.wikipedia.org/wiki/Social_engineering_(security) Social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures (Source: http://searchsecurity.techtarget.com/definition/social-engineering) CISB424, Sulfeeza

Common social engineering attacks Email from a friend Phishing attempts Baiting scenarios Creating distrust Social Engineering tips CISB424, Sulfeeza

A Sample Case In 2007, a mystery man who remains at large burgled safety deposit boxes at an ABN Amro bank in Belgium, stealing diamonds and other gems weighing 120,000 carats, in all. He visited the bank during regular business hours, overcame all of the bank's exceptional security mechanisms, and walked right out the door with €21 million (roughly $27.9 million at the time) worth of gemstones with no one the wiser, using absolutely no technology whatsoever. "He used one weapon -- and that is his charm -- to gain confidence," Philip Claes, spokesman for the Diamond High Council, said at the time. "He bought chocolates for the personnel, he was a nice guy, he charmed them, got the original of keys to make copies and got information on where the diamonds were. "You can have all the safety and security you want," said Claes "but if someone uses their charm to mislead people it won't help." CISB424, Sulfeeza